Switching from SailPoint is a decision enterprise buyers effectively make twice: once in the steering committee, and again when the first hard application moves. Citadel Identity360 is built so both decisions rest on evidence your own team gathers. This buyer guide sets out the questions an IT leader should settle before a renewal date arrives, the records to secure before any change, and a pilot that tests the switch on your own estate before you sign anything.
The aim is a decision you can defend to finance, audit and the application owners who depend on access working on day one. Technical cutover planning is covered in our SailPoint migration phases and risk checklist; this page stays on the buying side of the move.
Why Switching from SailPoint Starts as a Buying Decision
An identity governance platform sits underneath onboarding, offboarding, certifications and audit sampling. Replacing it touches every one of those processes, which is why the commercial and organisational questions deserve answers before anyone writes a project plan. Buyers who settle scope, ownership and proof criteria early go into the renewal conversation with real options instead of a deadline.
Citadel Identity360 makes that early work productive. It is a single platform for lifecycle management, access certifications, segregation of duties, risk analytics, non-human identities and AI agents, with one plan covering people, workloads and agents within an agreed scope. That plan includes setup, rollout and the stabilisation period after go-live, along with a 400-hour customization allowance.
Terms Buyers Meet in a Platform Switch
- Switch decision: the formal choice to replace the incumbent IGA platform, approved by budget owners and security leadership.
- Exit inventory: the records, rules and evidence you must export or document from the current platform before it is retired.
- Proof pilot: a time-boxed evaluation in which Citadel governs a defined slice of your estate under agreed success criteria.
- Coexistence window: the period in which both platforms run, each with a clearly assigned role for every application.
- Verified outcome: an access change confirmed by a fresh read of the target system, as distinct from a task that was merely approved or attempted.
- Hypercare: the stabilisation support period after go-live, included in the Citadel plan.
What This Buyer Guide Covers and Leaves Aside
In scope:
- Commercial scope: what one plan covers and what customization is included
- Operating ownership: who will run the platform after go-live
- Application reach, including legacy and disconnected systems
- Contractor lifecycle, SoD and identity risk scoring
- Non-human identities and AI-agent governance
- Audit evidence continuity across the switch
Out of scope:
- Step-by-step cutover sequencing and rollback mechanics
- Rule-by-rule translation of existing workflows
- Licence negotiation tactics and contract law
Five Board-Level Questions and How Citadel Identity360 Answers Them
Will the Total Programme Cost Be Clear Up Front?
Budget owners want one number they can hold the programme to. Citadel covers people, workloads and agents on one commercial plan within an agreed scope, and that plan includes setup, rollout and hypercare. The included 400-hour customization allowance gives your team a funded pool for enterprise-specific work: an approval chain that mirrors your org structure, a report your auditors already expect, or an adaptation for an unusual application. For the finance side of the argument, our guide to building the identity governance ROI case gives a baseline-first worksheet.
Who Will Run the Platform After Go-Live?
Citadel is no-code first for routine configuration, so workflows, policies and campaign settings can stay with your own IT or IAM team rather than waiting in a queue for outside specialists. Specialised integration work may still call for engineering, and the pilot is the place to see where that line falls on your estate.
Will Our Hardest Applications Come Along?
A switch evaluation often hinges on the application with no modern API. Citadel connects over web-service APIs (REST and SOAP), SCIM provisioning, LDAP directories, JDBC database links, file drops over SFTP, scheduled batch feeds, mainframe interfaces and purpose-built custom connectors. When the only way to change access is a person clicking through admin pages, Citadel supports RPA-based integration: an approved change is carried out through the application interface by a configured workflow. Ask for each pilot RPA change to be checked with a separate read of the target, since a completed run alone does not prove the resulting permissions. Read the planning considerations for moving from SailPoint for how to assess connectors by operation rather than by count.
Will Contractors, Workloads and Agents Share One Governance Model?
Contractors move through Citadel with a sponsor, an engagement window, extension approvals and a governed exit, using the same joiner, mover and leaver logic that employees follow. Every service account, key and machine identity is tied to a named owner from the day it is created until it is retired. Agents listed in the central registries that AWS, Google Cloud and Microsoft Entra maintain are discovered into one governed inventory, MCP servers are registered with an accountable owner, and each agent is granted a named set of tools instead of a whole server. Citadel generates an MCP config file that Claude, OpenAI and Cursor clients load to connect to the MCP services it governs, and a kill switch is available to intervene and contain an agent.
What Will the Auditor See on the Other Side?
Auditors care that controls kept operating through the change. Citadel gathers audit evidence automatically for every access review, certification and policy enforcement action, with one-click exports for auditors. The identity graph traces any access path from a person or machine to a resource, revealing the grant behind each entitlement and its approver, while live monitoring for toxic combinations and a risk score per identity flag conflicts early. That evidence trail is the foundation that the account management and audit controls of NIST SP 800-53 expect organisations to maintain.
Switching from SailPoint: The Buyer Decision Matrix
Use this matrix in the steering committee. Each row pairs a Citadel strength with a question to put to the incumbent at renewal, so the comparison rests on answers you collect yourself.
| Decision factor | Citadel Identity360 | Question for the incumbent at renewal |
|---|---|---|
| Commercial scope | A single plan for people, workloads and agents that already funds setup, rollout and hypercare | Which identity types and capabilities does our current subscription cover? |
| Customization | A bundled 400-hour allowance for approval logic, reporting, policy and integration work | How are custom workflows and connectors funded after go-live? |
| Administration | No-code-first console for routine configuration | Which routine changes need outside specialists today? |
| Connector reach | APIs, SCIM, directories, databases, file and batch feeds, mainframe, custom builds and RPA | Which of our applications are still handled by manual tickets? |
| Contractor lifecycle | Sponsors, end dates, extensions and offboarding in the core lifecycle | Where are contractor end dates enforced in our current setup? |
| SoD and identity risk | Live toxic-combination monitoring, a per-identity risk score and access-path analysis | How many SoD exceptions are open and who owns them? |
| NHI and AI agents | Owners, tool-level authorization, agent discovery scoped to the AWS, Google Cloud and Entra central registries, and a kill switch to intervene and contain | Which service accounts and agents have no named owner today? |
| Audit evidence | Automatic evidence for reviews, certifications and policy actions, plus access-path tracing | How long does assembling one audit sample take our team now? |
| Deployment | SaaS, private cloud or on-premises | Does the current deployment model still match our hosting policy? |
On the incumbent side, one sourced point is worth raising at renewal. SailPoint announced on June 29, 2026 that Entro’s NHI and credentials security solutions are available to its customers as standalone offerings while native platform integration continues, so ask which of those offerings your renewal quote includes.
Build Your Exit Inventory Before the Renewal Conversation
The strongest negotiating position is a complete picture of what you would carry forward. Assemble it while the current platform is fully available, and keep it whatever you decide.
- Identity sources and correlation rules: which authoritative sources feed the platform and how accounts are matched to people.
- Role and entitlement catalogue: every role with its owner, purpose and last review date, flagged for keep, merge or retire.
- Certification history: completed campaigns, decisions and, most importantly, whether each revocation was confirmed in the target. Auditors often ask about that field.
- SoD rule set: each rule, the business process it protects and every open exception with its approver.
- Workflows and custom rules: documented by intent and outcome, so they can be rebuilt cleanly in Citadel rather than copied line by line.
- Application operations list: for each target, which actions are automated, which are ticket-driven and which are not governed at all.
- Non-human identity register: service accounts, keys and agents with owners, or flagged as ownerless for investigation.
Retain the exported evidence for the period your audit and records policies require. NIST Cybersecurity Framework 2.0 treats governance and supplier transitions as part of managing cyber risk, so the inventory doubles as a governance record.
Prove the Switch Before You Sign
A Citadel proof pilot puts evidence ahead of commitment: your team designs it, runs it and scores it.
- Choose three applications: one modern SaaS target, one directory or database target, and the application everyone dreads.
- Load identities from your authoritative source and let Citadel build the identity graph for that slice.
- Run a joiner, a mover, a leaver and a contractor expiry end to end, including approvals and SoD checks.
- On the dreaded application, combine a file or JDBC read with an RPA change and a fresh read to verify the outcome.
- Run one certification campaign with AI-assisted recommendations and confirm each revocation in the target.
- Register one MCP server and one agent with an owner, authorize two tools, and generate the access configuration.
- Export the evidence pack and hand it to your internal audit lead for review.
Score each step against criteria agreed before the pilot starts. If you want to weigh the wider estate, the migration effort scoring rubric turns the pilot findings into an effort estimate for every remaining application.
An Illustrative Switch Decision
The following scenario is invented purely to illustrate the method; it is not a customer story. A regional insurer has a platform renewal due within the year, a policy administration system whose access can only be changed by hand in its admin pages, a growing contractor workforce and automation agents built by different teams. The CIO commissions an exit inventory first, which shows that contractor end dates live in spreadsheets and that several service accounts have no owner. The team then runs the seven-step Citadel pilot. The policy system is governed through an RPA workflow, with each change checked by a separate read, contractors gain sponsors and end dates, and each agent receives an owner and a short list of authorized tools. The steering committee approves the switch on the basis of its own evidence pack, and phased cutover follows the approach in our safe legacy IGA migration plan.
Switching from SailPoint: Buyer Questions Answered
When is the right time to evaluate switching from SailPoint?
Start well ahead of the renewal date, early enough to complete an exit inventory and a Citadel proof pilot before the commercial decision is due. Evidence gathered in advance turns the renewal into a choice rather than a default.
What does Citadel Identity360 include in its plan?
A single plan covers people, workloads and agents within an agreed scope. It includes setup, rollout and hypercare and a 400-hour customization allowance your team can spend on approval logic, reporting, policy or integration work.
Can our IAM team run Citadel without outside specialists?
For routine configuration, yes. Citadel is no-code first, which means workflows, policies and campaigns can be run by your own IT or IAM staff. Specialised integration work may still need engineering, and the pilot shows where.
What happens to an application that has no API?
Citadel combines file, database and directory reads with RPA-based changes made through the application interface, and the pilot should check each outcome with a separate read of the target.
Are AI agents governed while both platforms are running?
Yes. Agents found through the Google Cloud, Microsoft Entra and AWS central registries join the Citadel inventory with owners and individually granted tools from the first pilot wave, and the kill switch remains available to contain an agent or intervene.
Which deployment models does Citadel Identity360 offer?
Citadel runs as SaaS, in a private cloud or on-premises, so the switch can follow your hosting policy rather than reshape it. Under SaaS, Astranova runs releases; in a private cloud or on-premises, your team owns the change window.
Put the Make-or-Break System Through Citadel First
Pick the application that would make or break a switch from SailPoint, and we will scope a Citadel proof pilot around it with your success criteria written down first. Request Demo to begin, preview the platform in the Citadel Identity360 videos, and see how agents and MCP servers are governed on the Citadel agent governance page. For a wider shortlist view, read our SailPoint alternatives guide, and use the CISA guidance on maturing zero trust identity controls as a neutral yardstick for the identity pillar you are strengthening.