Compare identity providers (Cognito, Azure AD B2C, Firebase Auth, OCI Identity Domains).
Showing 20 of 20 features.
| Feature | AWS | Azure | GCP | OCI |
|---|---|---|---|---|
Identity Service Core Identity | AWS IAM Identity Center (successor to AWS SSO) | Microsoft Entra ID (formerly Azure Active Directory) | Google Cloud Identity / Google Workspace | OCI Identity and Access Management (Identity Domains) |
Directory Service Core Identity | AWS Directory Service (Managed AD, Simple AD, AD Connector) | Entra ID is the native directory; Entra Domain Services for legacy AD | Cloud Identity directory; Google Workspace; LDAP via Secure LDAP | Identity Domains with built-in directory; IDCS for legacy |
User Provisioning Core Identity | SCIM provisioning from external IdPs to Identity Center | SCIM provisioning, HR-driven provisioning (Workday, SAP) | SCIM provisioning, Google Cloud Directory Sync (GCDS) for LDAP/AD | SCIM provisioning, LDAP sync via Identity Bridge |
Group Management Core Identity | IAM groups, Identity Center groups with permission sets | Security groups, Microsoft 365 groups, dynamic membership groups | Google Groups for RBAC, Cloud Identity groups with dynamic membership | IAM groups, dynamic groups (rule-based), Identity Domain groups |
Pricing Core Identity | IAM free; Identity Center free; Directory Service per hour | Entra ID Free tier; P1 ($6/user/mo); P2 ($9/user/mo) | Cloud Identity Free; Premium ($7.20/user/mo with Workspace) | IAM free; Identity Domains included in tenancy |
MFA Methods Authentication | TOTP, FIDO2/WebAuthn, hardware tokens (Gemalto) | Authenticator app, FIDO2, SMS, phone call, certificate, passkeys | Google Authenticator, Titan Security Key, phone prompts, passkeys | TOTP, FIDO2, push notification, SMS, email OTP |
Passwordless Auth Authentication | FIDO2 security keys for root and IAM users | FIDO2, Windows Hello, Authenticator phone sign-in, certificate-based | Passkeys, Titan Security Keys, phone-based FIDO2 | FIDO2 WebAuthn in Identity Domains |
Conditional Access Authentication | IAM policy conditions (IP, MFA, time, tags) | Conditional Access policies (user risk, device, location, app, session) | Context-Aware Access (device trust, IP, user, access level) | Sign-on policies with network, MFA, and risk conditions |
Risk-Based Authentication Authentication | No native risk detection; partner integrations available | Entra ID Protection: sign-in risk, user risk (P2 license) | Context-Aware Access with device posture and BeyondCorp | Risk-based sign-on policies in Identity Domains |
Self-Service Password Reset Authentication | IAM console password change; Identity Center via IdP | SSPR with customizable methods, writeback to on-prem AD | Google account self-service recovery; admin-managed policies | Self-service password reset in Identity Domains |
SAML 2.0 Federation Federation & SSO | Identity Center SAML federation; IAM SAML identity providers | Entra ID enterprise app SAML SSO; thousands of pre-integrated apps | Cloud Identity SAML apps; Google Workspace SAML SSO | Identity Domains SAML IdP and SP configuration |
OIDC Federation Federation & SSO | IAM OIDC identity providers; Cognito for B2C OIDC | Entra ID OIDC for app registration; B2C custom OIDC policies | Workload Identity Federation OIDC; Google Sign-In | Identity Domains OIDC applications |
Social Identity Providers Federation & SSO | Cognito User Pools: Google, Facebook, Apple, Amazon, OIDC/SAML | Entra External ID: Google, Facebook, Apple, custom OIDC/SAML | Firebase Auth: Google, Facebook, Apple, Twitter, GitHub, OIDC/SAML | Identity Domains: Google, Facebook, custom OIDC/SAML |
Workload Identity Federation Federation & SSO | IAM Roles Anywhere (X.509); OIDC providers for GitHub, GitLab | Workload identity federation for GitHub, Kubernetes, external OIDC | Workload Identity Federation for AWS, Azure, GitHub, Kubernetes, OIDC | API key, instance principal, resource principal; OIDC (preview) |
Cross-Tenant B2B Federation & SSO | AWS Organizations cross-account; RAM for resource sharing | Entra B2B collaboration; cross-tenant access settings | IAM domain-wide delegation; cross-organization policies | Cross-tenancy policies; Identity Domain federation |
Access Reviews Governance & Security | IAM Access Analyzer for unused permissions; manual review process | Entra ID Access Reviews for periodic membership and access recertification (P2) | IAM Recommender for excess permissions; Policy Analyzer | Access review workflows in Identity Domains |
Privileged Access Management Governance & Security | IAM Roles with session duration limits; no native PAM | Entra Privileged Identity Management (PIM) for just-in-time elevation (P2) | No native PAM; short-lived credentials via impersonation | Just-in-time access via approval workflows in Identity Domains |
Audit Logging Governance & Security | CloudTrail for API calls; Identity Center activity logs | Entra ID sign-in and audit logs; 30-day free, 30+ with P1/P2 | Admin Activity audit logs; Cloud Identity reports | OCI Audit service; Identity Domain sign-in and admin events |
Lifecycle Management Governance & Security | Manual; IAM credential reports; Identity Center deprovisioning via SCIM | Entra ID Governance: lifecycle workflows, entitlement management (P2) | Cloud Identity lifecycle; GCDS sync; automated deprovisioning | Identity Domain lifecycle with provisioning and deprovisioning |
Compliance Reporting Governance & Security | IAM credential reports; Access Analyzer findings; Config rules | Entra ID compliance in Microsoft Purview; Conditional Access insights | IAM Policy Intelligence; Security Command Center | Identity Domain reports; Cloud Guard compliance recipes |
Compare identity providers (Cognito, Azure AD B2C, Firebase Auth, OCI Identity Domains). This tool helps multi-cloud engineers generate valid configurations quickly without consulting documentation, reducing errors and accelerating infrastructure deployment. All processing runs in your browser with no data sent to external servers.
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.