Platform category · 2 min read
Jump-start: choosing an IAM platform
Short answer
Choose an IAM platform by writing down your real scenarios first (workforce, customer, partner, API), then shortlisting products by deployment model and standards support, running a time-boxed proof of concept on your hardest scenarios, and checking operations, cost and exit options before you sign.
Key takeaways
- Requirements come from scenarios, not feature lists.
- Standards support (SAML, OIDC, OAuth extensions, SCIM, FIDO2) protects you from lock-in.
- A proof of concept on your hardest integration beats any demo.
Buying an IAM platform is a long commitment: every application will integrate with it, and replacing it later is expensive. A structured selection reduces the chance of regret.
Step 1: What are your scenarios?
List who signs in to what, from where, and how strongly they must be verified.
Write short scenarios such as "an employee opens a SaaS app from a personal phone", "a customer signs up with Apple and adds a passkey", "a partner's staff reach our portal with their own IdP", "a service calls an internal API". Rank them by importance and difficulty.
Step 2: Which deployment model fits?
Identity-as-a-service, self-managed software, or a mix.
| Model | Strengths | Watch for |
|---|---|---|
| IDaaS | No infrastructure, fast updates | Data residency, customization limits |
| Self-managed | Control, deep customization | Patching, scaling, staffing |
| Hybrid | Gradual migration | Two systems to run |
Step 3: Which standards must be supported?
At minimum SAML 2.0, OpenID Connect, OAuth 2.0 with PKCE, SCIM 2.0 and FIDO2/WebAuthn.
Then the extensions your scenarios need: PAR, DPoP, token exchange, CIBA, device flow, FAPI profiles. OpenID Foundation certification lists show which products have passed conformance tests. Build test requests in the Authorization URL Builder to check behavior during evaluation.
Step 4: Run a proof of concept
Time-box it, use your hardest scenarios, and include operations.
- Integrate one legacy app, one SaaS app and one API.
- Rotate a signing key and watch what breaks.
- Recover a locked-out user.
- Export configuration and users.
Step 5: Check the exit
Confirm you can export users, credentials where possible, configuration and logs.
Platforms get acquired, renamed and retired. Standard protocols at every integration point keep migration manageable. If you plan to hire help, see how to choose an integration partner.
Questions
Should we buy one platform for workforce and customer identity?
Sometimes. Workforce and customer identity differ in scale, user experience and privacy needs, and many organizations run separate platforms. A single platform can work if it handles both well in your proof of concept.
Cloud service or self-managed?
Identity-as-a-service removes infrastructure work and gets updates continuously. Self-managed software gives more control over data location and customization. Regulatory needs, latency, integration with on-premises systems and team skills decide.