Deepak Gupta

How to Choose a CIAM Platform

CIAM · practitioner · 9 min read · last reviewed 2026-08-15

Do not pick CIAM from a logo grid. Decide whether you need it, score five questions that discriminate, bake off four flows, and know when to stay.

TL;DR

You need CIAM when two triggers hit: SSO demand, a compliance regime, login firefighting, or more than one app or user type.
The five questions: who is the user, what deal is blocked, build vs hosted vs self-host, can you leave, who pages at 2 a.m.
Bake off SSO, social login, password-hash import, and consent export. Four weeks, three vendors.
Model three years of MAU, including enterprise SSO seats, not the year-one coupon.
Stay if you already depend on a feature the next vendor will make you rebuild and no deal is blocked.

Most teams pick a CIAM platform the way they pick a CRM: three demos, a pricing page, the logo they already recognize. Six months later they are fighting the data model, the MAU bill, or a SAML feature that was "on the roadmap." What Is CIAM tells you whether you are in this category. This page is how to choose, and when to stay on what you have.

I built a CIAM product and I have been the buyer. The useful question is not "which vendor is best." It is which failure you are trying to avoid: conversion friction, an enterprise SSO deal, a compliance hole, or a bill that scales against you.

Decide if you need CIAM at all

You do not need a platform on day one of a single app with email-and-password and no enterprise buyers. You need one when two or more of these are true:

A prospect has asked for SAML or OIDC SSO
You are on the hook for GDPR, CCPA, or a SOC 2 narrative that includes customer login
Engineers are doing security firefighting on the login endpoint
You have more than one app or more than one user type sharing identity
Password resets, account takeover, or consent export are becoming a product

If none of those have happened, buy a managed auth API, turn on MFA and passkeys, and stop. The solo-founder stack is that setup. Revisit when a trigger fires, not when a conference tells you to.

The five questions that actually discriminate

Vendors will drown you in feature matrices. Score these instead.

1. Who is the user? External customers (CIAM) versus employees (workforce IAM) versus both. Pointing Okta Workforce at a signup page is a structural mismatch, not a discount. If you need both, you need a product that models them separately or you need two systems.

2. What is the first enterprise deal blocking on? If it is SSO, you are buying SAML plus SCIM, not a growth story. If it is consent and deletion, you are buying a preference center and an export API, not another social-login tile.

3. Build, buy hosted, or self-host? Roll-your-own is how small teams ship breaches. Hosted CIAM is the default. Self-host (FusionAuth, Keycloak, and kin) is for data-residency or cost curves that hosted MAU pricing cannot survive. Model three years of MAU, not the year-one coupon.

4. Can you leave? Password hash export, standard protocols, and no proprietary Rules language as the only place business logic lives. Read Migrate off Auth0 before you sign Auth0. The same questions apply to every vendor. If hashes cannot leave, you do not have a vendor. You have a hostage situation.

5. Who owns login when it breaks at 2 a.m.? A platform with status history, regional failover, and a support path you have tested. Identity is on the revenue path. "Best developer experience" does not page itself.

The directory version of the market is in Top CIAM solutions and CIAM Compass. Use those to build a shortlist of three. Do not start with ten.

A shortlist pattern that does not waste a quarter

If your trigger is	Shortlist shape	Watch for
First B2B SSO deal	Hosted SSO API or CIAM with SAML/SCIM out of the box (WorkOS, Auth0, Stytch class)	SSO tax on your pricing to the customer
Consumer scale + social + consent	Full CIAM (LoginRadius class, or a consumer-tuned Auth0/Stytch)	MAU pricing vs actual monthly actives
Passwordless-first	Specialist (MojoAuth class) or CIAM with passkeys as a default, not a checkbox	Recovery design
Microsoft estate, employees and customers	Entra External ID plus a clear split from workforce	Customer UX that feels like Office
Data residency or MAU revolt	Self-host or a vendor with a documented export	You now own uptime

Run a four-week bake-off, not a six-month architecture. Implement one SSO connection, one social login, one password hash import, and one consent export on each finalist. The vendor that cannot do those four on a trial is telling you the truth.

Pricing the thing honestly

The invoice is not the identity tax. Conversion leak, SSO as a deal gate, and breach insurance are the rest. I wrote that accounting in The Identity Tax. For this decision:

Price on a realistic MAU curve, including the SSO seats you will give enterprise
Count professional services if the "we support SAML" slide assumes a services engagement
Count the year-two migration if the contract is only cheap because leaving is expensive
Do not pick the cheapest hosted plan and then build a custom authorization system next to it. That is how you pay twice. RBAC vs ABAC is the authorization half, and it is not free just because login was.

When to stay

Stay if MAU is flat, you already rely on a feature the next vendor will make you rebuild (Organizations, a mature FGA, a consent store you actually use), and no deal is blocked. Leaving for a blog post is how teams spend two quarters to save a bill they misread. Migrate off Auth0 and Akamai Identity Cloud exist for the cases where staying is the expensive choice.

Failure modes

Buying workforce IAM for customers. The failures are scale, consent, and self-service, not a missing feature checkbox.
Buying on the homepage comparison grid. Bake off the four flows above.
Ignoring export. You will care on the day the invoice jumps.
Putting business logic in proprietary hooks. That logic is the migration.
Starting the RFP before you know the trigger. You will buy a platform for a problem you do not have.

Key takeaways

Workforce IAM pointed at a signup page fails on scale, consent, and self-service.
If hashes cannot leave, you have a hostage situation, not a vendor.
Business logic in proprietary hooks is the migration.
The cheapest hosted plan plus a custom authorization system is paying twice.
Start the RFP after you know the trigger, not after a conference.
A four-week bake-off beats a six-month architecture.

Frequently asked questions

Do I need CIAM or can I keep building auth?: Keep building only while you have one app, one user type, and no serious compliance or SSO demand. Move when two triggers hit. Size is the wrong variable.
CIAM or workforce IAM?: Customers versus employees. The protocols overlap. The product does not. Do not point a workforce tool at registration.
How do I compare Auth0, Stytch, WorkOS, and the rest?: Shortlist three against your trigger, then implement one SSO connection, one social login, one hash import, and one consent export on each. The matrix on a homepage will not decide this.
Should I self-host?: Only for data residency or a three-year MAU curve that hosted pricing cannot survive. You now own uptime.
When should I stay on my current vendor?: When MAU is flat, you rely on a feature you would have to rebuild, and no deal is blocked. Leaving to save a misread bill is a two-quarter mistake.