The short answer
Buy One Identity if your requirement is identity governance and privileged access from one vendor, across an estate with Active Directory at its centre and regulators who want evidence of who had privileged access and when.
Skip it if you want cloud single sign-on and multi-factor authentication for a workforce. That is a different product category, and the cloud identity providers do it with published documentation you can read.
Where One Identity fits
The portfolio is the product, and it is worth knowing the names before any sales call. One Identity's own open-source organisation documents Identity Manager, with repositories for the HTML5 source of its web applications; the Safeguard family, covering Safeguard for Privileged Passwords, Safeguard for Privileged Sessions, Safeguard Authentication Services and Safeguard for Sudo; Active Roles; and Password Manager. That shape, governance plus privileged access plus directory administration, places this vendor alongside SailPoint rather than alongside a cloud login provider.
That distinction decides whether this product belongs on your list at all. Governance answers who should have access, proves it was reviewed and removes it when it should not exist. Privileged access management controls and records what an administrator did with a credential. Neither is single sign-on, and an organisation whose actual problem is that staff have twelve passwords is in the wrong aisle of the identity and access management category. An organisation whose problem is an audit finding about privileged accounts is in exactly the right one.
The engineering surface suggests a product line built for people who integrate deeply. The organisation profile says customers get more value from One Identity products through open-source add-ons, plugins, SDKs and scripting libraries, and that the products provide open APIs for customisation and integration. The repositories bear that out: C# and Java SDKs for the Safeguard Web API, PowerShell and Ansible resources, a secret distribution service for pushing secrets into DevOps environments, custom platform scripts, authentication plugins for privileged sessions, and a Model Context Protocol server for Safeguard for Privileged Passwords. This is a platform that expects configuration work, not a tool you switch on.
What could not be established is everything the vendor would normally tell you itself. On October 16, 2026 oneidentity.com, its products path and its support site all returned an AWS WAF challenge with an empty body, and the documentation portal loaded a shell that renders its product list in JavaScript. So this page does not describe current editions, current capabilities or current positioning, because ITCommons could not read them. Treat the product names above as the verified floor and make the vendor supply the rest in writing.
One Identity pricing
ITCommons has not checked One Identity's pricing, and on October 16, 2026 it could not have: the vendor's own site returned an AWS WAF challenge with an empty body to every request, including one with a browser user agent. There is no figure here and no estimate. What is possible is to be precise about what a governance and privileged access quote is built from, which is more useful than a number anyway on a purchase of this shape.
What you will be asked to count
Expect to count twice. Governance is priced on identities, and the identity population includes employees, contractors, non-employees and the service and machine accounts nobody has enumerated. Privileged access is priced on privileged accounts, sessions or assets depending on the vendor's model, and that number comes from an inventory most organisations have to build during the procurement rather than before it.
The second dimension is products, and it is where a portfolio purchase diverges from a tool purchase. Identity Manager, Safeguard for Privileged Passwords, Safeguard for Privileged Sessions, Safeguard Authentication Services, Safeguard for Sudo, Active Roles and Password Manager are separate line items in One Identity's own documentation structure. Buying three of them is a programme, and the integration work between them is yours unless the contract says otherwise.
The cost nobody quotes is the configuration and its ownership. A portfolio that ships SDKs, PowerShell libraries, Ansible resources and custom platform scripts is telling you honestly that it is customised rather than configured, and customisation is an asset with an owner and a maintenance cost. ITCommons has not measured that effort and puts no figure on it. The IT downtime cost calculator is a blunt way to frame the other side: an unplanned privileged-access incident and a failed audit both end in unbudgeted work.
What to establish before any number means anything:
- Which products are in scope. Identity Manager, the Safeguard family, Active Roles and Password Manager are separate products in One Identity's own documented portfolio, and a portfolio quote that does not name them individually is not a quote you can compare.
- How many identities for governance, and how many privileged accounts for Safeguard. Those are two different populations with two different meters, and the privileged one is almost always larger than the organisation believes, because service accounts count.
- How many applications and systems must be governed or have credentials vaulted. Coverage is what makes a governance deployment worth anything, and the systems holding your most sensitive access are usually the oldest and hardest to connect.
- Deployment and hosting. The documented product line includes software that runs in your own environment, which brings servers, upgrades and a support tier with it. Ask what the quote assumes and what the support commitment is.
- Implementation, which on governance and privileged access projects is normally partner-led and comparable in size to the licence. Ask who delivers it, what the first deliverable is, and when it lands.
The practical approach is to decide which problem you are solving before you take a portfolio meeting. If it is governance, put One Identity beside SailPoint and make both demonstrate a certification campaign on your own entitlement data. If it is single sign-on and multi-factor authentication, compare Okta and Microsoft Entra ID instead, and come back to governance as a second phase. And ask this vendor why its website would not load, because for the rest of the field that question does not arise.
ITCommons has not verified One Identity pricing and publishes no estimate. On October 16, 2026 https://www.oneidentity.com/, its products path and the One Identity support site all returned HTTP 202 with an AWS WAF challenge header and a zero-byte body, through the fetching tool and through a direct request with a browser user agent, and https://docs.oneidentity.com/ loaded a shell whose product list renders in JavaScript and carried no product names. The product names on this page come from One Identity's own GitHub organisation, which did load. Current editions, capabilities and rates all have to come from the vendor in writing.
Pricing on this page has not been independently verified. Confirm plans on the vendor's own site before procurement, starting from One Identity's open-source organisation, the vendor source that loaded on October 16, 2026.
What One Identity gives up
You give up cloud single sign-on as the centre of the product. Nothing in the documented portfolio is a workforce login service, so an identity provider is a separate purchase and a separate licence. Buying a governance and privileged access portfolio to solve a password problem is the most expensive way to not solve it.
You give up a short implementation. Governance and privileged access deployments are modelling and integration projects measured in months, and a portfolio that ships SDKs and scripting libraries is explicit about expecting customisation. Budget the partner, name the internal owner, and do not let a licence start before the implementation plan exists.
You give up self-service research, which on this vendor is more acute than on its competitors. You cannot read the product pages, the editions or the documentation from the public web, so every claim arrives through a salesperson. That is a slower purchase and it puts more weight on the contract than on the evaluation.
You give up the comparison you probably wanted to make. Without readable vendor documentation, setting this portfolio against SailPoint on capability detail is not possible from public sources today, so the comparison has to be made by making both vendors demonstrate the same campaign on your own data.
How One Identity compares
One Identity's honest comparison set is other governance and privileged access vendors, plus the identity provider you will still need beside it. Prices are marked as not verified here wherever ITCommons has not read that vendor's own pricing page, and the one verified figure carries its date.
| Tool | Best for | Price | Where it breaks |
|---|---|---|---|
| One Identity | Estates wanting identity governance, privileged access management and Active Directory administration from one vendor, with heavy customisation expected | Not published: One Identity's own website and support site returned an AWS WAF challenge with an empty body on October 16, 2026 | Breaks as a cloud single sign-on product, on time to value, and on public documentation a buyer can read |
| SailPoint | Identity governance at scale, including non-human identities, with documentation you can read before a call | Not verified here | Breaks as an access management product and does not include privileged access in the same line |
| OneLogin | Cloud single sign-on, recorded in this catalogue under the same vendor name | Not published: its own site returned an AWS WAF challenge with an empty body on October 16, 2026 | Breaks on commercial visibility: its product status could not be confirmed from the vendor either |
| Okta | The workforce identity provider this portfolio does not replace, with governance and privileged access as modules | Not verified here | Breaks on governance depth for complex certification programmes and on self-hosting |
| Microsoft Entra ID | Microsoft estates whose governance need is access reviews and privileged identity management rather than full certification | Not verified here | Breaks outside the Microsoft estate and on heterogeneous application coverage |
How to evaluate One Identity without public docs
With no readable vendor documentation, the evaluation has to extract from the vendor what you would normally read for yourself, and then prove it on your own data. Put the written questions first: they take longer to answer than a demonstration takes to arrange.
- Ask for a written product list and current editions, naming which of Identity Manager, the Safeguard products, Active Roles and Password Manager are in the proposal, what each covers and what each costs on its own.
- Ask why oneidentity.com, its products path and the support site would not serve a page on October 16, 2026. Whether the answer is bot protection or something else, you need it before you depend on that site for documentation and security advisories.
- Make the governance product run one real certification campaign on one real application with real reviewers, and inspect the evidence pack an auditor would receive. Sample data proves nothing here.
- Inventory your privileged accounts, including service accounts, before scoping Safeguard, then have the vendor demonstrate credential vaulting and session recording against two of your own systems, including the awkward legacy one.
- Test one joiner, one mover and one leaver end to end, with the mover case first. Accumulated access after a role change is what audits find and what a governance platform exists to prevent.
- Get implementation quoted alongside the licence, with the partner named, the duration stated and the first deliverable defined, and get the support commitment and advisory channel in writing given that the public support site did not load.
Frequently asked questions
- What is One Identity?
- One Identity is a vendor whose documented portfolio covers identity governance, privileged access management and directory administration. Its own open-source organisation names Identity Manager, the Safeguard family for privileged passwords, sessions, authentication services and sudo, Active Roles, and Password Manager.
- What does One Identity company do?
- It sells software for governing and controlling access rather than for signing users in. Governance decides who should hold which entitlements and proves it was reviewed; privileged access management vaults credentials and records administrator sessions; Active Roles and Password Manager cover directory administration and password workflows.
- Who is One Identity owned by?
- ITCommons could not confirm it from the vendor on October 16, 2026, because oneidentity.com, its products path and its support site all returned an AWS WAF challenge with an empty body. Ask the vendor directly, and get the contracting entity named on any quote rather than inferring it.
- How much does One Identity cost?
- ITCommons has not verified One Identity pricing and publishes no estimate. Its website would not serve a page to this check on October 16, 2026. Ask for a written product list with each item priced separately, the identity and privileged account counts assumed, the implementation quote and the renewal rate.
- Is One Identity an identity provider for single sign-on?
- Not primarily. The documented portfolio is governance, privileged access and directory administration, so a workforce identity provider for single sign-on and multi-factor authentication remains a separate purchase. If passwords and logins are your problem, compare the cloud identity providers first.
- What is One Identity Safeguard?
- Safeguard is the privileged access family. One Identity's own repositories name Safeguard for Privileged Passwords, Safeguard for Privileged Sessions, Safeguard Authentication Services and Safeguard for Sudo, with C# and Java SDKs for its Web API, PowerShell and Ansible resources, and a secrets distribution service for DevOps environments.
- What is One Identity Manager used for?
- Identity Manager is the governance product in the portfolio, and One Identity publishes the HTML5 source for its web applications in its open-source organisation. Governance work means modelling entitlements and roles, running certification campaigns, and automating joiner, mover and leaver provisioning across connected systems.
- Is One Identity the same as OneLogin?
- No. They are separate products recorded here under the same vendor name, and One Identity's portfolio centres on governance and privileged access rather than cloud single sign-on. Neither company's website would load for this check on October 16, 2026, so confirm the current relationship with the vendor.
- One Identity or SailPoint for identity governance?
- Both are governance platforms, and the difference that matters is scope and readability. One Identity pairs governance with privileged access management from the same vendor; SailPoint publishes more detail you can read before a call. Make both run a certification campaign on your own entitlement data before deciding.
- Does One Identity run on-premises?
- The documented product line includes software that runs in your own environment, which is part of why it appears in Active Directory-centred estates. ITCommons could not read current deployment options from the vendor on October 16, 2026, so get the supported topologies and the support commitment in writing.