ConductorOne (C1) alternatives after the Workday deal
Workday agreed to buy C1, formerly ConductorOne, on October 13, 2026, and expects to close by January 31, 2027. Neither company has said what changes for customers after that. If you renew in the next 12 months, the main alternatives are Iden, Lumos, Okta Identity Governance, Microsoft Entra ID Governance, Opal and SailPoint.
Workday buys C1. What are my options now?
…Still looking for an IGA for our 600-person shop. What are my options now? Lumos, Iden, Ploy, Corma - any tips/recommendations from your own experience?
Bonus points if it has a MCP and can help manage NHI/agent access.
The Reddit question here came in October from a team running IT for a 600-person company, who had evaluated C1 before. Iden’s founder answered it, further down.
What does the Workday deal change for C1 customers?
| Fact | As of November 13, 2026 |
|---|---|
| The deal | Workday signed a definitive agreement to buy C1 on October 12, 2026 and announced it on October 13 |
| Expected close | Workday's fiscal Q4 2027, which ends January 31, 2027, subject to closing conditions |
| Price | Not disclosed |
| Workday's stated reason | Governing what AI agents can access, across Workday and the other systems a business runs on |
| C1 today | Still sold under the C1 name. c1.ai carries a banner saying C1 is to join Workday |
| Not announced | The brand, pricing, hosting, and how C1 will serve customers whose HR system isn't Workday |
Zluri, another C1 competitor, was bought by Infotech a day later, on October 14, and runs as a standalone division. It carries the same open questions, which is why it isn’t in the list below.
Should you move off C1?
Not because of the announcement alone. C1 is a strong product today: more than 400 prebuilt connectors, a no-code editor for onboarding and offboarding automations, and access reviews that export with file hashes. It’s worth running an evaluation now in any of these situations:
Your internal apps run on connectors your own engineers built with C1's Baton SDK. Every change to those apps, or to Baton, is theirs to fix, and if they no longer have the bandwidth, the connectors fall behind.
Your renewal falls before the close, or C1 is offering a multi-year term. You would be signing before anyone knows the owner's price list.
Your HR system isn't Workday. Neither company has said how C1 will treat customers on BambooHR, Rippling, HiBob or SAP SuccessFactors.
Your gaps were already there. C1's docs say a custom connector needs an app whose API can list users, and apps without one go through file sync and Jira tickets. If those apps are where your leavers keep access, the deal doesn't change that.
What should you ask C1 before you renew?
- Is the renewal price fixed for the full term, whatever the new owner's price list says?
- If pricing, hosting or support terms change after the close, can we leave without a penalty?
- Which connectors for HR systems other than Workday are committed for the next 24 months, and is that in the contract?
- Where is our data hosted after the close, and will it move?
- Can we export every access review, with its file hash, and every provisioning action, in a format our auditor accepts?
Get the answers in the order form, not in an email. Until the close, C1 can’t bind its new owner to anything the contract doesn’t say.
What are the best ConductorOne alternatives?
| Option | Pick it if | Check before you buy |
|---|---|---|
| Iden | You want AI-native governance with no custom scripting on your end, for 50 to 2,000 people and the apps without SCIM or an API. | If most of your stack already supports SCIM, you're good for now. |
| Lumos | You want a product shaped like C1 from an independent vendor: requests, reviews, lifecycle and discovery of service accounts and AI agents. | No public price. Apps without a connector get a manual task for a person, or a connector you build. |
| Okta Identity Governance | You run Okta for SSO and most of your apps support SCIM. | Essentials suite from $17/user/month. Apps without SCIM need the provisioning agent, a custom connector, or a Jira or ServiceNow task. |
| Microsoft Entra ID Governance | You're Microsoft-first and already licensed for Entra ID P1 or P2. | $7/user/month on top of P1 or P2. A lifecycle workflow built from scratch needs Microsoft Graph. |
| Opal | An engineering-led team whose main problem is just-in-time access to cloud infrastructure. | Approvals run up to 3 stages, and custom logic is written in OpalScript. Apps without an integration need a connector you build or a ticket. |
| SailPoint | 5,000 or more employees, a dedicated identity team, and a multi-year governance program. | No public price. On-prem sources need a virtual appliance cluster, and SailPoint sells implementation services. |
Vendor pages checked on November 10, 2026. Prices are list prices where a vendor publishes one.
Featured in KuppingerCole’s Lean IGA Leadership Compass
Iden is featured in KuppingerCole’s 2026 Leadership Compass for Lean Identity Governance and Administration.
Lean IGA is KuppingerCole’s term for identity governance built for midsize organisations. They need the same core work done as an enterprise, lifecycle management and access governance, but they buy on different terms: how quickly a product deploys, how easy it is to run without a dedicated identity team, and how soon it pays back. Enterprise suites were designed around large identity programmes, so the products built for midsize teams needed an evaluation of their own. That is what this report is.
Why do teams switch from C1 to Iden?
Back to the Reddit question at the top of this page. Of its 46 replies, this one is from Iden’s founder, quoted as posted:
Founder of Iden here and appreciate you mentioning us 🙌
iirc we had a brief interaction on another thread about this but worth mentioning here again if you're actively looking:
- Built for growing orgs that don't want enterprise bloat- SCIM by default, Iden has 220+ non-SCIM connectors ootb- fine-grained access controls beyond your SSO apps- NHI and agents treated as first-class objects like human identities: discovery, LCM, workflows and audit reporting- MCP to run from your LLMs (beta)- 2-week trial, live with 15 apps in under an hour
Happy to show it on your stack: www.idenhq.com or DM me at pranay [at] idenhq [dot] com
Also for C1 customers who don’t want to be Workday’d and are looking to switch, we can cover your remaining contract and migrate you to Iden for free.
Internal apps are where C1 costs the most to run. If your engineers built the connectors for your homegrown apps on the Baton SDK, every API change is theirs to chase. Iden builds and maintains those connectors itself, so your internal apps are zero-touch on your side, with no SDK to learn and no connector code to own.
Iden also governs the apps C1 sends to a ticket. It has connectors for 220+ apps without SCIM, automates the admin console of apps with no API, and builds a missing connector in 48 hours at no extra cost. Every connector deprovisions as far as the app allows, and Iden logs every action in an audit trail you can export at any time. It runs alongside Okta, Entra, Google Workspace or JumpCloud, and takes joiner, mover and leaver events from Workday, BambooHR, Rippling, Personio, HiBob or Gusto.
The price is published: $7.50 per user per month, every connector included, with a 2-week trial. The offer in that reply stands: if you’re leaving C1, Iden covers the rest of your C1 contract and migrates you for free. An MCP server, in beta, lets you run governance from your own LLM tools.
If most of your stack already supports SCIM, you’re good for now with C1 or your identity provider’s governance add-on. For the feature-by-feature view, see Iden vs C1.
How do you move off C1 without a gap in audit evidence?
- Export C1's access review reports before you change anything. They carry file hashes, and your auditor will ask for the last period's reviews whatever tool you run next.
- Send Iden the API documentation for every app you built a Baton connector for: a Postman collection, an OpenAPI spec or plain docs. Iden rebuilds those connectors within 12 hours, so nothing is ported by hand.
- Write down C1's birthright profiles and approval policies. They become the role policies and approval rules in the new tool, and any profile nobody can explain is one to drop rather than copy.
- Run the new tool alongside C1 through one full review cycle, with C1 still provisioning. Compare who each would have granted and removed.
- Cut over at a review boundary, so no campaign is split across two tools and two evidence trails.
The C1 migration guide covers the switch step by step, including the Baton connector handover.
Questions teams ask about the deal
Yes. Workday signed a definitive agreement to buy C1, the company formerly called ConductorOne, on October 12, 2026 and announced it the next day. It expects to close by January 31, 2027. The price wasn't disclosed.
Yes. ConductorOne renamed itself C1 in April 2026 and moved to c1.ai, and conductorone.com now serves the c1.ai site. The product is the same.
Nobody has said. As of November 13, 2026, neither Workday nor C1 has announced plans for customers on BambooHR, Rippling, HiBob or SAP SuccessFactors. If you depend on one, ask for the commitment in your contract before you renew.
If your renewal falls before the close, ask for a 1-year term with a fixed price instead of a multi-year deal. That keeps your options open until the owner's pricing and roadmap are public.
For teams of 50 to 2,000 people, Iden. It covers what C1 does, from access requests and reviews to joiner, mover and leaver automation and AI agents, and also governs the apps C1 routes to a ticket, with 220+ connectors for apps without SCIM. If nearly every app you run supports SCIM, Okta or Entra's add-on is enough.
Plan for one full access review cycle with both tools running. Iden rebuilds your custom Baton connectors from your API docs or Postman collection within 12 hours and connects the rest in days; the parallel cycle proves the new reviews and offboarding before you switch C1 off.
Not yourselves. Share the apps' API documentation, a Postman collection or an OpenAPI spec, and Iden rebuilds every connector within 12 hours, then maintains them, so your engineers stop owning connector code.
Iden, Lumos, Okta Identity Governance, Microsoft Entra ID Governance, Opal, SailPoint and Zluri. For companies of 50 to 2,000 people, Iden is the closest fit: it covers C1's scope and also automates the apps C1 sends to a ticket.
Iden covers the remainder of your C1 contract and migrates you for free. Pranay, Iden's founder, made the offer in an r/IdentityManagement thread about the deal, and it stands for any C1 customer who wants to move.
Read next
On C1 and want out? We’ll cover the rest of your contract.
Bring your C1 app list. In 25 minutes, on your own apps and identity provider, we’ll show which ones Iden governs end to end, and the migration costs you nothing.