CyberArk Single Sign-On

Name: CyberArk Single Sign-On
Brand: CyberArk
Rating: 4.3 (227 reviews)

Leader

CyberArk is the global leader in identity security.

Est 1999|Valuation $20.6B|Raised $1.5B

LinkedIn 325K|Website|Web traffic 444K|FTEs 4,000|HQ Newton, MA

MarketsIdentity Provider (IdP) & SSO Identity Provider (IdP) & Single Sign-On (SSO)Identity Governance & Administration (IGA)

Platform CoversPrivileged Access Management (PAM)

Published Sep 26, 2026

01Common complaints

- **When primary need is CIAM (customer login)** - CyberArk Identity includes CIAM-capable features but community feedback indicates some teams have experienced challenges when using CyberArk for CIAM scenarios. Consider CIAM-specialist platforms (Auth0, Okta Customer Identity, ForgeRock) depending on requirements. - **For Microsoft-first organizations with existing licensing** - Where Microsoft Entra P1/P2 is already included via Microsoft bundles, adding a second workforce IdP can increase complexity and cost unless there is a clear justification such as privileged access alignment or required features not available in Entra. - **When maximum third-party ecosystem depth and community content are required** - Okta and Microsoft generally have larger public communities and more third-party guidance; organizations that require abundant community resources and prebuilt integrations may prefer those alternatives. - **When minimums / contract structure are prohibitive** - Framework pricing and vendor terms may include minimum quantities or term lengths that are unsuitable for small deployments. - **SSO logout and user experience inconsistencies** - Community reports indicate logout flows can be inconsistent depending on IdP and application token handling (single sign-on does not imply consistent single sign-out). - **SAML troubleshooting and attribute mapping** - Attribute and claim mapping, URL handling, and application-specific configuration can cause access errors until carefully traced and adjusted. - **Roadmap visibility** - CyberArk publishes release notes and announcements, but forward-looking roadmap details and specific dates typically require customer briefings or account-level communications. - **Post-acquisition uncertainty (2026)** - If the Palo Alto Networks acquisition proceeds and integration efforts continue, procurement and technical teams should expect potential changes to packaging, support processes, and product roadmaps during 2026 and thereafter.

02Why they buy

- **Integration between workforce identity and privileged access** - A differentiator for CyberArk is its longstanding focus on privileged security and the option to integrate workforce access controls with privileged access workflows and vaulting. - **Credential storage options** - CyberArk supports storing credentials in the Identity Cloud or in a self-hosted CyberArk Vault depending on deployment requirements. - **Published SOC reports for procurement** - Public availability of SOC 3 reporting and related trust documentation provides concrete artifacts for security and procurement reviews.

03Field reports

Note: CyberArk Single Sign-On is often reviewed under CyberArk Workforce Identity / CyberArk Identity rather than as a standalone SKU. - **Review platforms (examples; accessible excerpts vary by platform)** - TrustRadius hosts CyberArk Workforce Identity reviews. - G2 hosts CyberArk Workforce Identity reviews. - Gartner Peer Insights has listings for CyberArk Workforce Identity; full review text may require login. - **Community / social (direct quotes from Reddit)** - Example discussions show SSO/SAML edge-case behavior and logout caveats. Community comments are anecdotal and reflect specific environments or implementations. - Example negative sentiment in a community thread reflects a specific user’s experience and may not reflect the broader customer base. - Example positive comments report successful integration of Identity with on‑prem privileged access solutions in some environments. - **Why customers chose CyberArk SSO (themes)** - Reported reasons include: - Platform consolidation for organizations already invested in CyberArk (PAM + workforce identity) - Faster application onboarding and a central portal for end users - Alignment with existing security controls such as MFA and auditing - Vendor case studies claim time-boxed rollouts; these claims are vendor-authored and should be validated with references. - **Why some customers leave / churn reasons (themes from community and review patterns)** - Recurring themes include: - Product complexity and administrative overhead in broad CyberArk deployments - Mixed support experiences reported in community threads - Fit issues when using CyberArk outside its core strengths (for example, for CIAM or small/simple deployments) - **Optiv (vendor-authored story)** - Claim: replaced legacy SSO quickly; onboards all apps in a short timeframe framing. - Critical evaluation: timeline claims are vendor-published and may represent a best-case scenario with strong internal resourcing and vendor support; the story does not fully disclose internal labor, exceptions, or long-tail app onboarding. - **Grupo Argos (vendor-authored story and PDF)** - Highlights SSO rollout to applications (SuccessFactors, Ariba, Office 365) and a single portal experience. - Critical evaluation: benefits are plausible; however, the case study is vendor-produced. Validate outcomes by requesting references or third-party validation. - **Global Consultancy (vendor-authored PDF)** - Claim: a very short deployment timeframe for a constrained deployment (the study references a brief deployment for multiple tenants and SSO to several hundred users). - Critical evaluation: the example may represent a constrained scope or extensive services engagement; confirm scope details such as which applications were included and which items were deferred.

04Best fit

- **Company sizes (practical ranges)** - Practical fit tends to be mid-sized to very large organizations where central SSO and MFA policy management, application sprawl, and compliance requirements justify enterprise IAM investment. - Smaller organizations that already use CyberArk for PAM may also find Workforce Identity appropriate to reduce vendor footprint. - **Industries / verticals** - Security-sensitive industries (financial services, healthcare, critical infrastructure, government contractors) commonly deploy enterprise IAM/SSO; CyberArk has established recognition in privileged security contexts. - **Roles/personas** - Decision makers: CISO, VP Security, IAM Director, IT Director - Implementers: IAM engineers, security architects, identity governance teams, endpoint teams - End users: employees and contractors who access SaaS and internal applications - **Qualification criteria (good fit)** - Requirements for SSO + MFA with alignment to privileged access controls - A mix of SaaS applications and legacy/on‑prem apps where a central portal is desired - Internal staff and processes to manage an enterprise IAM program - **Deal disqualifiers (poor fit)** - Organizations that only require basic SSO for a small number of SaaS apps and already have Entra P1/P2 through existing licensing - Organizations that require fully transparent, self-serve pricing with low minimums - Use cases primarily focused on customer identity and access management rather than workforce SSO

05The pitch

What the product does (core value proposition)

- CyberArk Single Sign-On (SSO) is part of CyberArk Workforce Identity / CyberArk Identity (historically Idaptive) and provides centralized authentication to cloud, mobile, and certain on‑premises applications using standard federation approaches (e.g., SAML), plus an end-user portal and related identity controls. Product documentation emphasizes streamlined access and reducing the number of user-managed passwords, with options to store credentials in CyberArk Identity Cloud or a self-hosted CyberArk Vault for some use cases. - Official vendor product overview and feature pages.

Target market and market positioning

Positioned primarily for mid-market to enterprise organizations that want SSO as part of a broader identity security stack—particularly organizations already using or considering CyberArk PAM and seeking closer linkage between workforce access and privileged access workflows.
CyberArk positions SSO as one component of a broader identity security platform approach (SSO + MFA + lifecycle automation + integrations into privileged controls).

Get a comprehensive analysis of CyberArk Single Sign-On including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →