Evolveum midPoint

Evolveum midPoint is open-source identity governance software for organizations coordinating identities, roles, and access decisions across repositories. It best fits teams able to deploy and operate a Java application and build governance processes around it. Its breadth is appealing, but production planning must account for PostgreSQL and subscription-gated capabilities.

Overview

MidPoint connects identity synchronization with account provisioning and access governance. It can manage accounts, groups, and organizational units, while giving users a role catalog for requesting application access and administrators an audit trail for operations involving identity objects, roles, policies, and configuration. Evolveum positions it for organizations of varied types and sizes; it is less suited to teams seeking a managed, low-operations service.

The software is available under the Apache License and European Union Public License, with no license fee for the free plan. That does not make every production capability free: clustering and selected features require an active support subscription.

Key features

• Provisioning and synchronization: Automatic management of accounts, groups, and organizational units can reduce manual identity administration. Directory synchronization and connectors for LDAP, Active Directory, database tables, and CSV files provide familiar integration routes, though the connector catalog is not a substitute for checking whether a specific environment is supported.
• Access requests and reviews: Users can request application access through a role catalog, with policy routing requests for approval before roles are assigned. Certification campaigns let reviewers decide whether existing access remains necessary and support remediation, making the product relevant to organizations that need recurring access governance rather than provisioning alone.
• Audit trail: Administrators can examine recorded operations involving identity objects, roles, policies, and configuration. This gives governance teams a record of system activity, while the product's security guidance cautions that remote services should be restricted to trusted entities because their use can affect availability.
• Identity standards: SAML 2.0 single sign-on and TOTP multi-factor authentication are supported, alongside lifecycle provisioning.

Pricing

The midPoint plan costs free and includes the open-source software with no license fee. It suits organizations able to host and administer the system themselves. There are no published seat or quota caps in the plan terms, but free licensing does not include all production capabilities: clustering and selected features require an active support subscription.

Evolveum sells paid support subscriptions for third-level product support, with Product Support service levels of 8×5 next business day or 24×7. Organizations that need those capabilities or support should budget for a subscription; there is no published subscription price to compare here, so treat it as custom pricing.

Platforms

MidPoint is a Java application deployable on Linux, Windows, or macOS, as well as a web-accessible and self-hosted product with an API. Linux is recommended. macOS is not supported for production, so it should not be chosen as the production host. For midPoint 4.10 and newer, PostgreSQL is the only supported deployment database. Organizations requiring clustering or a generic repository database also need an active support subscription.

Who it's for

MidPoint is a strong fit for organizations that need identity lifecycle management, role-based access requests, certification campaigns, and auditability in one open-source system, and have the technical capacity to run it. It is a weaker fit for teams that cannot take on self-hosting, require a production database other than PostgreSQL, or need clustering without a support subscription. Evolveum says security issues receive its highest priority regardless of whether the reporter subscribes, but administrators still need to heed the guidance on limiting access to remote services.

Pros and cons

• Pro: Provisioning, synchronization, access requests, reviews, and auditing address several connected identity-governance needs in one system.
• Pro: The software has no license fee and is offered under the Apache License and European Union Public License.
• Con: Production deployment requires PostgreSQL for version 4.10 and newer, limiting database choice.
• Con: Clustering and selected features depend on an active support subscription, so the free license alone may not meet production requirements.
• Con: macOS is not supported for production, and self-hosting a Java application calls for operational capacity.

Alternatives

Soffid Identity Governance Administration is worth considering if you want free binary downloads with registration or a free trial; source code downloads do not require registration.

Corma may suit teams looking for a freemium option centered on identity-provider connections, browser extension, SSO connection, and a 10-app free tier.

Oracle Cloud Infrastructure Secret Management is an alternative for readers seeking a free API and web secret-management product.

Stitchflow is another option, with a free first workflow built and tested in your environment and an ongoing plan priced at $1,000 a month.

Okta Lifecycle Management may be preferable if you want a paid lifecycle-management service with 50 Workflows and Essentials priced at $17 a month per user, billed annually, subject to a $1,500 annual contract.

SailPoint IdentityIQ is a paid alternative with term subscriptions typically contracted for three years and billed annually upfront; pricing depends in part on the number of digital identities.

Beta Systems Garancy Suite offers one-time purchase and subscription options with custom pricing.

Saviynt Enterprise Identity Cloud offers Essentials and Pro tiers for organizations evaluating paid identity-cloud options; both use custom pricing.

Compare more options in Identity Governance Software and Identity and Access Management Software.

Verdict

Choose midPoint if your organization wants open-source identity governance with provisioning, access reviews, and auditing, and can operate a Java application on a PostgreSQL-backed production deployment. Its license-free core is a meaningful advantage, but the database restriction and subscription requirements for capabilities such as clustering are reasons to look elsewhere if your infrastructure or production needs do not fit.