Types of tools for managing SaaS accounts, and how they differ

Tools for managing SaaS accounts fall into six types: identity providers, password managers, privileged access management (PAM), enterprise browsers, SaaS management tools, and access management tools. Their names sound alike, but each one solves a different problem. Facts about other vendors’ products come only from what we found in the official documentation and product pages of one or two products of each type.

The six types and the products we checked

What is an identity provider (IdP)? covers the first type in more depth, and What is a password manager? the second. What is privileged access management (PAM)? covers the third.

The comparison

The Junify column describes Junify’s product page only. That page doesn’t list plans or prices, so this table leaves cost out. “Not checked” marks points we couldn’t confirm.

What backs each type

Identity providers: SAML is the standard that lets an app accept an identity provider’s sign-in. Microsoft’s documentation says Entra ID verifies each person and confirms who they are to the app. The app then no longer keeps its own usernames and passwords. For apps that don’t connect, password-based SSO stores the username and password and sends them to the app. People who use a shared account this way don’t see the actual password. Admins can see in Entra ID’s sign-in log who opened an app and when. Okta’s Secure Web Authentication (SWA) gives single sign-on to web apps that don’t support SAML or similar standards. The Okta Browser Plugin enters the login automatically. Okta’s Application Usage report shows who signed in to an app during a chosen period.

Password managers: 1Password lets you share a vault with members or groups. In 1Password Teams, view access includes showing concealed passwords and copying them. Business makes it a separate setting: View and Copy Passwords. The Business usage report shows, for each item, when it was last used, the action taken, such as fill, reveal, or copy, and who took it. Most reports are a Business feature; Teams accounts billed directly by 1Password can try them free. The browser extension fills saved logins in on sign-in pages.

PAM: NIST SP 800-53 Rev. 5 is a catalog of security controls. Its control AC-6(5) asks you to limit privileged accounts to the people or roles you define. AC-6(9) asks you to log each time someone uses admin-only functions. Palo Alto Networks’ page for Idira Privileged Access Management shows what a product of this type does. It covers infrastructure and SaaS, and it keeps each sensitive admin connection separate and records it. It also stores system account passwords and changes them automatically, and it grants access only for the length of a task. The page says the user never handles the login, even in older apps, because the product fills it in at sign-in.

Enterprise browsers: Google’s help center says Chrome Enterprise Core lets you manage Chrome browsers from one cloud console. It covers Windows, Mac, Linux, Android, and iOS at no additional cost. Policies reach browsers even when people don’t sign in or don’t have a Google account. Reports show each browser’s version, its apps and extensions, and the policies applied. Chrome Enterprise Premium, the paid tier, adds controls on copy and paste, uploads, downloads, and printing. It also adds access rules that look at identity, device, and location. Island’s product page says it controls printing, downloads, screenshots, and copy and paste. It records the user, the device, and the actions taken. It comes as a full browser or as an extension. Island’s password-manager page adds “protected sharing”, which lets a team use an account without seeing its password. Its use cases include contractors and BPOs.

SaaS management tools: BetterCloud’s site lists finding apps IT doesn’t know about and automating onboarding and offboarding with workflows. It also lists reclaiming unused licenses, dropping duplicate subscriptions, and seeing what you spend on and use. It doesn’t list checking who signs in each day or recording those sign-ins.

How to combine them

You can use several of these types together, matching each kind of account to one. Apps where each person gets their own account and that connect through SAML belong to the identity provider. If you don’t know what’s in use, a SaaS management tool is where to start the list. To stop data leaving through the browser, look at an enterprise browser. To give server and cloud admin access only for the length of a task, and record it, look at PAM. For apps that don’t connect to the identity provider, and for shared accounts, choose among a password manager, an access management tool, and an enterprise browser that shares logins without showing them. The deciding questions are whether people may see the password and whether you need a record by person.

When you don’t need Junify

If you can give everyone their own account and the app connects to your identity provider, the identity provider alone is enough. Its password fill-in also covers apps that don’t connect, and shared accounts, when everyone who uses them has an account there. That holds as long as “who opened the app, and when” is enough of a record. Accounts used by a few people who may see the password are handled well by a password manager.

An access management tool is worth a look when one of two things remains. Either people you won’t add to the identity provider use the account, or you don’t want more people to know the password. PAM or an enterprise browser can also record what happens after sign-in, and Island can share a login without showing it. They differ in which apps they cover and how they’re deployed.