What it is
Identity and access tools decide who can sign in, to what, and with how much power. Most attacks on smaller companies now start with an account rather than a piece of malware: a reused password, a phished login or a former employee whose access was never removed. Getting identity right closes a large share of those doors.
The category covers several product types that are often sold together but solve different problems:
- Single sign-on (SSO) and multi-factor authentication (MFA) give people one login for many apps and require a second factor. This is the foundation of identity and access management (IAM).
- Identity governance handles the lifecycle: granting access when someone joins, changing it when they move roles, removing it when they leave, and running periodic access reviews.
- Privileged access management (PAM) controls admin accounts, shared credentials and service accounts, often with checkout, session recording and just-in-time elevation.
- Password managers store and share credentials for the systems that will never support SSO.
- Customer identity platforms add login to your own applications. These are a different purchase from workforce identity, so be clear which one you need.
Signs you need it
- Offboarding is a checklist someone works through by memory, and you are not sure every account gets closed.
- Staff share passwords in spreadsheets, chat messages or sticky notes.
- MFA is on for email but not for VPN, remote access, payroll or cloud admin consoles.
- Several people use the same domain admin or cloud global admin account.
- An auditor, insurer or customer asked for evidence of access reviews and you had nothing to show.
- You keep finding apps that someone signed up for with a work email and nobody in IT knows about.
What to look for
- App coverage. Check that the apps you actually use support the integration level you need, because a gap means a manual process remains.
- Phishing-resistant MFA options. Support for passkeys or hardware keys matters because codes sent by text or simple push prompts can be phished or fatigued.
- Automated provisioning and deprovisioning. Connecting to your HR system or directory removes the human memory step from offboarding.
- Conditional access. Rules based on device health, location and risk let you tighten access without blocking everyone.
- Privileged account controls. Separate, monitored admin accounts limit the damage a single stolen login can do.
- Break-glass and recovery. You need a tested way back in if the identity provider itself has an outage or is misconfigured.
- Audit logs you can search. Investigations and audits both depend on knowing who signed in where and when.
Mistakes to avoid
- Rolling out MFA to everyone except executives and IT admins, who are exactly the accounts attackers want.
- Treating SSO as finished when the login works. Provisioning, deprovisioning and reviews are where the risk sits.
- Leaving local admin rights on every laptop because removing them causes tickets.
- Forgetting service accounts and API keys. They rarely have MFA and often have broad permissions.
- Buying a governance platform before you have a clean list of apps and owners. The tool will automate the mess.
- Locking yourself out with a conditional access policy that has no tested exception.
Questions to ask vendors
- Which of our current apps support SSO and automated provisioning with your product, and at which plan tier?
- What phishing-resistant MFA methods do you support, and can we enforce them by group?
- How does offboarding work end to end, from the HR record to app access removed?
- How do you handle service accounts and shared admin credentials?
- What happens to our users if your service is unavailable?
- How long are sign-in and admin logs retained, and can we export them?
- What does a typical rollout take for an organization our size, and what do we have to do ourselves?
- Are features we need, such as conditional access or access reviews, included or sold as add-ons?
What drives the cost
Most identity products are priced per user per month, so headcount is the base driver. Feature tiers matter more than they first appear: SSO may be included while provisioning, conditional access or governance sit in a higher plan. Some application vendors also charge extra to enable SSO on their side, which can be a hidden cost. PAM and governance tools add per-admin or per-connector pricing in some cases.
The bigger cost is often effort. Cleaning up your app inventory, mapping roles, connecting your HR source, migrating users to new MFA methods and handling exceptions all take time. Phased rollouts reduce disruption but stretch the project.
Where Tabor Point can help
Tabor Point runs cybersecurity audits that include a structured review of identity and access alongside email, devices, cloud apps, backups and vendor access. Findings are ranked by risk with a remediation roadmap, which helps you decide which identity tool you actually need and in what order. If you want a second opinion before you buy, Tabor Point can help.
