Your requirements are specific enough to make a real shortlist: SSO and MFA across 80 SaaS apps, automated provisioning tied to HR updates, SOC 2 access reviews with usable audit trails, and a preference for a single tool rather than a combination. The honest answer is that a truly unified single tool that covers all four well — particularly the SCIM gap on the provisioning side — is harder to find than vendor marketing suggests. But the options below get close enough to be worth evaluating against your actual app stack.

One framing note worth keeping before you start demos: the identity market has two distinct layers that matter for your requirements. IAM (SSO, MFA, directory) handles the authentication side. IGA (lifecycle automation, access reviews, governance) handles the compliance and provisioning side. The tools that excel at both tend to either be expensive enterprise suites or newer platforms that have built both layers from the ground up. Understanding which layer each tool is strongest on will help you evaluate against your specific requirements rather than generic feature claims.

Option 1: Extend Your Existing Azure AD (Entra ID)

Since you already have a semi-configured Azure AD tenant, the lowest-friction path is completing that configuration and adding the Identity Governance add-on.

Microsoft Entra ID with the Governance add-on (on top of P1 licensing) gives you: SSO and MFA for Azure AD-connected applications, Lifecycle Workflows for automated joiner-mover-leaver processing, PIM for privileged access, and Access Reviews for SOC 2 certification campaigns. Entra ID connects to Workday, BambooHR, and SAP SuccessFactors natively for HR-driven provisioning.

The limitations worth knowing: risk-based Conditional Access (dynamic policies that respond to anomalous sign-in behavior) requires P2 rather than the Governance add-on. For your 80 SaaS apps, SCIM support varies — apps that support SCIM provision and deprovision automatically, apps that don't require either Okta Workflows-style custom API calls or manual processes. The Governance add-on's access reviews cover Entra-managed resources; for applications outside Entra's direct management scope, you need additional configuration.

If your 80 apps are heavily Microsoft 365 and applications with strong SCIM integrations, this path is efficient and avoids adding new vendors to your stack.

Option 2: Okta (with Identity Governance)

Okta is the most commonly recommended IAM platform for mid-sized organizations moving off a manual or partially-configured setup. Its application library is the broadest in the market, the SSO setup experience is well-documented, and adaptive MFA (including number matching to prevent MFA fatigue — a real risk that practitioners in this thread flagged specifically) is solid.

Okta Identity Governance extends the platform with access certifications and lifecycle automation. The practitioner community's assessment: access requests and certifications work well for what they do; the limitations are around conditional logic complexity in workflows, and the governance module hasn't been fully integrated with Okta Workflows yet. For SOC 2 access review requirements, Okta IGA satisfies the basic control evidence requirement.

The same SCIM caveat applies: apps in your 80 that don't support SCIM won't provision and deprovision automatically. For non-SCIM apps, Okta Workflows can build custom API calls per app, but that's engineering work per application.

Cost at mid-market: Okta is consistently flagged as expensive, particularly when governance features are added. Get a specific quote for your user count and feature requirements before comparing against alternatives.

Option 3: Rippling IT + HR

Rippling is the most common community recommendation in this thread, and for your specific situation it deserves serious consideration. If you don't yet have your HR system fully deployed or you're open to having HR and IT in one platform, Rippling's combined approach directly addresses the "automated provisioning tied to HR updates" requirement — because the HR system and the IT provisioning system are the same product.

Rippling IT handles SSO, MFA, device management, and app provisioning. The HR system handles employee records, and provisioning is triggered automatically from HR events without needing an integration between two separate systems. For onboarding and offboarding automation, this is genuinely strong.

The limitation for your requirements: Rippling is primarily an HR + IT operations platform with SSO and basic provisioning. The SOC 2 access review and governance depth that a dedicated IGA platform provides — certification campaigns, audit-ready timestamped reports, role-based access review workflows — is lighter in Rippling than in platforms built specifically for governance. If SOC 2 Type II access reviews are a significant requirement, verify the specific certification campaign features before committing.

Option 4: Dedicated IGA Platform (Azure AD for SSO, Zluri for Governance)

The "single tool" preference is understandable given your bandwidth constraints. The reason many mid-sized organizations end up with two tools — a core IAM for SSO and MFA, plus a dedicated IGA platform for lifecycle and governance — is that the SCIM gap is real and affects mid-market organizations more acutely than enterprise.

For 80 SaaS apps, a meaningful portion likely don't support SCIM at the tier you're licensing them at. Those apps need either custom Workflows logic (engineering work), AI-powered browser automation (what Zluri provides for apps without APIs), or manual processes. A dedicated IGA platform that handles all three categories from a single offboarding trigger is what closes the "we keep finding manual tracking is out of date especially when folks are offboarding" problem you described.

The specific combination: keep your existing Azure AD for SSO and MFA (it already works), connect Zluri to Azure AD and your HR system, and let Zluri handle the lifecycle automation and access review workflows across all 80 apps including the non-SCIM ones. The operational overhead is lower than it sounds because most of the configuration is done at setup rather than ongoing — a well-configured Zluri deployment runs playbooks automatically without IT intervention on individual provisioning events.

On MFA Fatigue: Worth Addressing Before You Deploy

One practitioner in this thread flagged this specifically, and it's worth calling out directly: MFA fatigue attacks (repeated push notifications until a tired user approves one) are a real vector. Whatever platform you select, configure number matching on push notifications — where the user has to enter a code shown on the login screen rather than just tapping Approve. Microsoft Authenticator, Okta Verify, and most enterprise authenticators support this. Enable it on day one.

How HR Integration Actually Works Across These Platforms

All four options connect to HR systems as the provisioning trigger, but the mechanism varies:

Workday, BambooHR, HiBob, and most major HRMS platforms have pre-built integrations with Okta, Entra ID, and Zluri. When HR marks a new hire with a start date, the platform detects the event and triggers an onboarding workflow. When HR records a termination, an offboarding workflow fires automatically. The key is that the HR system is configured as the authoritative source — IT doesn't need to manually trigger provisioning when HR has already captured the event.

Rippling skips the integration step because HR and IT are the same system. This is architecturally simpler but means you're committing to Rippling's HR platform as well, not just their IT product.

Frequently Asked Questions

What IAM platform is best for a mid-sized company with 80 SaaS apps?

The right choice depends on your existing infrastructure and primary requirements. If you're already on Azure AD, extending with Entra Identity Governance is the lowest-friction path. If you're selecting fresh and want the strongest SSO library, Okta is the most commonly recommended option at mid-market. If HR and IT operations aren't separated, Rippling's combined approach addresses the HR-to-provisioning automation directly. For organizations where SOC 2 governance depth and non-SCIM app coverage are the primary requirements, a dedicated IGA platform like Zluri alongside your existing directory may be the most complete solution.

What is MFA fatigue and how do you prevent it?

MFA fatigue attacks send repeated push authentication requests to a user until they approve one — often while distracted or half-asleep — allowing an attacker with stolen credentials to complete the login. Prevention is straightforward: enable number matching on push notifications (the user must enter a code from the login screen, not just tap Approve) and configure rate limiting on push requests. All major authenticator apps support number matching. Enable it on deployment, not after you experience an incident.

How does HR-driven provisioning work in IAM platforms?

HR-driven provisioning connects your HR system (Workday, BambooHR, HiBob, etc.) as the authoritative source of employee data. When HR adds a new employee with a start date, the IAM platform detects the event and runs an onboarding workflow that creates accounts and assigns licenses for connected applications. When HR records a termination, an offboarding workflow runs automatically. The IT team isn't the trigger — HR events are. This eliminates the delay and manual error that come from IT waiting for a request before starting provisioning.

What is the SCIM limitation in IAM platforms?

SCIM is the protocol that allows an IAM platform to automatically create, update, and delete accounts in downstream SaaS applications. The limitation is that not all SaaS applications support SCIM, or they require an enterprise-tier subscription to enable it. For applications without SCIM, the IAM platform can handle SSO (authentication) but can't automatically provision or deprovision accounts. For a mid-sized company with 80 apps, a meaningful portion are likely in this category — meaning manual deprovisioning remains necessary unless you use Workflows-based custom API calls or a dedicated IGA platform with alternative integration paths.