Identity lifecycle management buyer's checklist: 20 questions for vendors

1. How does the tool handle an application with no connector, no SCIM endpoint and no SSO integration?
2. Can it discover applications that are not in our inventory, and how?
3. Does it find local accounts, service accounts and hardcoded credentials inside applications?
4. What does it need installed or granted in each application to do that?

Public pages answer this unevenly. Saviynt names onboarding of disconnected applications; Orchid Security states discovery of unmanaged and custom applications; Microsoft Entra ID Governance documents a manual CSV process. The coverage ledger has the detail.

5. Which HR systems trigger joiner, mover and leaver events, and how quickly?
6. On a role change, how is the old role's access removed, and when?
7. For leavers, is the account disabled or deleted, and can that differ by application?
8. What happens in applications the tool cannot write to: a ticket, a task, or nothing?

9. Which campaign types are supported: manager, application owner, targeted, role?
10. Can accounts from disconnected applications be loaded into a campaign?
11. How are revoke decisions carried out and confirmed?
12. How does the tool reduce rubber-stamping, for example by auto-certifying low-risk items?

13. What evidence is exported, and is it mapped to SOX, PCI DSS, HIPAA, NIS2 or DORA?
14. For each leaver, can it show the termination date and the date each account was disabled?
15. How long is evidence retained, and can it be exported in a format our auditors accept?

Orchid Security and SailPoint Identity Security Cloud both describe evidence mapped to named frameworks. For the other tools, the pages we reviewed describe audit trails without a framework mapping, so ask.

16. Does it replace our identity provider or IGA, or work alongside them? Which integrations exist today?
17. Where is tenant data held, and is there a regional option such as an EU instance?
18. What is the deployment model, and what network access does it need?

19. What is the pricing unit, and how are contractors and non-human accounts counted?
20. What is included, what is an add-on, and what is charged as services?

Only Microsoft Entra ID Governance publishes a full per-user price among the tools we score. The pricing note sets out what the others publish.

• An answer about disconnected applications that describes only connectors. Ask what happens to the application that has none.
• A leaver answer that covers the directory account but not local accounts in the application.
• An evidence answer that is a screenshot of a dashboard. Ask for the export an auditor would receive.
• A pricing answer that gives a per-user figure without saying whether contractors and service accounts count as users.

None of these is disqualifying on its own. Each is a place where a proof of concept should test the claim instead of accepting it.

Score the answers against the same criteria you would use for a shortlist. The calculator lets you set your own weights on the criteria this site uses, and the proof of concept note turns the most important answers into tests.