Look for a tool that governs access across the full identity lifecycle—not just one that signs users in. It should automate joiner, mover, and leaver changes; manage access requests and approvals; support recurring access reviews; enforce roles and segregation-of-duties rules; integrate with the systems you use; and preserve audit evidence. Then check whether “free” means zero license cost or genuinely low total operating cost.
What identity governance needs to cover
Identity governance helps an organization decide who should have access, manage how that access changes, review whether it is still appropriate, and show that the controls were followed. Evaluate complete workflows rather than a feature checklist: a system may list a capability but still lack the connector behavior, context, or operational fit your environment requires.
As an Amazon Associate I earn from qualifying purchases.
Joiner, mover, and leaver lifecycle
Check whether the tool can create, update, suspend, and remove accounts when someone joins, changes role, or leaves. Ask which identity source provides those events, how reliably changes reach target systems, and how the tool handles a failed or incomplete offboarding action. A process that disables the main account but leaves access in other applications is not complete lifecycle governance.
Access requests and approvals
Test the request path from the employee’s perspective, then follow the approval through to provisioning. Confirm who can approve, whether approvals can be delegated, whether access can be time-limited, and what happens when an approver rejects or ignores a request. Evolveum’s midPoint documentation describes an approval engine for access requests; Microsoft describes entitlement management and lifecycle workflows. midPoint roles and policies documentation and Microsoft Entra ID Governance overview.
Access reviews and certification
Reviewers need enough context to make a meaningful decision, a clear way to revoke access, and a record of the decision. Check how review campaigns are scoped, how overdue reviews are treated, and whether revocation is tracked through completion. midPoint documents access certification as a process in which appropriate reviewers certify whether user access remains necessary. midPoint access certification documentation.
Roles, entitlements, and separation of duties
Determine whether the tool can represent business roles, maintain their assignments, and identify or prevent incompatible combinations of access. Ask how exceptions are approved and recorded. midPoint documents role-based access control (RBAC) and segregation-of-duties checks; Microsoft identifies separation-of-duties controls among its governance scenarios. midPoint roles and policies documentation and Microsoft Entra ID Governance overview.
Connectors, reconciliation, and audit evidence
List every application and directory the tool must govern. For each, verify whether its connector can read and write the operations you need, how it reconciles existing accounts with identity records, and how it reports and recovers from errors. Protocol support is not proof that every application operation is supported. Microsoft documents cloud and on-premises application support and integration through standards such as SCIM, SAML, and OpenID Connect; midPoint describes connectors and synchronization. Also verify that decisions, changes, approvals, and review outcomes can be searched and exported in a format your auditors can use. Microsoft Entra ID Governance overview and midPoint documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
What “free” means in practice
Separate license fees from the cost of deploying and operating the system. Include infrastructure or hosting, implementation, connector development, staff skills, upgrades, support, monitoring, and recovery. A free license can still demand substantial engineering and administration.
Evolveum describes midPoint as open source with zero license cost and identifies professional services as part of its commercial model. That makes midPoint a candidate to assess—not a claim that a deployment has no cost. Evolveum midPoint product page.
For Microsoft Entra ID Governance, do not infer that governance features are included just because an organization uses Microsoft identity services. Microsoft’s licensing documentation maps capabilities across Free, P1, P2, Governance, and Suite tiers, and its overview says use of the governance feature set requires Entra ID Governance or Entra Suite licenses. Check current feature eligibility, scope, and licensing for your tenant and geography before budgeting. Microsoft Entra ID Governance licensing fundamentals.
Rank #4
How the candidates differ
| Candidate | What its official material establishes | What to verify |
|---|---|---|
| midPoint | Evolveum documents provisioning and deprovisioning, synchronization, request approvals, RBAC, segregation of duties, connectors, audit and reporting, identity lifecycle, and access certification. Evolveum describes it as open source with zero license cost. Evolveum product page and midPoint certification documentation. | Whether its connectors, deployment model, support arrangements, and operating demands fit your systems and team. |
| Microsoft Entra ID Governance | Microsoft documents lifecycle governance, access reviews, entitlement management, and privileged identity management. Its licensing materials place features across multiple tiers. Governance overview and licensing fundamentals. | Which features your tenant can use under its current licenses, and the applicable scope and geography. |
| Keycloak | Its official product description centers on application authentication, single sign-on, and identity brokering. Keycloak product site. | Whether it can meet your broader governance needs. The product description alone does not establish lifecycle governance, access certification, approval workflows, or audit controls as a replacement for IGA. |
These descriptions establish areas to investigate, not a neutral head-to-head performance ranking. An IAM or SSO product should not be treated as a full identity governance and administration (IGA) replacement without validating the governance workflows you require.
Run a proof of concept against your actual work
Ask each candidate to demonstrate the same scenarios in a representative test environment. Include the identity sources and applications that matter, rather than relying on a generic demo or connector list.
- Joiner: Create a person from the authoritative identity source and verify that the right accounts and entitlements are provisioned.
- Mover: Change that person’s role and check that appropriate access is added, obsolete access is removed, and policy conflicts are detected.
- Leaver: Trigger departure and confirm access is removed across every in-scope system, with errors visible and recoverable.
- Request: Request an entitlement, route it to the correct approver, and test rejection, delegation, expiry, and an unanswered request.
- Certification: Have a reviewer assess access, record a decision, revoke an entitlement, and verify the outcome and audit trail.
- Reconciliation and audit: Introduce an account or change outside the normal workflow, then check whether the tool detects it and can report the relevant decisions and actions.
- Operations: Exercise the deployment, monitoring, upgrade, backup, and recovery tasks your team would own, and record the staff effort involved.
Compare candidates on the supported identity population and systems; lifecycle automation; request and approval workflows; certification and revocation; role and segregation-of-duties policy depth; audit and reporting; connector write capability and maintenance; deployment model; staff effort; support; and total cost over the period you expect to operate the tool.
Evolveum publishes claims of 18 million managed identities in one deployment and scalability to 100 million identities; the publication year is not stated on the product page. These are vendor claims, not independent benchmarks, so use them to frame questions rather than substitute for testing representative workloads. Evolveum midPoint product page.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
