Top 10 CIAM Solutions (2026): CIAM Vendors and Platforms Ranked

Most CIAM shortlists fail for one reason: teams compare every vendor on one generic feature list, then discover the MAU bill, the missing enterprise SSO, or the migration lock-in after launch. The direct answer is to pick by job. Auth0 is the safest generalist for mixed B2C and B2B apps. Microsoft Entra External ID wins in Microsoft shops, Ping Identity in banking and hybrid deployments, and IBM Verify when governance must sit next to login.

Below that tier, WSO2 is the open-source, self-hostable enterprise option, MojoAuth is the passwordless-native pick, Amazon Cognito is the AWS-native default, and SSOJet, WorkOS, Stytch, Descope, and Clerk cover specific developer and B2B SaaS jobs. This page is the full ranking, the enterprise comparison, and a pick-by-job table in one place.

Last verified: September 2026. Every price, free tier, acquisition, and product rename below was re-checked against vendor pricing pages, vendor documentation and changelogs, analyst announcements, and acquisition press releases. See How we evaluated for the method.

If you are still getting oriented on what CIAM is and how it differs from workforce IAM, start with the complete CIAM guide or the IAM vs CIAM comparison. If you want every vendor in the market with facts only and no ranking, use the CIAM providers directory.

Quick answer: pick the CIAM platform by job

There is no single best CIAM. There is a best CIAM for a job. Pick the row that matches your job this quarter and ignore the rest. If two jobs are both true (a Next.js login and enterprise SSO, for example), do not average two vendors. Read both profiles and decide which job matters more now.

Job	2026 pick	Runner-up	Avoid for this job
Mixed B2C plus B2B, broad SDKs, packaged agent identity	Auth0	Stytch (Twilio)	Clerk as the only vendor
Microsoft 365 and Azure shop	Entra External ID	Auth0	Cognito
Banking, government, hybrid or on-prem	Ping Identity	IBM Verify	Developer-first SaaS tools
Identity governance bundled with CIAM	IBM Verify	Ping Identity	Clerk, Firebase Auth
Self-hosted enterprise, data sovereignty	WSO2 Identity Server	Keycloak	Auth0 (cloud only)
Self-host with lighter operations	FusionAuth	Keycloak	Auth0 (cloud only)
Native passkeys and passwordless	MojoAuth	Stytch	Descope, Cognito default UI
Identity orchestration (visual journeys)	Descope	Authsignal or Corbado overlay	MojoAuth (wrong category)
Enterprise SSO with transparent pricing	SSOJet	WorkOS	Clerk, Firebase Auth
B2B Admin Portal, mature SSO	WorkOS	SSOJet, Frontegg	Cognito
Native Next.js and Node.js apps	Clerk	Auth0	Ping, Keycloak
AWS-native apps, IAM tokens, FedRAMP	Amazon Cognito	Auth0	Clerk
Fintech and high-fraud B2C	Transmit Security	Ping Identity	Clerk, Firebase Auth
SAP Commerce and SAP CX shops	SAP Customer Data Cloud	Auth0	Developer-first SaaS tools
Cut the Auth0 invoice at consumer scale	MojoAuth or Cognito	FusionAuth	Ping, Descope

The top 10 CIAM solutions at a glance

The ranking weighs enterprise fit, analyst standing, authentication coverage, developer experience, pricing transparency, and 2026 agent-identity readiness. Prices are the published entry points as of September 2026. Enterprise tiers are quote-based for every vendor on the list.

Rank	Platform	Best for	Free tier	Paid entry point	Deployment
1	Auth0 (Okta Customer Identity)	Most enterprises, developer-led teams	25,000 MAU	$35/mo (B2C Essentials)	Cloud, private cloud
2	Microsoft Entra External ID	Microsoft-native organizations	50,000 MAU	Per-MAU plus add-ons	Cloud (Azure)
3	Ping Identity (includes ForgeRock)	Financial services, government, hybrid	None	Custom quote	Cloud, hybrid, on-prem
4	IBM Verify	Regulated enterprises, CIAM plus governance	None	Custom quote	Cloud, hybrid, on-prem
5	WSO2 Identity Server and Asgardeo	Data sovereignty, self-hosted enterprise	Open source	Custom subscription	Self-hosted, SaaS, hybrid
6	MojoAuth	Passwordless-native B2C and SaaS	25,000 MAU	$50/mo (5,000 MAU)	Cloud, private cloud
7	Amazon Cognito	AWS-native applications	10,000 MAU (Lite, Essentials)	$0.015/MAU (Essentials)	Cloud (AWS)
8	CyberArk Customer Identity	CyberArk PAM customers, high-security B2C	None	Custom quote	Cloud
9	Transmit Security	Banking and high-fraud consumer apps	None	Custom quote	Cloud
10	SAP Customer Data Cloud	SAP commerce and CX customers	None	Custom quote	Cloud

Two names from earlier editions of this list are gone from the ranked ten. Google Cloud Identity is a workforce product for employee access to Google Workspace and Google Cloud, which Google's own edition guide makes clear. Google's customer-identity product is Identity Platform, the engine behind Firebase Authentication. OneLogin, owned by One Identity since 2021, is primarily a workforce SSO product and is now listed in the CIAM directory instead. ForgeRock is no longer a separate entry because Ping has absorbed and renamed its products.

1. Auth0 (Okta Customer Identity)

Best for: mid-market to large enterprises across most verticals, complex authentication flows, and developer-led teams that need B2C onboarding plus B2B enterprise SSO.

Auth0 has operated as Okta's customer identity product since Okta closed the acquisition in May 2021 for $6.5 billion. It remains the platform most identity teams default to when a CIAM comparison starts. Okta was named a Leader in the November 2025 Gartner Magic Quadrant for Access Management for a ninth consecutive year. Okta's separate workforce product covers employee login and is a different evaluation.

Where Auth0 wins

• Extensibility. Actions, serverless functions that run inside the login flow, let teams add custom risk scoring, compliance logic, or non-standard federation without forking the login flow.
• Broadest SDK and federation library. Social logins, SAML, OIDC, and enterprise connections come out of the box, and nearly every integration question has a public answer.
• Adaptive MFA and passkeys. Adaptive MFA escalates only when device, location, or behavior signals raise risk. Passkeys and FIDO2 are supported natively.
• B2B model. Organizations gives SaaS apps tenant separation, and Auth0 FGA adds Zanzibar-style fine-grained authorization without a second vendor.
• Agent identity. Auth0 for AI Agents reached general availability in November 2025. Its Token Vault gives an agent a scoped, short-lived token instead of a shared API key, with the same audit trail a human session has.

Limitations

• Price curve. The MAU bill climbs steeply above 100,000 users, and adaptive MFA and enterprise features sit in higher tiers. The B2B plans start materially higher than the consumer plans.
• Lock-in. Actions code is proprietary. Moving off Auth0 means rewriting every Action against the new vendor's hooks.
• Learning curve. Teams without a dedicated identity engineer report real effort getting Actions, Organizations, and enterprise connections right on the first pass.

Pricing

Per the Auth0 pricing page, the Free plan covers up to 25,000 MAU with no credit card. B2C Essentials starts at $35 per month and B2C Professional at $240 per month, each priced from 500 MAU. B2B Essentials starts at $150 per month and B2B Professional at $800 per month. Enterprise is quote-based. Annual billing is 11 times the monthly price.

Full profile: Auth0 on CIAM Compass. Leaving Auth0? See the top Auth0 alternatives.

2. Microsoft Entra External ID

Best for: organizations running Microsoft 365, Azure, and Intune, and regulated teams that want phishing-resistant authentication on the same policy engine as their workforce.

Entra External ID is Microsoft's customer identity product and the replacement for Azure AD B2C. Azure AD B2C stopped selling to new customers on 1 May 2025, and Microsoft's B2C FAQ commits to supporting existing tenants until at least May 2030. B2C Premium P2 was discontinued on 15 March 2026. Microsoft was also a Leader in the November 2025 Gartner Magic Quadrant for Access Management, its ninth year running.

Where Entra External ID wins

• One policy engine. Conditional Access applies to workforce and customer identities, and sign-in events flow into Microsoft Sentinel without a separate pipeline.
• Native passwordless. Windows Hello for Business, FIDO2 security keys, Microsoft Authenticator, and synced passkeys are all first-party.
• Agent identity. Microsoft Entra Agent ID reached general availability in April 2026, per Microsoft's Entra release notes. It gives AI agents their own identity inside Entra, with Conditional Access and lifecycle controls.

Limitations

• The integration payoff mostly disappears outside Microsoft's stack. Teams running on AWS or Google Cloud rarely justify it over a cloud-agnostic vendor.
• Developer experience still trails Auth0 for teams without Entra experience.
• Data residency add-ons are narrow. The Go-Local add-on is currently available only in Australia and Japan.

Pricing

Microsoft's External ID pricing documentation uses a monthly active user model, and the Entra pricing page states that core features are free for the first 50,000 MAU. SMS authentication, machine-to-machine tokens, and Go-Local data residency are billed as add-ons. For comparison, workforce Entra ID P1 now lists at $7 and P2 at $10 per user per month.

Full profile: Entra External ID on CIAM Compass. Head-to-head: Auth0 vs Entra External ID.

3. Ping Identity (PingOne for Customers, including ForgeRock)

Best for: financial services, government, and heavily regulated enterprises that need cloud, hybrid, or on-premises deployment and complex federation.

Thoma Bravo took Ping Identity private in October 2022 for $2.8 billion and closed its acquisition of ForgeRock in August 2023. Ping has since renamed the ForgeRock line: ForgeRock Access Management is now PingAM, and ForgeRock Identity Cloud is now PingOne Advanced Identity Cloud. Ping also closed its acquisition of Keyless, a privacy-preserving biometrics vendor, in January 2026.

Where Ping wins

• Regulated-industry depth. PingFederate is one of the most widely deployed federation servers in banking, and many customers have extended it for over a decade rather than replacing it.
• Deployment range. Cloud, hybrid, and on-premises options from one vendor, which no cloud-only CIAM matches.
• Adaptive security. Risk-based access, fraud signals, and now Keyless zero-knowledge biometrics for re-verification.
• Agent identity. Identity for AI reached general availability in March 2026, built on Agent IAM Core, Agent Gateway, and Agent Detection.

Limitations

• Implementation complexity matches the feature surface. Projects usually need dedicated identity engineers and run longer than cloud-native alternatives.
• The ForgeRock merger created portfolio overlap. Expect an account-team conversation about which product in the combined catalog fits your scenario.
• No public self-serve pricing. Every deal is quoted.

Pricing

Custom enterprise pricing based on identity volume and modules. Start at the Ping pricing page, then expect a quote.

Profiles: Ping Identity and ForgeRock on CIAM Compass. Head-to-head: Auth0 vs Ping Identity.

4. IBM Verify

Best for: large regulated enterprises with existing IBM security infrastructure, and organizations that want identity governance bundled with customer login.

IBM dropped "Security" from the name, so IBM Security Verify is now IBM Verify. It includes a dedicated CIAM offering for customers, partners, and citizens, and IBM was a Leader in the November 2025 Gartner Magic Quadrant for Access Management.

Where IBM Verify wins

• Governance plus CIAM. Identity governance and administration sits next to authentication, which matters when access to sensitive data needs periodic certification.
• Threat intelligence. Risk-based access draws on IBM's security portfolio, giving authentication decisions more signal than most CIAM platforms collect alone.
• Agentic AI identity. IBM now markets agentic AI identity management with unique agent identities, governed delegation, and real-time enforcement for human and non-human identities.
• Passwordless and consent. MFA, passwordless login, social sign-on, and consent management for GDPR and CCPA are built in.

Limitations

• Without an existing IBM footprint, the integration payoff disappears and the platform reads as expensive for CIAM alone.
• Developer experience is not IBM's traditional strength. Expect more integration time than Auth0 or Microsoft.

Pricing

Custom quotes based on user volume, modules, and support level. No public price list.

Full profile: IBM Verify on CIAM Compass.

5. WSO2 Identity Server and Asgardeo

Best for: enterprises that want an open-source, self-hostable core with a managed SaaS option, and telecom, banking, and public-sector deployments where data sovereignty decides the deal.

WSO2 is the platform most North American buyers overlook. KuppingerCole named WSO2 an Overall Leader in its 2026 Leadership Compass for CIAM, its fourth consecutive report in that position. EQT Private Capital Asia acquired WSO2 in 2024 in a deal valued at about $600 million.

Where WSO2 wins

• Same product, self-hosted or SaaS. WSO2 Identity Server is open source. Asgardeo is the managed version on the same codebase, so a team can move between them without a rewrite.
• Enterprise federation baseline. SCIM, multi-tenancy, RBAC and ABAC, and full SAML, OIDC, and OAuth 2.0 federation are native.
• Consent and governance depth. Twenty years of federation work shows in consent management and adaptive authentication.

Limitations

• Agent identity is less visible publicly than at Auth0, Microsoft, Ping, or IBM. Ask for the shipped product and roadmap before you buy on a five-year horizon.
• The integration marketplace is thinner outside EMEA and APAC, and self-hosting carries a heavy operational profile.

Pricing

The open-source Identity Server is free to self-host. Commercial support subscriptions and Asgardeo enterprise plans are quote-based.

Full profile: WSO2 Identity Server on CIAM Compass.

6. MojoAuth

Best for: consumer apps and SaaS teams whose job is passwordless enrollment: passkeys, magic links, and OTP as the product rather than an add-on.

MojoAuth is the growing passwordless-native pick. Passkeys, email and SMS OTP, and magic links are the core product, with SDKs across web, mobile, and server languages, plus SAML and OIDC for enterprise connections. Its public pricing table runs from free into enterprise volumes rather than jumping straight to a sales quote.

Where MojoAuth wins

• Passwordless is the product, so enrollment flows and recovery are designed around passkeys first.
• Transparent MAU pricing that scales without a surprise quote, which makes it a credible option when the goal is to cut an Auth0 invoice at consumer scale.
• Hosted login pages or API-first integration, so teams can choose the approach that fits their architecture.

Limitations

• The community is smaller than Auth0's, and there is no FedRAMP authorization.
• It is an authentication layer, not a substitute for the org hierarchies, delegated admin, and SCIM provisioning that full enterprise B2B CIAM needs.

Pricing

Per the MojoAuth pricing page, the Free plan covers 25,000 MAU. Business Pro starts at $50 per month for 5,000 MAU, with higher MAU tiers and a $0.06 overage per MAU above your tier. Enterprise private cloud is custom.

Profile and head-to-heads: MojoAuth on CIAM Compass, MojoAuth vs Auth0, MojoAuth vs Stytch. More passwordless options: the top 10 passwordless CIAM solutions.

7. Amazon Cognito

Best for: startups and enterprises building on AWS that want managed user pools, IAM-native tokens, and one less external vendor.

Cognito handles sign-up, sign-in, and access control for web and mobile apps. User pools are the directory, supporting OAuth 2.0, OIDC, and SAML federation with Google, Apple, Facebook, and enterprise IdPs. Identity pools exchange those identities for temporary AWS credentials to reach services such as S3 and DynamoDB.

Where Cognito wins

• Deep integration with Lambda triggers, API Gateway, and IAM, so serverless apps get authentication with no extra vendor.
• The Essentials tier adds managed login and passwordless sign-in with passkeys, email, or SMS. The Plus tier adds risk-based adaptive authentication and compromised-credential detection.
• No servers, databases, or patches to operate.

Limitations

• A steeper learning curve for teams new to AWS, and core flows are less flexible than specialist CIAM platforms.
• Real AWS lock-in, and password hashes cannot be exported, which makes outbound migration a forced-reset or lazy-migration project.
• B2B features such as organizations and admin portals are thin.

Pricing

Cognito now has three feature tiers. Per the Cognito pricing page, Lite and Essentials include 10,000 free MAU for direct sign-in and 50 free MAU for SAML or OIDC federation. Essentials costs $0.015 per MAU and Plus $0.020 per MAU. Lite starts at $0.0055 per MAU for the first 100,000. Lite user pools created before 22 November 2024 keep the older 50,000 free MAU allowance.

Profile: Amazon Cognito on CIAM Compass. Head-to-head: Auth0 vs Cognito. Leaving Cognito? See the top Cognito alternatives.

8. CyberArk Customer Identity

Best for: existing CyberArk privileged access customers consolidating identity under one vendor, and high-security consumer platforms in finance and e-commerce.

CyberArk built its customer identity product on the Idaptive business it acquired in 2020. Palo Alto Networks completed its acquisition of CyberArk on 11 February 2026 in a deal valued at about $25 billion. CyberArk is now a wholly owned subsidiary, and Palo Alto says the Identity Security Platform remains available standalone.

Where CyberArk wins

• CIAM plus privileged access management from one vendor is uncommon and useful for security-led enterprises.
• Adaptive MFA, risk-based access, and fraud detection inherited from Idaptive.
• Passwordless options, consent management, and unified customer profiles.

Limitations

• Enterprise pricing and a developer experience that trails cloud-native CIAM vendors.
• Roadmap and support terms can shift after a deal this size. Confirm them in writing with the vendor.

Pricing

Custom quotes based on users, features, and deployment. No public price list.

Profile: CyberArk Customer Identity on CIAM Compass.

9. Transmit Security

Best for: banks, fintechs, and high-fraud consumer apps that want CIAM, fraud detection, and orchestration in one platform instead of three vendors.

Transmit Security's Mosaic platform combines identity, risk decisioning, behavioral biometrics, and passkey orchestration. Transmit was named a Leader in the November 2025 Gartner Magic Quadrant for Access Management on its first appearance. It raised a $543 million Series A in 2021 at a $2.2 billion valuation.

• Strength: fraud and identity decisions in one engine, which removes the typical CIAM plus fraud plus orchestration stack.
• Limitation: enterprise-only, quote-based pricing that puts it out of reach for mid-market evaluations.

Profile: Transmit Security on CIAM Compass.

10. SAP Customer Data Cloud

Best for: retailers, manufacturers, and distributors already running SAP Commerce Cloud or SAP Customer Experience.

SAP Customer Data Cloud is built on Gigya, which SAP acquired for about $350 million in 2017. Its strength is joining customer identity, consent, and preference data with SAP commerce and CRM data. Twenty years of B2C consent and preference-center work is uncommon outside this product.

• Strength: a unified view of identity, consent, and transaction history inside the SAP estate.
• Limitation: outside SAP shops, high pricing and a developer-experience gap make it the wrong greenfield choice.

Profile: SAP Customer Data Cloud on CIAM Compass.

Enterprise CIAM: the five platforms that make Fortune 500 shortlists

I built LoginRadius from 2013 into a CIAM platform serving more than a billion identities, competing directly against three of the five platforms below for enterprise deals. This comparison covers what each one does well, where it falls short, and which deployment scenario it actually fits, not the vendor's own pitch deck.

The five enterprise platforms are Auth0, Microsoft Entra External ID, Ping Identity, IBM Verify, and WSO2. All five carry current, independent analyst backing. Gartner named five Leaders in its November 2025 Magic Quadrant for Access Management: Okta, Microsoft, Ping Identity, IBM, and first-time Leader Transmit Security. KuppingerCole's 2026 Leadership Compass for CIAM named five Overall Leaders, among them Ping Identity and WSO2.

What makes enterprise CIAM different

"Enterprise grade" is a specific claim, not a marketing one. It means four requirements at full intensity at once.

• Scale. Tens to hundreds of millions of identities, with login spikes that cannot degrade.
• Compliance. SOC 2 Type II as the baseline, then HIPAA, PCI DSS, ISO 27001, FedRAMP, and regional rules, plus the audit logs and data residency controls customers need to prove their own compliance.
• Federation. Enterprise customers bring Okta, Entra ID, Ping, or AD FS and expect SAML 2.0 and OIDC federation with all of them.
• Organizational structure. Org hierarchies, delegated administration, SCIM provisioning, and RBAC granular enough for an enterprise security team.

B2B-specific platforms such as WorkOS, Frontegg, and SSOJet exist precisely because they do not try to meet all four at once. They are covered in the fast-growing CIAM providers comparison. Picking the wrong tier for your company's stage is the subject of the CIAM vendor selection trap.

Enterprise comparison table

Dimension	Auth0	Entra External ID	Ping Identity	IBM Verify	WSO2
Analyst recognition	Gartner Leader (9th year)	Gartner Leader (9th year)	Gartner Leader; KuppingerCole Overall Leader	Gartner Leader	KuppingerCole Overall Leader (4th report)
Deployment	Cloud, private cloud	Cloud (Azure)	Cloud, hybrid, on-prem	Cloud, hybrid, on-prem	Self-hosted, SaaS, hybrid
Agent identity (2026)	Auth0 for AI Agents (GA Nov 2025)	Entra Agent ID (GA Apr 2026)	Identity for AI (GA Mar 2026)	Agentic AI identity management	Ask the vendor
Passkeys and FIDO2	Native	Native	Native	Native	Native
B2B federation	Strong	Strong in Microsoft estates	Strongest	Strong, plus IGA	Strong
Developer experience	Highest	Moderate	Complex	Complex	Moderate
Pricing model	MAU tiers, public	Per-MAU plus add-ons	Custom	Custom	Free open source plus subscription
Best for	Most enterprises, developer-led teams	Microsoft shops	Finance, government, hybrid	IBM shops, governance	Data sovereignty, EMEA and APAC

How to narrow the enterprise shortlist

• Microsoft-native: start with Entra External ID. The integration advantages are large inside a Microsoft estate.
• Financial services or government: start with Ping Identity. Its hybrid deployment and banking reference base are the default for regulated work.
• Developer speed and ecosystem breadth: Auth0 wins, and its agent-identity product is the most CIAM-native of the launches. Model the MAU bill at your real scale first.
• Governance alongside CIAM: IBM Verify is the strongest single-platform option.
• Data sovereignty or no lock-in: WSO2 is the only enterprise option here that runs the same product self-hosted or as SaaS.

Run your own requirements against the enterprise-ready CIAM checklist, which ranks vendor readiness on SSO, SCIM, audit logs, RBAC, org structures, session policy, and data residency.

Developer-first and B2B SaaS picks

These platforms do not belong in a Fortune 500 incumbent comparison, but they win real budget in B2B SaaS and consumer apps. Each is the right answer for a narrower job.

• SSOJet is the enterprise-SSO pick when commercial transparency matters. Connection-based public pricing, no MAU tax, and a design built for B2B SaaS adding enterprise logos quickly. Per the SSOJet pricing page, the Free plan has unlimited MAU, and Business starts at $79 per month billed annually ($99 monthly). WorkOS still leads on Admin Portal maturity, so model both. See SSOJet vs WorkOS and Frontegg vs SSOJet.
• WorkOS is B2B-first by design. Per the WorkOS pricing page, AuthKit is free for the first 1 million MAU, and SSO and Directory Sync connections start at $125 each. See the top WorkOS alternatives.
• Stytch is the other passwordless-native platform, owned by Twilio since November 2025. Use it for that DNA plus Twilio SMS and WhatsApp. Per the Stytch pricing page, the free plan covers 10,000 MAU and AI agents plus five SSO or SCIM connections. See Stytch vs Descope.
• Descope is identity orchestration, not a passwordless-native product. Its Flows builder is the strongest visual journey designer in the category, and passkeys exist as Flow steps. Per the Descope pricing page, the free tier covers 7,500 MAU and Pro starts at $249 per month billed annually.
• Clerk is the default for native Next.js and Node.js apps. Drop-in UI is real, but the enterprise surface is not: long-tail SAML, Java and .NET, FedRAMP, and ISO 27001. Per the Clerk pricing page, the free plan covers 50,000 monthly retained users per app and Pro costs $25 per month. See Clerk alternatives.
• Frontegg leads on the self-service Admin Portal that end customers' IT teams use, with account hierarchies and fine-grained authorization.
• FusionAuth is the self-host default that is not Keycloak: single binary, usable free Community tier, and a managed option. Keycloak is the open-source standard when zero per-MAU cost matters and you can run it like a database.

Every vendor in the market, including the ones not ranked here, is profiled in the CIAM providers directory and on the identity map's customer identity category.

What changed in the CIAM market in 2025 and 2026

• Palo Alto Networks closed its CyberArk acquisition on 11 February 2026.
• Twilio acquired Stytch, closing in November 2025.
• Ping Identity closed its Keyless acquisition in January 2026 and finished renaming the ForgeRock product line.
• Azure AD B2C stopped selling to new customers on 1 May 2025, and B2C P2 was discontinued on 15 March 2026.
• Akamai Identity Cloud reaches end of life on 31 December 2027, per Akamai's product status page. See the Akamai Identity Cloud migration guide.
• Passage by 1Password was retired on 16 January 2026, so its customers had to move to another passkey provider.
• Amazon Cognito split into Lite, Essentials, and Plus tiers, and the free allowance for new pools fell to 10,000 MAU.
• Agent identity became an RFP line item. Auth0, Microsoft, and Ping all shipped generally available agent-identity products between November 2025 and April 2026.

For the full trend picture, see the state of CIAM 2026 analysis of 200-plus vendor changelogs.

CIAM pricing and migration: what to model before you sign

Most CIAM vendors price on monthly active users. A user who logs in 50 times in a month counts as one MAU, so the model favors highly engaged apps with moderate user bases. Watch three things: the jump at tier boundaries, per-connection fees for enterprise SSO, and security features gated to higher tiers. Clerk counts "retained" users instead, and SSOJet and WorkOS price enterprise connections rather than users.

Switching providers later is possible but painful. Password hashes are the main obstacle, because many platforms use proprietary hashing configurations or, like Cognito, do not export hashes at all. The usual strategies are bulk import with a forced password reset, lazy migration that authenticates against the old system on first login, and a parallel-run period. Plan for three to six months of migration effort for a production app.

Cost at 100,000 and 1 million MAU is modeled in CIAM pricing at scale 2026. Passkey conversion is covered in passkey orchestration vendors 2026. A 90-day exit plan that matches this ranking: Auth0 to MojoAuth.

How we evaluated

Last verified: September 2026. Each platform was checked against its own pricing page, product documentation, and changelog, plus acquisition press releases and analyst announcements from Gartner and KuppingerCole. Prices and free tiers above are the published figures on those pages, not negotiated rates.

Platforms were ranked across eight dimensions:

1. Authentication coverage: passkeys, FIDO2, MFA, social login.
2. Scalability and reliability: documented SLAs and known production scale.
3. Compliance: SOC 2, HIPAA, PCI DSS, ISO 27001, FedRAMP, and regional data residency.
4. Federation and SSO: SAML, OIDC, and B2B federation.
5. Developer experience: SDK quality, documentation, and time to a working login.
6. B2B capabilities: multi-tenancy, SCIM, delegated admin, and org hierarchies.
7. AI agent identity: a shipping product, not a roadmap slide.
8. Total cost of ownership: pricing transparency and how cost behaves at scale.

The standards behind the category informed the security criteria: the FIDO Alliance passkey specifications, the NIST SP 800-63-4 digital identity guidelines, and OWASP application security guidance. The ranking is editorial, with no paid placements. Each vendor's full capability record, with its own verification date, is on CIAM Compass, scored on one capability matrix under a published methodology. If you want a tool to shortlist for you, use the vendor selector.

Frequently Asked Questions

What is the best CIAM solution in 2026?

There is no single winner; the right platform depends on the job. Auth0 is the safest generalist for mixed B2C and B2B apps. Entra External ID fits Microsoft shops, Ping Identity fits banking and hybrid deployments, IBM Verify fits governance-heavy enterprises, and WSO2 fits self-hosted, sovereignty-driven programs.

Who are the top CIAM vendors and providers?

The enterprise leaders are Okta (Auth0), Microsoft, Ping Identity, and IBM, all Gartner Access Management Leaders in November 2025, plus WSO2, a KuppingerCole CIAM Overall Leader in 2026. Transmit Security, SAP, and CyberArk serve specific enterprise niches. MojoAuth, Stytch, SSOJet, WorkOS, Descope, and Clerk lead developer and B2B segments.

What is the difference between a CIAM platform and workforce IAM?

Workforce IAM manages employee access to internal apps with IT-controlled provisioning. CIAM manages customers at consumer scale, with self-service registration, social login, consent management, and progressive profiling. It has to handle millions of unknown users, protect conversion rates, and meet privacy laws such as GDPR and CCPA.

How much do CIAM solutions cost?

Most price per monthly active user. Auth0 is free to 25,000 MAU and starts at $35 per month. Entra External ID is free to 50,000 MAU. Cognito charges $0.015 per MAU on Essentials after 10,000 free. Ping, IBM, CyberArk, Transmit, and SAP quote enterprise deals individually.

Which CIAM platform is best for financial services?

Ping Identity is the most common choice in banking, because PingFederate is widely deployed there and Ping supports hybrid and on-premises models. Transmit Security is the strongest option when fraud detection must sit in the same engine as login. IBM Verify suits banks that need governance bundled in.

What certifications should an enterprise CIAM platform have?

SOC 2 Type II is the baseline. Regulated industries add HIPAA for healthcare, PCI DSS for payments, ISO 27001 internationally, and FedRAMP for US government work. For GDPR, PDPA, or LGPD, verify the platform's actual data residency options rather than assuming a certification covers them.

What to read next

• CIAM providers directory: every vendor, facts only, not ranked.
• What is CIAM? A complete guide: foundation reading before platform evaluation.
• CIAM security buyer's guide: the security questions to put in the RFP.
• The CIAM vendor selection trap: why most B2B SaaS teams pick the wrong provider for their stage.
• Top 10 passwordless CIAM solutions: platforms built for passwordless specifically.

Deepak Gupta is the co-founder and CEO of GrackerAI and an AI and cybersecurity expert with 15+ years in digital identity and enterprise security. He built and scaled LoginRadius, a CIAM platform, to serve over one billion users globally. He writes about cybersecurity, AI, and B2B SaaS at guptadeepak.com.