Magic Quadrant for Access Management
Gartner defines access management (AM) as tools that include authentication, authorization, single sign-on (SSO) and adaptive access capabilities for modern standards-based web applications, classic web applications and APIs. AM's purpose is to give people (employees, consumers and other users) and machines access to protected applications in a streamlined and consistent way that enhances the user experience. For people, SSO is part of the enhanced experience. AM is also responsible for providing security controls to protect the user session during runtime. It enforces authentication and runtime authorization using adaptive access. Lastly, AM can provide identity context for other cybersecurity tools and reliant applications to enable identity-first security.
No strategic planning assumptions provided.
Vendors must, among other requirements:
A: This research evaluates 13 Access Management vendors across two axes: Ability to Execute and Completeness of Vision. It covers AM solutions for workforce (employees), customers (CIAM), partners, and machines. The evaluation includes product capabilities, pricing, market responsiveness, customer experience, innovation, geographic strategy, and business models. Vendors were assessed on mandatory features including SSO, authentication, authorization, adaptive access, identity repositories, and life cycle management.
A: IAM leaders should use this research to evaluate and select Access Management vendors based on their specific use cases (workforce, customer, partner, or machine identities). The research helps identify vendors with the right balance of execution capability and vision for their requirements. Organizations can compare vendors on key differentiators including authentication methods, adaptive access, machine IAM support, orchestration capabilities, pricing models, geographic coverage, and vertical expertise. The accompanying Critical Capabilities research should be reviewed for detailed use case and functionality requirements.
A: Mandatory features for vendors included in this market are: (1) SSO and session management with support for standard identity protocols and social logins; (2) User authentication including phishing-resistant MFA, compromised password controls, and passwordless authentication; (3) Authorization policy definition and enforcement for applications and APIs; (4) Adaptive access based on dynamic evaluation of identity trust and access risk; (5) A directory or identity repository with synchronization services for all constituencies; and (6) Basic identity life cycle management with CRUD operations for all user types.
A:
A: Ability to Execute evaluates vendors on the quality and efficacy of processes, systems, methods or procedures that enable IT vendors to be competitive, efficient and effective, and that positively affect revenue, retention and reputation. It focuses on current execution including product capabilities, sales effectiveness, pricing, customer experience, and operational excellence. Completeness of Vision evaluates vendors on their understanding of buyer wants and needs, and how well they anticipate, understand and respond with innovation. It focuses on strategic vision including market understanding, innovation roadmap, marketing and sales strategy, business model, and geographic/vertical strategies for future market direction.