11 Lumos Alternatives in 2026 for Mid-Market Teams Without an Identity Engineer

An honest comparison of 11 Lumos alternatives for IT teams at 100–500 employee companies. Real pricing where available, setup times, and when each tool wins. Updated May 2026.

Lumos's autonomous-identity pitch assumes you have a security team to govern the AI agents making access decisions. Most 100–500 employee companies don't. Industry research puts the median offboarding lag at 11 days — the window when a former employee still has active app access — and annual license waste at around $26,000 for a 250-person company (industry research figures, not KINT outcomes). The tools designed to close that gap are mostly built for enterprises with dedicated identity engineers, not for the IT operator running provisioning from a Notion doc.

Here are 11 Lumos alternatives ranked for teams that want joiner/mover/leaver automation without a dedicated identity engineer — and without an autonomous AI agent (like Lumos's Albus) taking access actions your one IT person can't fully audit.

TL;DR: If you're a 100–500 employee company evaluating Lumos and finding it's demo-gated, quote-only, and built for enterprise security teams with hundreds of apps, the clearest mid-market alternatives are KINT (published pricing, self-serve), JumpCloud (self-serve but it wants to replace your directory), Microsoft Entra ID Governance (good if you're already all-in on M365), and Okta LCM (if you're already on Okta). Everyone else — ConductorOne, Linx, Zluri, Torii, BetterCloud, Cerby, Stitchflow — is also demo-gated and quote-only. The full breakdown is below.

Quick Comparison: 11 Lumos Alternatives at a Glance

Pricing estimates for quote-only vendors are based on publicly reported deal data and market intelligence — those vendors do not publish pricing.

1. KINT (Kingsley Integrators)

What it is: KINT (by Kingsley Integrators) is an HR-driven identity lifecycle automation platform for companies with 100–500 employees. It automates onboarding, role changes, and offboarding across SaaS apps — including the apps without APIs, via browser automation — and produces SOC 2 CC6 audit evidence as a byproduct. Pricing is published per employee per month ($3 Starter, $5 Growth). Self-serve signup at kingsleyint.com.

When an HR event fires — hire, role change, termination — KINT reads it and pushes access changes to every connected SaaS app simultaneously. The full offboarding cycle, from HR trigger (T+0) to signed evidence packet with all app revocations confirmed (T+47 seconds), runs in under a minute. That's the T+0→T+47s walkthrough in practice: six-plus apps in parallel, no manual intervention, every action Ed25519-signed and mapped to SOC 2 CC6.1–CC6.3.

Best for: IT operators at 100–500 employee companies who want JML automation without an identity engineer, without a sales call to get a price, and without a six-week professional services engagement to go live.

Pricing: Published on the website. Starter at $3/employee/month (100–250 employees, 50+ live API and SCIM connectors). Growth at $5/employee/month (250–500 employees, 200+ mapped connectors in the catalogue, browser automation up to 5 apps, access intelligence, MCP integration). Custom for 500+. Annual prepay saves 15%.

Setup: OAuth setup under 5 minutes. First workflow in under an hour.

Honest note: KINT is early. As of May 2026, we have zero paying customers — we're actively looking for our first 3–5 design partners on a founding offer of $1.50/employee/month, 12-month price lock, in exchange for case-study collaboration. Adobe Admin Console browser automation is live; Figma, Canva, Notion, and Miro are in progress. If you need those apps fully automated today, ask us directly which connectors are ready.

The Lumos contrast: Lumos's Albus agent — its AI for autonomous identity governance — ingests HRIS data, app assignments, and usage logs, then makes or recommends access decisions continuously. That's powerful if you have an identity engineer configuring policies and reviewing agent output. KINT uses human-in-loop MCP — reads are free, mutations need your approval. If you want to understand and control every access change rather than delegate it to an autonomous agent, that's the meaningful difference.

Free trial: 14 days, no card, no auto-conversion. Self-serve signup at kingsleyint.com.

Pros:

• The only tool in this list that publishes per-employee pricing on the website
• Self-serve OAuth setup — no demo required, no sales call required
• Every action Ed25519-signed and mapped to SOC 2 CC6 automatically

Cons:

• Pre-customer; no named case studies yet
• Connector catalogue is growing — ask about specific apps before assuming

Try KINT free for 14 days →

14-day trial · No card · Live in under an hour

2. ConductorOne (C1)

What it is: ConductorOne rebranded to C1 in 2025. It's an access governance platform focused on just-in-time access, access reviews, and — as of March 19, 2026 — AI Access Management for governing AI tools, agentic apps, and MCP connections in enterprise environments.

Best for: Security teams that need fine-grained JIT access governance across complex environments, especially companies adopting AI tools and needing governance over what those agents can touch.

Pricing: Custom quotes. Reported deal range is roughly $4,300–$20,000/year for mid-market; large enterprises go higher. C1 does not publish a pricing page. Per-identity pricing model (not per user).

Setup: Sales-led onboarding. Weeks to deploy.

The Lumos contrast: Both C1 and Lumos are targeting enterprise security buyers. C1's differentiation is its JIT access model and the new AI Access Management layer; Lumos's is the autonomous-identity agent approach (Albus). Both are enterprise-first; neither is built for a 250-employee company whose IT team is one person.

Pros:

• Strong JIT access governance model
• AI Access Management is a genuine differentiator for companies deploying AI agents
• $79M raised (Series B, October 2025) — well-capitalised

Cons:

• Demo-gated; no self-serve
• No published pricing
• Overkill for teams that need basic JML, not JIT governance

3. Linx Security

What it is: An AI-native identity security and governance platform founded in 2023, headquartered in New York. Linx's angle is "below the IdP" — it ingests activity logs and access policies to map identity relationships, permissions, and privilege structures across cloud infrastructure, SaaS apps, and internal systems continuously.

Best for: Enterprise security teams that need continuous identity posture monitoring — not just JML workflows, but real-time detection of privilege drift, dormant accounts, and entitlement anomalies.

Pricing: Not published. Enterprise pricing, custom quotes only. Linx raised $50M in a Series B in March 2026 (led by Insight Partners), bringing total funding to $83M.

Setup: Enterprise deployment. Weeks.

The Lumos contrast: Linx is emerging as one of Lumos's sharpest competitors in the enterprise IGA space. Both are AI-native; Linx goes deeper on the entitlement-graph side. Neither is a fit for a 200-person company without a security team.

Why it's on this list: Linx topped several "Lumos alternatives" SERPs in 2026. If you're shopping Lumos at the enterprise level and want a newer, more security-posture-focused autonomous identity governance alternative, Linx is worth evaluating. If you're at 100–500 employees, it's not the right category.

Pros:

• Deep entitlement visibility; goes "below the IdP" where others stop
• Well-funded ($83M) with enterprise-grade deployments

Cons:

• Enterprise-only; no mid-market play
• No published pricing; demo-gated
• Overkill for standard JML use cases

4. Zluri

What it is: A next-generation IGA and SaaS management platform built for enterprise identity teams. Zluri combines app discovery, JML automation, access reviews, and license reclaim in one platform, with 300+ out-of-the-box connectors.

Best for: Companies with 500+ employees, a dedicated identity team, and a need for deep SaaS spend intelligence alongside governance.

Pricing: Not published. Enterprise quotes. Based on public buyer accounts, contracts typically start at $40,000–$80,000/year for 500 employees (based on market intelligence and buyer accounts — Zluri does not publish pricing). Setup typically involves a 6–12 week professional services engagement per G2 reviewer averages.

The Lumos contrast: Zluri and Lumos compete in the same enterprise IGA market. Zluri's edge is the SaaS management layer (license reclaim, app discovery); Lumos's edge is the autonomous-agent identity approach. Both are overkill for the 100–500 mid-market.

Why it's here: Zluri actively competes on the "Lumos alternatives" SERP and many mid-market buyers evaluate both together before deciding they need a different category of tool.

Pros:

• Broadest SaaS management coverage in the category (300+ out-of-the-box connectors)
• Strong license reclaim and spend visibility
• Well-established product with a large customer base

Cons:

• Demo-gated and quote-only
• 6–12 week setup per G2 reviewer averages is prohibitive for lean IT teams
• Not the right fit for companies without a dedicated identity function

5. Torii

What it is: A SaaS governance platform covering app discovery, employee onboarding and offboarding workflows, license management, and renewal tracking. Torii's workflow engine is its core — flexible automation without needing developers to build it.

Best for: Companies in the 200–2,000 employee range that need SaaS spend visibility and workflow automation alongside JML, and have a systems or IT ops person to configure and maintain it.

Pricing: Not published. Based on publicly reported contract data, annual contracts typically run $15,000–$35,000 for 100–500 employees — based on market intelligence and buyer accounts, Torii does not publish a pricing page.

Setup: Sales-led. Weeks to configure workflows properly.

The Lumos contrast: Torii is SaaS management-first with JML on top; Lumos is identity governance-first with SaaS visibility on top. Torii is not targeting enterprise security teams — it's closer to KINT's ICP. The difference vs KINT: Torii is demo-gated, quote-based, and doesn't publish pricing.

Pros:

• Flexible no-code workflow engine
• Strong app discovery across the stack
• Better fit for mid-market than Lumos or Zluri

Cons:

• Demo-gated; no published pricing
• No browser automation for apps without APIs
• Lighter on audit evidence vs a dedicated lifecycle platform

6. BetterCloud

What it is: One of the original SaaS management platforms, now owned by CoreStack following an acquisition completed on March 31, 2026. The combined entity is positioned as an "Agentic Governance OS." Raj Kunnath (CoreStack) is now President of BetterCloud.

Best for: Larger organisations — typically 500+ employees — with complex Google Workspace environments and a need for workflow automation across that ecosystem.

Pricing: Quote only. No published per-user price. Historically one of the more expensive tools in the category at renewal, which is partly why the CoreStack acquisition window is drawing evaluators to alternatives.

Setup: Sales-led. Weeks.

The Lumos contrast: BetterCloud and Lumos are both selling to enterprise IT and security buyers. The meaningful question for BetterCloud evaluators in 2026 is less "should I choose Lumos instead" and more "what does my renewal look like inside CoreStack's roadmap."

Why it's here: BetterCloud evaluators frequently land on Lumos in their research. If you're mid-market and evaluating both, neither is built for a lean IT team.

Pros:

• Deep Google Workspace integration
• Established 2,000+ customers and partners; not going away
• CoreStack acquisition brings FinOps angle for cloud-cost teams

Cons:

• Quote-only pricing, no transparency
• Acquisition creates roadmap uncertainty for the SaaS-management module
• Not mid-market: overkill for 100–500 employee companies

7. Cerby

What it is: Cerby (founded 2020, Alameda, CA) specialises in what it calls "disconnected applications" — apps without SCIM or SAML support that sit outside what your IdP can natively reach. It uses browser automation, a proprietary protocol layer, and a tool called Cerby Scout (record-and-replay for UI workflows) to push identity policy into non-standard apps.

Best for: Enterprise security teams that already have an IdP (Okta, Entra, SailPoint) and need to extend lifecycle governance to the shadow IT and marketing SaaS that the IdP can't touch.

Pricing: Custom enterprise pricing. Not published.

Setup: Weeks. Cerby integrates with your existing IdP and adds a layer on top.

The Lumos contrast: Cerby solves a different problem than Lumos. Lumos is trying to be your full identity governance platform. Cerby slots in beside an existing platform to handle the apps it can't reach. Lumos evaluators who specifically need non-SCIM app coverage should look at Cerby as a complement, not a replacement.

The KINT overlap: KINT also handles browser automation for non-SCIM apps — the difference is KINT builds it into the full JML lifecycle platform from the start, rather than as a layer on top of an enterprise IdP.

Pros:

• Best-in-class for non-SCIM, non-SAML "disconnected application" governance
• Works with existing IdPs rather than replacing them
• Named enterprise customer base including L'Oréal

Cons:

• Doesn't replace a full lifecycle platform — it extends one
• Enterprise pricing; not viable for mid-market
• Requires an existing IdP to integrate with

8. Stitchflow

What it is: A fully managed service for IT automation and lifecycle management. Stitchflow audits your app stack, documents your rules and exceptions, builds the workflows for you, and operates them — typically deployed in under a week.

Best for: Companies that want lifecycle automation but don't want to configure or maintain it themselves. If the idea of building workflows is the bottleneck, Stitchflow removes it.

Pricing: Quote only. Managed-service pricing by scope.

Setup: Fast — Stitchflow builds it for you in under a week as their standard model.

The Lumos contrast: Stitchflow is a service; Lumos is a platform. Stitchflow's appeal is operational — someone else runs it. Lumos's appeal is the platform depth and the Albus autonomous-agent layer. If your concern with Lumos is the complexity of configuring and governing autonomous agents, Stitchflow's model (they build it, you approve it) is meaningfully different.

Pros:

• Fastest time-to-live in the category (someone else does the setup)
• Works without an IdP
• Good fit for companies that want hands-off automation

Cons:

• You're dependent on their team; less in-house control
• Quote-only; no published pricing
• Offboarding-focused; less suited for full JML

9. JumpCloud

What it is: A cloud directory platform that combines LDAP replacement, SSO, MDM, and user lifecycle management in one product. JumpCloud is the only other tool in this list besides KINT that publishes its pricing.

Best for: Companies that don't have an existing directory and want to consolidate identity, device management, and access in one place. Strong fit for startups and SMBs.

Pricing: Published. Published floor around $9 (Device Management) / $11 (SSO); higher platform tiers are contact-sales. Annual billing saves 18%. Free tier for up to 10 users. Verify current tiers at jumpcloud.com/pricing before quoting.

The important distinction: JumpCloud wants to be your identity provider — it replaces your directory. Every other tool in this list, including KINT, plugs into the directory you already have (Entra, Okta, Google Workspace). If you're already on one of those directories and want lifecycle automation on top of it, JumpCloud is a different category of decision.

The Lumos contrast: Lumos sits on top of your IdP and adds governance. JumpCloud replaces your IdP. They're solving different problems for different buyers.

Pros:

• Transparent published pricing (the only other tool here besides KINT with a public price page)
• Self-serve; free trial available
• Good SMB/startup fit

Cons:

• It's a directory replacement — a bigger decision than adding a lifecycle layer
• No browser automation for non-SCIM apps
• Better fit for companies without an existing directory than for companies with Entra/Okta already deployed

10. Microsoft Entra ID Governance

What it is: Microsoft's identity governance add-on, which includes entitlement management, lifecycle workflows, access reviews, and separation-of-duties checks. If your organisation is already on Microsoft 365, Entra ID Governance builds on what you already have.

Pricing: $7/user/month as an add-on, requiring Entra P1 or P2 as a prerequisite. The full Entra Suite (which bundles ID Governance along with Internet Access, Private Access, and ID Protection) is $12/user/month.

The realistic constraint: You're already deep in the Microsoft stack. Entra ID Governance is the most cost-effective option in this list for M365-first companies — but only if you're managing lifecycle inside the Microsoft ecosystem. Non-Microsoft SaaS apps outside Entra's native reach are where the gaps appear.

The Lumos contrast: Microsoft Entra is built for Microsoft-heavy environments. Lumos is built for companies with hundreds of SaaS apps spread across IdPs. If your stack is mostly Microsoft, Entra wins on cost. If your stack is diverse, the gaps in Entra's SaaS coverage become the problem.

Pros:

• Most cost-effective lifecycle option for M365-first shops
• Deep Microsoft integration — Entra, Intune, Teams, Azure AD all converge
• Published pricing (unlike most competitors)

Cons:

• Requires Entra P1/P2 as a base — that's an added cost
• Gaps in non-Microsoft SaaS coverage
• Setup complexity scales with your Microsoft licensing configuration

11. Okta Lifecycle Management

What it is: Okta's native lifecycle management add-on, covering provisioning, deprovisioning, and profile syncing for companies already on the Okta platform.

Pricing: $4/user/month as a standalone add-on. Bundled into the Essentials suite at $17/user/month, which also includes MFA, Privileged Access, Access Governance, and 50 Workflows.

The key constraint: Okta LCM only works if you're already on Okta. It's not a standalone tool — it's an extension of the Okta platform.

The Lumos contrast: Okta LCM and Lumos aren't really competing. Okta LCM is for Okta customers who want native lifecycle automation without a third-party layer. Lumos is for companies that want governance beyond what Okta covers, across apps that Okta can't reach via SCIM.

Pros:

• Native Okta integration — zero friction if you're already an Okta customer
• Published pricing
• Strong provisioning for Okta-connected apps

Cons:

• Requires Okta — not viable without it
• Limited to apps that Okta can reach
• Setup complexity and cost grow quickly as you add apps

How do these tools compare on pricing at 250 employees?

Pricing is where mid-market buyers feel the gap most sharply. Below is an honest estimate at 250 employees, using published pricing where available and market intelligence estimates where not.

For all market intelligence estimates: these are based on publicly reported deal data and buyer accounts. The vendors named do not publish pricing. Your actual contract may differ.

When is Lumos actually the right choice?

This page exists to help you evaluate alternatives honestly — which means acknowledging when Lumos wins.

Lumos is the right choice if:

• You have hundreds of SaaS apps and a security team to govern AI agents. Lumos's autonomous-identity model — particularly the Albus agent (Identity Security Agents are in waitlist access; Identity Intelligence is GA) — is genuinely powerful when there's an identity engineer configuring policies and reviewing agent output. Without that person, the autonomy becomes a governance risk rather than an efficiency gain.
• You need enterprise IGA with Slack-native access requests. Lumos's AppStore model — where employees request app access in Slack and Lumos routes approvals — is polished and well-reviewed.
• Fine-grained entitlement visibility is the core requirement. Lumos's ability to surface who-has-access-to-what across hundreds of apps with anomaly detection is difficult to replicate at this price point for enterprise buyers.
• You're in a high-compliance environment with a dedicated identity engineer. SOC 2 Type II, ISO 27001, or FedRAMP contexts where policy enforcement needs to be automated and audited at the app entitlement level.

If you're a 100–500 employee company with one IT person, none of those conditions apply. That's not a criticism of Lumos — it's a category mismatch.

Lumos describes itself as an "Autonomous Identity Platform." If that framing resonates, and you have the team to govern it, Lumos is worth a serious look. If it doesn't fit your situation, the alternatives above are the honest answer.

FAQ

What is the best Lumos alternative for a 200-person company?

For a 200-person company without a dedicated identity engineer, the clearest options are KINT (published $3–5/employee/month pricing, self-serve OAuth setup, no demo required), Microsoft Entra ID Governance (if you're already on M365 — $7/user/month add-on), or Okta LCM (if you're already on Okta — $4/user/month). Every other tool in this comparison is demo-gated and quote-only.

Is Lumos overkill for mid-market companies?

For most 100–500 employee companies, yes. Lumos is designed for organisations with hundreds of SaaS apps and a security team to manage AI agents and set entitlement policies. The Albus autonomous identity governance agent, in particular, requires someone who can configure policies, review agent decisions, and tune exceptions — work that doesn't exist in a one-person IT department. Most mid-market IT teams have neither the apps nor the people to justify it.

What's the difference between Lumos and KINT?

Lumos is an enterprise Autonomous Identity Platform. KINT is an HR-driven JML automation platform for the 100–500 mid-market. Lumos uses autonomous AI agents (Albus) to manage access; KINT uses human-in-loop MCP — reads are free, mutations need your approval. KINT publishes pricing ($3–5/employee/month) and a full comparison is here. Lumos does not publish pricing and requires a demo.

What is Lumos Albus and is there an alternative to it?

Albus is Lumos's AI agent for autonomous identity governance, launched June 2025. It ingests HRIS data, app assignments, and usage logs to detect anomalies, approve or reject access based on peer-group analysis, and answer natural-language queries like "Who has anomalous access in Snowflake?" Albus acts continuously rather than on a scheduled review cycle. Note: Identity Security Agents are in waitlist access as of 2026; Identity Intelligence is GA. If you want the outcome — clean access, fast revocation, audit trail — without autonomous agent complexity, KINT and the tools in this list are built for that.

Do any Lumos alternatives publish their pricing?

Three tools in this comparison publish pricing: KINT ($3–5/employee/month), JumpCloud (published floor around $9–$11; higher tiers contact-sales), and Microsoft Entra ID Governance ($7/user/month add-on, $12 in the Entra Suite). Okta LCM also publishes a price ($4/user/month standalone; $17/month bundled in Essentials). Every other tool — ConductorOne, Linx, Zluri, Torii, BetterCloud, Cerby, Stitchflow — uses custom quotes and requires a sales engagement before you can see a number.

Which Lumos alternative is fastest to set up?

KINT: OAuth setup in under five minutes, first workflow in under an hour. JumpCloud: self-serve, hours. Stitchflow: under a week — but they build it for you, not a self-serve tool. Every other tool in this list requires a sales-led onboarding process that takes weeks, per G2 reviewer averages.

Does KINT require an identity provider like Okta or Entra?

No. KINT reads events from an HRMS (ADP, BambooHR, Workday, Darwinbox, and others) and pushes access changes directly to SaaS apps via API, SCIM, or browser automation. You can connect an IdP as a source, but KINT does not require one. This is the key architectural difference from tools that sit on top of Okta or Entra.

Which Lumos alternative handles apps without SCIM?

KINT (Adobe Admin Console live, more in progress), Cerby (the specialist in this category), and Stitchflow all handle non-SCIM apps via browser automation or a SCIM bridge. JumpCloud, Entra, and Okta LCM do not handle non-SCIM apps natively. Lumos, Zluri, Torii, BetterCloud, and ConductorOne have limited non-SCIM coverage.

Is there a free trial for any of these tools?

KINT: 14-day free trial, no card required, self-serve at kingsleyint.com. JumpCloud: free for up to 10 users. Most others require a demo before you can see the product.

What's the honest case against KINT?

KINT is pre-customer. As of May 2026, KINT has zero paying customers and is actively looking for its first design partners. If you need named case studies, third-party reviews, or a proven track record at your company's scale before you sign, we're not there yet. The founding offer ($1.50/employee/month, 12-month price lock, case-study collaboration) exists because being early should come with a real advantage for the companies willing to move first.

Try KINT free — no demo required

Start your 14-day free trial →

14-day trial · No card · Live in under an hour

Or read the head-to-head KINT vs Lumos comparison if you want the detailed breakdown. See KINT pricing for the full plan comparison.

Published: 2026-06-02 · Author: Gowtham Palanisamy, Founder, Kingsley Integrators