# Positioning for identity management software > Explain why an IT team with an authoritative identity source should consider a different way to grant and revoke access consistently across applications. A practical procedure with a worked scenario, category-specific checks and an editable worksheet. Source: https://saas-marketing.net/industries/identity-management/positioning/ Topic: SaaS Product Marketing Type: field-guide Published: 2026-09-17 Last updated: 2026-09-17 Publisher: SaaS Marketing (saas-marketing.net) License: CC BY 4.0. Quote or republish with attribution and a link to https://saas-marketing.net/industries/identity-management/positioning/ ## Short answer A useful positioning brief for identity management software starts when manual provisioning leaves stale or excessive access. That event gives the IT identity lead a reason to reconsider the current process. ## Key takeaways - Start with the change that creates a buying conversation. - Name the alternative without caricaturing it. - Separate the purchase argument from the daily-use argument. - A polished message can still fail if it ignores this constraint: an integration badge does not prove every permission or deprovisioning path works. --- This field guide uses an IT team with an authoritative identity source as its working context. The buying conversation involves the IT identity lead, while the IT administrator needs to grant and revoke access consistently across applications. Adapt the scope when those roles, dependencies or operating conditions differ. ## Start with the change that creates a buying conversation A useful positioning brief for identity management software starts when manual provisioning leaves stale or excessive access. That event gives the IT identity lead a reason to reconsider the current process. A broad claim about efficiency does not explain why a purchase belongs on this quarter's agenda. Interview someone who recently faced the trigger and reconstruct what happened before a vendor was contacted. Record the work that became unacceptable, the people affected and the consequence of leaving it unchanged. Keep that account separate from a salesperson's interpretation of it. ## Name the alternative without caricaturing it The working alternative here is individual application accounts and spreadsheets. It may be inexpensive, familiar and adequate for a smaller team. Explain the condition under which it stops serving the customer rather than pretending it never worked. A comparison should acknowledge what the customer would lose by moving, including familiarity, flexibility and historical information. If the product cannot improve a material part of the workflow, a more forceful headline will not create a durable position. Use the customer's current process as the comparison baseline even when it has no commercial brand. ## Separate the purchase argument from the daily-use argument The IT identity lead needs confidence that the change is worth approving. The IT administrator needs a workable way to grant and revoke access consistently across applications. These are connected concerns, but the proof differs. A purchase narrative might show ownership and control; a user narrative should show the actual sequence of work. Write one sentence for each audience and test whether they contradict each other. Promising stronger control while hiding additional data entry is a common way to win approval and lose adoption. ## Build a claim that can survive a demonstration Use a joiner, mover and leaver test with break-glass recovery as a candidate proof exercise. The demonstration should reveal the mechanism behind the claim: what information enters, what the product changes, who acts and what can be inspected afterward. Avoid superlatives that have no defined comparison set. An honest limitation can strengthen the evaluation by identifying an unsuitable use case early. Keep a claim register with an owner and a link to evidence so sales copy does not drift beyond what the demonstration establishes. ## Test comprehension before preference Show a draft message to people in an IT team with an authoritative identity source. Ask what they think the product does, who it is for and what would need to be true for them to evaluate it. Do not ask whether they like the wording before learning whether they understood it. A respondent who repeats the headline has not necessarily connected it with their work. Ask them to describe a recent situation in which it would matter. Preserve confusing responses verbatim in the internal research notes, then revise the underlying explanation. ## Use objections to define the boundary The objection "A failed rollout could lock users out of business systems" belongs in the positioning brief. Decide whether it points to a product limitation, an implementation requirement or missing evidence. Each answer changes the public claim differently. A product limitation needs a qualification; an implementation requirement needs a clear plan; missing evidence needs a test. Do not turn a legitimate objection into an aggressive rebuttal. The useful output is a more accurate buying decision, including a clear reason some prospects should not proceed. ## Category-specific review Provisioning, role changes and removal can behave differently across connected applications. A directory integration may not cover every permission or session behavior. Ask which system is authoritative and what recovery path exists if a rollout affects access unexpectedly. Use synthetic joiner, mover and leaver cases with a supported application. Verify the resulting access rather than only the provisioning log. Keep a clearly approved recovery route and do not treat an integration logo as evidence that every access scenario is handled. ## Worked situation Imagine the IT identity lead evaluating a change after manual provisioning leaves stale or excessive access. In the first message test, a prospect describes the offer as "another system for administration." That response shows category recognition but no reason to change. Revise the proof around a joiner, mover and leaver test with break-glass recovery, then ask the prospect to explain which step differs from individual application accounts and spreadsheets. The useful evidence is a specific explanation, not a higher preference score. If the prospect still cannot connect the difference with the work needed to grant and revoke access consistently across applications, investigate the offer before running a larger messaging test. ## Working worksheet | Working item | Category-specific starting point | Question to resolve | | --- | --- | --- | | Audience | an IT team with an authoritative identity source | Which recent customer matches this scope? | | Buying trigger | manual provisioning leaves stale or excessive access | What happened immediately before evaluation? | | Current alternative | individual application accounts and spreadsheets | Where is it still adequate? | | Demonstrable difference | a joiner, mover and leaver test with break-glass recovery | What evidence supports the claim? | | Boundary | A failed rollout could lock users out of business systems | When should the prospect decline? | Add your evidence, owner and next action to each row. Read the [worksheet instructions](/resources/#using-worksheets) before completing the file. ## Run the review with the people who do the work Bring the IT administrator into the review of a joiner, mover and leaver test with break-glass recovery. Ask them to identify the input they would actually have, the exception they expect to encounter and the person who receives the output. Then ask the IT identity lead which unresolved issue could change the decision. Keep the two answers separate until the team understands whether the obstacle is workflow fit, implementation readiness or commercial priority. Record any dependency on HRIS, directory and SaaS applications beside the affected worksheet row. A dependency should have an owner and an observable completion condition. If it changes the scope of the offer, revise the public description before the next campaign. This prevents a useful planning exercise from turning into a promise the delivery team cannot meet. ## When to change the plan A polished message can still fail if it ignores this constraint: an integration badge does not prove every permission or deprovisioning path works. If new evidence changes the audience, required workflow or acceptance conditions, update the brief and explain why. Compare later results against the version of the plan that was actually used. ## Continue with the next decision Use the [ideal customer profile guide](/industries/identity-management/ideal-customer-profile/) when that is the next unresolved task, or return to the [identity management software marketing overview](/industries/identity-management/) to choose a different route. The [saas product marketing hub](/saas-product-marketing/) provides the broader method. ## Reference and scope The [primary category reference](https://developer.okta.com/docs/) is a starting point for checking product terminology and current capabilities. This page provides an original planning framework. It does not imply a vendor endorsement, firsthand product test, original market survey or guaranteed commercial result. ## Frequently asked questions ### Where should positioning for identity management software start? Explain why an IT team with an authoritative identity source should consider a different way to grant and revoke access consistently across applications. Confirm the customer situation and the evidence needed for the next decision before selecting a channel, format or tool. ### What category-specific concern should the team investigate? The concern "A failed rollout could lock users out of business systems" needs an observable test or a clear limitation. Also account for the dependency on HRIS, directory and SaaS applications; do not assume it is already resolved. ### What does the worksheet include? It contains the working items and category-specific starting points shown on this page. Add your own evidence, owner, status and next review decision. The examples are constructed, not reported results or industry benchmarks. ### How does this connect to customer value? The customer needs to grant and revoke access consistently across applications. A meaningful first checkpoint is to provision a test user and verify access removal across a supported app; the ongoing condition is that authorized access changes follow approved identity lifecycle rules. Choose the stage appropriate to this piece of work rather than combining all three into one metric.