How to choose an IAM implementation partner

Most identity projects that go wrong were set up to fail in the selection meeting, when someone picked a partner off a slide deck. Before you sign, check one thing above all: whether the people who will actually build your system have built one like it before, and can prove it.

Identity programs rarely fail in production. They fail months earlier, and the bill shows up later. A partner who underestimates your apps comes back with change orders. A team that rotates juniors in after the sale leaves you with a half-built system and nobody who understands it. Worst case, you've paid for licenses that sit unused, and the access reviews your auditor expects still run on spreadsheets.

The vendor logo on the proposal tells you very little about any of that. Everything else in this guide follows from the one test in the opening line: who will do the work, and have they done it before.

Sometimes you don't need a boutique partner at all. If you have a standing identity team with product-certified engineers and a multi-year roadmap, doing it in-house keeps the knowledge where it belongs. If your program spans forty countries and needs an army, a large SIdefinitionShort for systems integrator. Think of the big consulting firms that build and wire up technology for clients. When a program needs fifty consultants next month, they're usually the ones who can find them.'s bench really helps. This guide is for everyone in between, who needs deep product skills for one defined program and can't afford to find out twelve months in that they bought shelfwaredefinitionSoftware that was bought and paid for but never put to real use..

For the engineers on the evaluation: the discovery step is where the real numbers come from. ConnectordefinitionThe link between the identity platform and one app. When HR marks someone as a leaver, the connector is what actually goes into that app and switches their account off. When the app upgrades, the connector is often what breaks. counts, the quality of authoritative sources like HR, and how mature your role modeldefinitionA list of business roles and the access each one gets. When a new accounts clerk starts, they get the clerk role, and nobody sits there ticking permissions one at a time. Partners can't price the build until they've seen it. is all vary hugely between organizations. A quote that skips that work is a guess.

Every partner page lists the same vendor logos. What you want is certified, named staff on the specific products you're deploying (SailPoint, CyberArk, Entra, whatever your stack is), and confirmation that those named people are the ones on your engagement. The oldest trick in services procurement is resume padding. The principal architect wins the deal and rotating juniors deliver it. Ask, verbatim: "Which of the people in this proposal will be on the project in month six, and what is your substitution policy?" A good partner answers with names and a contract clause. A bad one answers with an org chart.

References work the same way. "We have done fifty implementations" is marketing. "Call this identity lead at a company your size, on your product, and ask what went wrong" is evidence. Insist on at least two named references that you pick from a list. Otherwise you'll get the two happiest clients somebody chose for you.

Be wary of the partner-of-every-vendor firm, too. A consultancy that resells eight competing identity suites has a commercial reason to recommend whichever one carries the best margin this quarter, whether or not it fits your estate.

The most expensive words in identity are "we'll size it during the project." Connector counts, authoritative-source quality and role-model maturity vary so much between organizations that any implementation quote produced before a structured discovery is fiction. Usually it's optimistic fiction, corrected later by change orders. The clean pattern is a short, fixed-price discovery: inventory the applications, profile the source data, sketch the role model, and only then price the build. It costs weeks and saves quarters. If a partner resists (if the license order and the implementation SoWdefinitionShort for statement of work. That's the contract document that says what a partner will deliver, by when, and for how much. arrive stapled together), that is the clearest red flag in this business.

Discovery is also where you learn who actually shows up after the sale. Watch who the partner sends to the discovery workshops: if it is the same architects proposed for delivery, the firm is serious. If discovery is delegated to a sales engineer while "the delivery team forms later," you have already met the substitution policy in action.

A good implementation partner aims to become unnecessary, and that has to be written into the contract. Make runbooks and design docs deliverables with acceptance criteria, and use paired delivery so your engineers commit code alongside the partner's. Set the handover milestones at kickoff.

Then write exit terms that still hold up in a mid-project dispute over who keeps the configuration, the pipelines and the custom connectors. Ask, verbatim: "Describe the last engagement you exited. What did the client's team run without you on day one?" Partners who profit from permanent dependency can't answer that specifically. The good ones have the story ready, because the exit was the plan all along.

Exit terms are also where you find out who shows up after go-live. Governance doesn't stop there. Connectors break when applications upgrade, certification campaigns need tuning, and joiner-mover-leaverdefinitionGiving people access when they start, changing it when they switch jobs, and taking it away when they leave. Many audit findings in identity start here. exceptions pile up.

So ask what support really looks like after the sale. Will a named engineer who worked on your build pick up the call, or does a ticket queue route it to whoever is free? Ask what happens when a connector fails during a certification campaign, and get the answer as an SLA instead of an assurance. Plenty of firms deliver well and support badly. You'll spot it in the contract's support schedule long before you see it in the proposal, so read that before the pricing page.

# score each 0-2 · below 8 total, keep looking
named_certified_staff: on YOUR products, contractually locked
references: 2+ named, chosen by you
discovery: fixed-scope, before license spend
quote_before_role_model: red flag: walk
partner_of_every_vendor: red flag: ask whose margin wins
exit_terms: runbooks, paired delivery, handover milestones
# 8 or more? check the people, price after discovery, plan the exit

Choosing well is half of it. These habits keep the program in your hands, whoever the partner is and however long they stay.

How Cohash helps: our IAM assessments are fixed-scope and end in a ranked, costed roadmap, usually in under a month of work. You get that roadmap before anyone talks about licenses, and you can take it to any partner, including us.