- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
One Identity Manager
Secure the front door. Email is where most attacks arrive — One Identity Manager automates the identity lifecycle, runs access reviews and enforces segregation of duties — answering who has access to what, why, and should they still.
Buy through TechBag
Same software. Better outcome — at no extra cost.
Free, vendor-neutral, 30 minutes
How it’s rated
Full scoreboard ↓Quick answer
One Identity Manager is One Identity's flagship identity governance and administration (IGA) platform — the engine that answers the three questions every security and audit team must be able to answer: who has access to what, why do they have it, and should they still have it? It automates the full identity lifecycle — the joiner-mover-leaver process — so that when someone is hired, changes role, or leaves, their access is provisioned, adjusted and revoked correctly and automatically across connected systems, instead of by hand and error. It runs access-certification campaigns so managers periodically re-attest who should keep what; enforces segregation-of-duties (SoD) policies so no one accumulates a toxic combination of entitlements; and provides a business-friendly access-request and approval experience so users request what they need and the right approver signs off. Built on a governance-first data model with deep role structures, entitlement management and hundreds of connectors, it is a recognised IGA leader — an established enterprise alternative to SailPoint, and part of One Identity's Unified Identity Security Platform (a Quest Software company). It closes the orphaned-account and access-creep gaps that auditors flag and attackers exploit. TechBag scopes, PoCs and quotes it in INR/GST.
The One Identity platform family
This page covers Identity Manager — the IGA flagship. The rest of the platform:
Quick facts
30-second orientation- Product
- One Identity Manager — IGA & access governance
- Vendor
- One Identity (a Quest Software company · Aliso Viejo, CA)
- The category
- Identity Governance & Administration (IGA)
- Answers
- Who has access to what, why, and should they still
- Automates
- Joiner-mover-leaver lifecycle & provisioning
- Governs
- Access reviews · SoD · role management · requests
- The standing
- A recognised IGA leader — a SailPoint alternative
- Part of
- One Identity Unified Identity Security Platform
- Deployment
- On-prem or Identity Manager On Demand (SaaS)
- In India via
- TechBag — quotes, PoCs, GST invoicing, Tier-1 support
Understand email security before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is IGA?
Identity governance & administration — controlling and proving who has access to what across your systems.
One Identity Manager is a governance-first IGA leader.
Unprotected inbox vs AI email security — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Unprotected / signature email | Identity Manager (One Identity) |
|---|---|---|
| Who has access to what | Nobody can say | Governed, on demand |
| Joiner-mover-leaver | Manual & error-prone | Automated end to end |
| Leavers' accounts | Linger (orphaned) | Deprovisioned on HR change |
| Access creep | Piles up over years | Removed at recertification |
| Segregation of duties | Unenforced / by spreadsheet | Policy-engine enforced |
| Access requests | IT tickets | Business self-service catalogue |
| Reviews | Ad hoc / never | Scheduled certification |
| The audit | A scramble | An export |
Access sprawls — creep, orphaned accounts, unenforced SoD. Govern the lifecycle and prove it. Part of the One Identity platform.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Identity Lifecycle
Automates provisioning, changes and deprovisioning across connected systems as people are hired, move roles and leave — so access is always correct, and no leaver keeps live accounts.
Access Governance
Runs periodic access-certification campaigns so managers re-attest who should keep what — closing the access-creep and orphaned-account gaps auditors flag and attackers exploit.
Segregation of Duties
Enforces segregation-of-duties rules so no one accumulates a toxic combination of entitlements (e.g. create-and-approve-a-payment) — with detection and prevention.
Access Request
A business-friendly request-and-approval experience — users request the access they need from a shop-like catalogue, the right approver signs off, fulfilment is automatic.
Roles & Connectors
Deep role structures, entitlement management and hundreds of connectors to applications and directories — the governance-first model One Identity Manager is built on.
One agent on every machine, one console over all of them — modules attach without a second operational world.
Twelve capabilities. Automate, govern, prove.
One Identity Manager governs the whole identity estate — lifecycle automated, access reviewed, SoD enforced, part of the portfolio, and paired with the human firewall.
Automated Provisioning
Provisions, changes and deprovisions access automatically across connected systems as people join, move and leave — the joiner-mover-leaver engine.
Hundreds of Connectors
Connects to the applications, directories and systems that hold your entitlements — SAP, Active Directory, Entra ID, cloud apps and more.
Access Request Catalogue
A shop-like catalogue where users request the access they need — the business-friendly front door, not an IT ticket queue.
Approval Workflows
Configurable multi-step approval workflows so the right people sign off on access requests — with delegation, escalation and audit.
Role Management
Deep role structures and role mining — bundle entitlements into business roles so access is granted by role, not one permission at a time.
Segregation of Duties
Detects and prevents toxic entitlement combinations — the SoD conflicts (like create-and-approve-a-payment) auditors and regulators require you to control.
Access Certification
Periodic recertification campaigns where managers re-attest who should keep what access — closing access creep and orphaned accounts.
Policy & Compliance Rules
Enforces access policy across the estate — who can have what under which conditions — turning compliance rules into automated controls.
Data Governance
Extends governance to unstructured data — who can access which files and folders — a common blind spot in access reviews.
Audit-Ready Attestation
A complete, defensible record of who has access, why, who approved it and when it was last reviewed — the export auditors expect.
Governance Reporting
Dashboards and reports on access, requests, reviews and SoD violations — visibility for security, business owners and auditors.
Identity Manager On Demand
The same governance delivered as a SaaS service — faster to deploy and operate, without running the full on-prem stack yourself.
Watch One Identity Manager in action
The overview, getting started, and protecting M365 email.
What is Identity Manager by One Identity?
The IGA flagship, explained.
Identity Manager — Overview #2: Key Features
The core governance capabilities.
Identity Manager — Overview #1: ADM vs. IGA
How administration differs from governance.
Want a live, India-context walkthrough on your own fleet?
Book a guided demo →The endpoint catches what arrives. Email stops it arriving.
Here’s what genuinely sets One Identity Manager apart in IGA.
It answers the three questions governance must answer
Every security and audit conversation about access comes down to three questions: who has access to what, why do they have it, and should they still have it? Most organisations cannot answer them confidently — access is scattered across dozens of systems, granted ad hoc over years, and never systematically reviewed. One Identity Manager exists precisely to answer them. It maintains a governed model of every identity and their entitlements across connected systems, records why each grant exists (the role, the request, the approval), and drives periodic reviews to confirm whether it should continue. Being able to answer those three questions — on demand, with evidence — is the whole point of identity governance, and it is what turns an audit from a scramble into an export.
The lifecycle runs itself — no leaver keeps access
The joiner-mover-leaver process is where access risk is created and destroyed. Done by hand, it is slow and error-prone: new hires wait days for access, role-changers accumulate permissions they no longer need (access creep), and leavers keep live accounts long after they are gone — the orphaned accounts attackers love and auditors flag. One Identity Manager automates the whole lifecycle. A new joiner gets exactly the right access for their role on day one; a mover's old access is removed as new access is granted; a leaver is deprovisioned everywhere the moment their HR record changes. Automating this is not just efficiency — it directly closes two of the most common and dangerous access-security gaps.
Governance-first, built by business users
One Identity Manager was built from the ground up as a governance platform, with a deep, purpose-built data model of identities, roles, entitlements and policies — not access management with governance bolted on. A distinguishing strength is how much control it puts in the hands of business users rather than IT: managers run their own access reviews, business owners approve requests through a friendly catalogue, and role owners manage their roles — governance becomes a business process, not an IT bottleneck. That governance-first depth (role structures, SoD, entitlement management, certification) is exactly what places it among the recognised IGA leaders and makes it a genuine enterprise alternative to SailPoint.
Segregation of duties, enforced
One of the most important — and hardest — governance controls is segregation of duties: making sure no single person can accumulate a toxic combination of entitlements, like the ability to both create a vendor and approve a payment to it, which enables fraud. Enforcing SoD manually across dozens of systems is effectively impossible. One Identity Manager encodes SoD rules into the platform and enforces them continuously — detecting existing violations and preventing new toxic combinations at the point of request. For regulated organisations (SOX, and in India RBI/SEBI controls), demonstrable SoD enforcement is often a hard requirement, and doing it by policy engine rather than by spreadsheet is the only sustainable way.
Part of a unified identity platform
One Identity Manager does not stand alone. It is part of One Identity's Unified Identity Security Platform, which spans governance (Identity Manager), privileged access (Safeguard), access management (OneLogin) and Active Directory management (Active Roles) — a single vendor relationship with a shared model across governance, privileged and workforce identity. For organisations that want to consolidate identity onto one platform rather than stitch together point tools from different vendors, that unification is a real advantage: an access review can see privileged entitlements, a lifecycle change can flow through to AD and cloud, and governance sits over the whole identity estate rather than a slice of it.
The honest scope
One Identity Manager is a deep, enterprise-grade IGA platform — the governance-first depth is real, and it is a genuine alternative to the category leader. That depth is also its trade-off: SailPoint has the larger IGA market share and mindshare, and full IGA programs are substantial projects regardless of vendor — they reward planning, clear role design and phased rollout. If you want lighter, faster governance, simpler tools (Securden IGA — hub live) or the governance built into an access platform may suit a smaller estate; Microsoft covers some governance ground in Entra ID if you are all-Microsoft. One Identity Manager's edge is deep, business-user-driven governance unified with privileged and workforce identity on one platform. TechBag scopes it honestly against SailPoint and the lighter options.
The numbers behind the platform
What your identity-governance journey looks like
Governance scoping
Your connected systems, your compliance drivers (SOX/RBI/SEBI/ISO), your worst access-creep and orphaned-account risks, and your role model. TechBag scopes it free.
Connect & model
On-prem or On Demand stood up; key systems connected; identities and entitlements imported; the initial role model and SoD rules defined.
Automate & review
Joiner-mover-leaver automation live on the first systems; access-request catalogue open to the business; first certification campaign run.
Governed & audit-ready
Lifecycle automated, SoD enforced, reviews scheduled, audit an export. Governance sitting over the whole identity estate. TechBag models the mix in INR/GST.
Trusted across regulated industries in 100+ countries
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We finally can answer 'who has access to what and why' — on demand, with evidence. The joiner-mover-leaver automation alone closed our orphaned-account problem.”
“SoD enforcement was the reason we bought it. RBI and SOX both want proof that no one can create and approve a payment — Identity Manager enforces it, not a spreadsheet.”
“The access-request catalogue put governance in the hands of business managers. They run their own reviews and approvals now — IT is out of the bottleneck.”
“Certification campaigns used to be a quarterly nightmare of spreadsheets. Now managers re-attest in the tool and access creep is actually controlled.”
“The governance-first data model is genuinely deep — roles, entitlements, policy. It's a real SailPoint alternative for enterprise IGA.”
“It's a serious platform and a serious project — plan the role design and phase the rollout. Rushed, IGA hurts; done right, it transforms access control.”
“Being able to see privileged entitlements (Safeguard) inside the same governance reviews is the payoff of the unified platform.”
“Identity Manager On Demand let us get governance without running the full on-prem stack — faster to value for a lean team.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the email security market — tap any vendor to see why it sits where it does.
TechBag Email-Security Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Governance-first IGA leader, business-user-driven, unified with PAM/access. This page's product.
Detection × Portfolio Integration
The grid nobody publishes — how strong the email detection is vs how integrated with the wider security portfolio.
Deep governance unified with the wider identity platform.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
One Identity Manager vs the IGA field
The IGA leaders and the lighter options — honest lanes; the edge is deep, business-driven governance unified with privileged and workforce identity.
| Dimension | One Identity Manager | SailPoint | Saviynt | Securden IGA | No IGA |
|---|---|---|---|---|---|
| Standing & heritage | IGA leader, governance-first | The market leader | Strong IGA | Lighter IGA | The gap |
| Governance depth | Deep | Deepest | Strong | Good | None |
| Lifecycle automation | Strong | Strong | Strong | Good | Manual |
| Business-user experience | A strength | Can be IT-heavy | Good | Simple | None |
| Simplicity & cost | Enterprise-grade | Enterprise-grade | Moderate | Simple, per-user | Free |
| Best fit | Enterprises wanting deep, business-driven IGA, unified with PAM/access | The deepest standalone IGA | Cloud-native governance | Simpler / price-sensitive IGA | Nobody with regulated access |
Which email-security approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose One Identity Manager if…
- ✓You want deep, governance-first IGA that business users can run
- ✓Lifecycle automation and SoD enforcement are priorities
- ✓You want governance unified with PAM, access and AD on one platform
- ✓You're evaluating an enterprise alternative to SailPoint
Choose SailPoint if…
- ✓You want the deepest standalone IGA market leader
Choose Saviynt if…
- ✓You want cloud-native governance as a converged platform
Choose Securden IGA if…
- ✓You want simpler, per-user, price-sensitive governance (hub live)
No IGA if…
- ✓Never — ungoverned access is an audit failure and breach path
What do email threats cost you?
Drag the sliders (count users; IT-hour cost as loaded incident rate). Estimates assume ~1.5 hours per user per year handling email threats that reach the inbox without AI filtering, with ~70% removed by stopping the mass at the gateway — the avoided-breach value (most attacks start here) is the larger, unpriced win. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models actual device counts and modules.
Three ways to consume it
One Identity Manager prices per identity (on-prem or Identity Manager On Demand). TechBag scopes it for your governance programme in one GST quote.
Identity Manager
Best for access governance
- Joiner-mover-leaver automation
- Access reviews & certification
- Segregation of duties enforced
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Identity platform
Best for a unified programme
- Governance unified with Safeguard PAM
- OneLogin access + Active Roles
- TechBag scopes the mix
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your device counts and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Confirm connectors for YOUR key systems — SAP, AD, Entra ID, cloud apps, HR — where your entitlements actually live.
Test joiner-mover-leaver end to end — a leaver deprovisioned everywhere the moment HR changes.
Run a certification campaign — managers re-attesting access — and confirm it's genuinely business-friendly.
Encode YOUR toxic combinations and confirm the policy engine detects existing and prevents new violations.
Test the access-request catalogue and approval workflow — the business self-service experience.
Confirm the role model fits your organisation — role mining, business roles, entitlement bundling.
IGA is a real project — for lighter needs compare Securden IGA (hub live); for the deepest standalone, SailPoint.
Right-size on-prem vs On Demand and per-identity — TechBag scopes and quotes in INR/GST.
Questions buyers ask
Ready to govern who has access to what?
Scope an IGA PoC (automate the lifecycle, run a certification campaign, enforce SoD), map it to your compliance obligations, or let a TechBag advisor plan your governance programme.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.