Identity and access

Identity and access software controls how users authenticate and what conditions a login must meet to be trusted: multi-factor authentication, single sign-on across multiple applications, and conditional access that can block a login based on device health, location or risk signals. Privileged access management, a distinct and more specialised feature, controls and time-limits access to admin-level accounts specifically, since those accounts cause the most damage if compromised. Directory sync keeps user accounts consistent between a client's identity provider and the applications that need to know about them. This category does not manage passwords for a whole team's shared logins; that is password management, a related but separate category.

Pricing is per user or per endpoint per month, depending on whether the product licenses by person or by device enrolled for authentication. Privileged access management is sometimes a separate, higher-priced tier from basic MFA and SSO.

MFA and SSO are the baseline most clients now expect; beyond that, conditional access and device trust determine how much control you have over risky logins, such as one from an unrecognised device or location. Privileged access management matters specifically for admin and service accounts, which carry more risk than ordinary user logins. Passwordless and passkey support is increasingly relevant as clients move away from passwords entirely, and session and risk monitoring plus breach monitoring add visibility into compromised credentials before they are used. Legacy VPN and app support matters if a client still runs older systems that do not support modern authentication protocols.

Directory sync needs to work cleanly with whatever identity provider a client already uses, usually Microsoft Entra ID or Google Workspace, since a broken sync causes account access problems that generate support tickets fast. RADIUS and SAML support matter for connecting to older applications and network equipment that do not speak modern authentication protocols natively.

Ask about the contract term, whether pricing is per user or per endpoint, and what happens if privileged access management is added later as a separate purchase. Ask how directory sync is licensed and whether there are limits on the number of connected applications for single sign-on.

A small MSP can usually cover most client risk with straightforward MFA and SSO, without needing privileged access management or deep conditional access policies for every client. A larger MSP managing clients with sensitive data or compliance obligations more often needs conditional access, privileged access management and breach monitoring as standard, since the cost of a compromised admin account scales with the size of the environment it can reach.