Best Microsoft Entra ID Alternatives (2026) Compared | Siit

Doren Darmon, HR & Operations Editor · Last updated: August 2026

TL;DR: Teams outgrow Microsoft Entra ID when licensing tiers gate the features they need and non-Microsoft apps, devices, or clouds multiply. Okta stands out for the broadest integration catalog; JumpCloud for mixed Windows, macOS, and Linux fleets. Other options cover regulated enterprises, lean IT teams, privileged access, governance, Google-centric shops, and self-hosted deployments.

How We Evaluated Microsoft Entra ID Alternatives

Microsoft Entra ID is Microsoft's cloud identity and access management (IAM) service, so a credible replacement has to cover single sign-on (SSO), multi-factor authentication (MFA), and user provisioning, or state plainly which adjacent job it does instead. 

We weighted the shortlist by workforce IAM capability and the availability of published pricing and public reviews; the table compares best fit, starting price, and G2 rating. The shortlist draws from commercial, governance, and open-source platforms and focuses on the eight that matter most.

Microsoft Entra ID Alternatives at a Glance

Entra ID replacements fall into three camps:

• Software-as-a-service (SaaS) identity providers (IdPs) that replace Entra ID outright (Okta, Ping Identity, OneLogin)
• Platforms that bundle identity with device management (JumpCloud, Google Cloud Identity)
• Adjacent options for privileged access, governance, and self-hosting (CyberArk, Saviynt, Keycloak)

Google Cloud Identity has no dedicated G2 listing; Google Cloud Identity Platform is a separate listing.

Category should drive the decision because access management, device management, governance, and self-hosting solve different problems.

1. Okta

Okta is a vendor-neutral workforce identity and access management platform that runs SSO, MFA, and lifecycle automation the same way across Microsoft, Google, and AWS estates. It is the most commonly shortlisted Entra ID replacement for organizations whose application portfolio extends well beyond Microsoft.

Okta Key Features

• Okta Integration Network: more than 8,000 pre-built integrations spanning SSO, provisioning, and MFA, so non-Microsoft SaaS apps connect without custom development.
• Okta FastPass: device-bound, phishing-resistant authentication with third-party authenticators that support the FIDO2 passwordless authentication standard. Passwords stop being an attack surface.
• Lifecycle Management: automated joiner-mover-leaver provisioning grants day-one access and revokes everything at offboarding from one trigger.
• Okta Workflows: no-code automation for identity tasks, so routine provisioning logic does not require engineering time.
• Identity Threat Protection with Okta AI: real-time detection and automated response to identity-based threats. Bot protection targets credential stuffing.

These capabilities suit buyers that need broad SaaS coverage and automated identity operations.

Okta Pros and Cons

Pros:

• Vendor neutrality means a cloud migration or an acquisition does not force an identity replatform.
• Centralized policies reduce inconsistent access rules across applications during onboarding and offboarding.
• Governance, privileged access, and threat protection live under one vendor as requirements grow.

Cons:

• Adaptive MFA and lifecycle automation are paid add-ons rather than baseline capability.
• A 2024 authentication cache vulnerability involving long usernames and late-Friday disclosure practices drew sustained criticism.
• Advanced configuration carries a steep learning curve, and documentation lags new feature releases.

The tradeoff is broad capability at a higher cost and with more administrative overhead.

What Users Say About Okta

Reviewers and practitioner forums agree on the product and argue about the price.

• G2 reviewers credit SSO with cutting password-related tickets and describe Okta Verify push MFA as low-friction, stepping up only when login behavior looks anomalous.
• A self-described former Okta employee on r/sysadmin estimates that a Microsoft-licensed shop with PowerShell expertise can rebuild roughly 90% of Okta's functionality in Entra ID for about half the cost.
• Threads describe organizations staying because redoing identity integrations is risky, even when satisfaction is low.

User sentiment sourced from G2 reviews, Reddit, a Hacker News pricing discussion, and a Hacker News security discussion as of August 2026.

Okta Pricing

• Starter: $6/user/month, billed annually, with SSO, MFA, Universal Directory, and 5 Workflows.
• Core Essentials: $14/user/month, billed annually, adds Adaptive MFA and Lifecycle Management.
• Essentials: $17/user/month, billed annually, adds Privileged Access for 2 admins, Access Governance, and 50 Workflows.
• Professional and Enterprise: custom quotes. These plans add Device Access, Identity Threat Protection, and Application Programming Interface (API) Access Management.
• Contract minimum: $1,500 per year, which excludes the smallest teams from the entry tier.

Pricing from Okta's pricing page. Verified August 2026.

Best fit: organizations running dozens of non-Microsoft SaaS apps across more than one cloud, where provisioning automation pays for itself in saved admin hours.

Look for Okta alternatives if your existing Microsoft licensing already includes Entra capabilities, or the contract structure doesn't fit your team.

2. JumpCloud

JumpCloud combines identity (SSO, MFA, LDAP (Lightweight Directory Access Protocol), RADIUS (Remote Authentication Dial-In User Service)) with cross-platform device management for Windows, macOS, and Linux. JumpCloud works mostly for small and mid-market teams retiring on-premises Active Directory.

These teams can avoid buying separate identity and endpoint products.

JumpCloud Key Features

• Cloud Directory: replaces on-premises Active Directory with LDAP, RADIUS, and SAML (Security Assertion Markup Language) SSO, plus 2,600+ SSO integrations.
• Cross-platform device management: one console for macOS, Windows, Linux, iOS/iPadOS, and Android. That covers the Linux and macOS gaps Entra ID leaves open.
• Microsoft 365 directory sync: provisions JumpCloud accounts into M365/Entra ID in real time, syncs attributes continuously, and imports users back via SCIM, the standard provisioning protocol.
• JumpCloud Protect MFA: push-based MFA covers Windows, macOS, and Linux device logins plus RADIUS and LDAP app access as well as web apps.
• Conditional access: restricts access by location, managed-device status, and group membership.

The combined feature set is strongest when identity and device management need one console.

JumpCloud Pros and Cons

Pros:

• Retiring on-premises Active Directory removes domain controllers from the estate without adding a second endpoint vendor.
• Directory sync can take over existing Microsoft 365 accounts or provision new ones, supporting gradual migration.
• Patch management, zero-touch enrollment, and full-disk encryption ship alongside mobile device management (MDM), not as separate tools.

Cons:

• Cannot manage or sync user passwords into Microsoft 365 while Entra Connect remains active; the connector must be removed first.
• Linux visibility is shallow: installed applications are not exposed via API, forcing manual compliance evidence.
• Phone support is not a standard channel; most customers work through email and chat.

Buyers should test Linux visibility, macOS reliability, and support channels before committing.

What Users Say About JumpCloud

Community discussions are more critical than review-platform feedback.

• G2 reviewers highlight audit readiness: device policies, MFA enforcement, and access provisioning consolidate into a single evidence source, with onboarding and offboarding as one action.
• r/msp (managed service provider) practitioners struggle to justify the spend against Microsoft 365 Business Premium plus a remote monitoring tool, describing broad functionality with limited depth in individual areas.
• Reviewers also report macOS MDM immaturity, including devices dropping out of enrollment and limited software-update scheduling.

User sentiment sourced from G2 reviews, Reddit, and Hacker News as of August 2026.

JumpCloud Pricing

• À la carte identity stack: $3/user/month billed annually ($4 monthly) and covers cloud directory, MFA, SSO, lifecycle management, password management, and more.
• Device Management package: $9/user/month billed annually ($11 monthly) with MDM, patching, software management, and remote access.
• SSO package: $11/user/month billed annually ($13 monthly) with directory, MFA, SSO, and lifecycle management.
• Device Identity Management: $13/user/month billed annually ($15 monthly) and combines the two packages.
• Platform tiers: contact sales.
• Trial and free tier: 30-day free trial with no feature restrictions; accounts created before February 1, 2024 keep a free-forever tier of up to 10 users and 10 devices.

Pricing from JumpCloud's pricing page. Verified August 2026.

Best fit: companies running Macs and Linux machines alongside Windows without enterprise Microsoft licensing, where one vendor for directory, SSO, and device control beats stitching three together.

Look for JumpCloud alternatives if: you already pay for a Microsoft bundle that includes Entra and Intune, or your Linux estate needs detailed, console-driven policy control.

3. Ping Identity

Ping Identity is an enterprise software company that provides intelligent identity and access management (IAM), single sign-on (SSO), and multi-factor authentication (MFA) solutions. Large, regulated organizations with mixed infrastructure are Ping Identity's core market.

The enterprise access management platform covers workforce, customer, and business-to-business (B2B) identity across cloud, on-premises, and hybrid deployments.

Ping Identity Key Features

• PingOne DaVinci orchestration: drag-and-drop, no-code design of authentication journeys, handling complex step-up and branching logic without engineering work.
• Deployment flexibility: multi-tenant cloud, dedicated tenant, self-managed software, and Federal Risk and Authorization Management Program (FedRAMP) High on Amazon Web Services (AWS) GovCloud. That range covers estates SaaS-only vendors cannot serve.
• Adaptive MFA: risk- and context-based authentication across FIDO2, biometrics, mobile push, SMS, and security keys.
• PingOne Advanced Identity Cloud: real-time identity synchronization between cloud and on-premises systems, with policy enforcement through PingGateway.
• AI agent identity in self-managed software: as of July 2026, Ping secures AI agents in private-cloud and hybrid environments as well as SaaS deployments.

These features favor organizations with custom authentication flows and mixed deployment requirements.

Ping Identity Pros and Cons

Pros:

• Protocol coverage (SAML, OpenID Connect, OAuth 2.0, SCIM, LDAP, Kerberos, RADIUS) reaches legacy systems most SaaS IdPs skip.
• A native Entra ID provisioning connector moves users, groups, and memberships between the two, easing coexistence during migration.
• Deployment options extend to fully self-managed software for organizations that cannot put identity in shared cloud.

Cons:

• Enterprise deployments require substantial implementation time and specialist expertise.
• Documentation is thin for complex environments, and integration partners have wrongly claimed scenarios are unsupported.
• Many applications lack direct integrations and need substantial customization.

Ping is best evaluated with a realistic implementation plan and an inventory of legacy integrations.

What Users Say About Ping Identity

G2 and r/sysadmin users consistently describe extensive capability paired with administrative complexity.

• Admins who evaluated both credit DaVinci with better authentication customization than Okta, alongside less mature lifecycle management and a less intuitive admin experience.
• G2 reviewers in banking and healthcare describe the platform as exceptionally stable in Kubernetes and hybrid cloud deployments.
• Practitioners in Microsoft-centric organizations favor Entra ID for its tighter fit with their existing M365 environment.

User sentiment sourced from G2 reviews and Reddit as of August 2026.

Ping Identity Pricing

• PingOne for Workforce Essential: $3/user/month with SSO, directory, SCIM, LDAP, Kerberos, RADIUS gateway, and no-code orchestration.
• PingOne for Workforce Plus: $6/user/month, adds adaptive MFA, passwordless/FIDO, and Microsoft integrations.
• Contract terms: annual contracts with a 5,000-user minimum at published rates; PingFederate and PingAccess are quoted separately. A 30-day free trial is available.

Pricing from Ping Identity's pricing page. Verified August 2026.

Best fit: regulated organizations in sectors like finance and healthcare that need custom authentication journeys across hybrid and legacy infrastructure.

Look for Ping Identity alternatives if: you are a small or mid-sized team that wants a fast SaaS-only rollout without specialist implementation expertise.

4. OneLogin

OneLogin is a cloud-based identity and access management (IAM) provider that develops a unified access management (UAM) platform for enterprise-level businesses and organizations. Lean IT teams can use OneLogin to deploy workforce SSO and MFA without an enterprise-suite footprint. The platform focuses on dedicated access management and fast implementation.

OneLogin Key Features

• SmartFactor Authentication: adjusts login requirements in real time using the Vigilance AI risk score across location, device, and behavior signals.
• MFA method breadth: time-based one-time passcodes (TOTP), hardware tokens, WebAuthn biometrics, and passkeys, so no user is stuck on SMS.
• Active Directory Connector: syncs AD to the OneLogin directory and onward to Microsoft 365, with automatic activation and license assignment.
• Real-time deprovisioning: subscribes to AD change notifications, so removed users are logged out of active sessions instantly.
• HR-driven provisioning: directory sync from Workday, UKG, Namely, and BambooHR turns HR events into access changes automatically.

The feature set favors straightforward SSO deployments with fast AD-driven offboarding.

OneLogin Pros and Cons

Pros:

• Fast to deploy and easy to templatize for straightforward SSO consolidation.
• Instant session termination on AD removal is a genuine offboarding differentiator.
• Step-up and conditional authentication flows come without enterprise-platform overhead.

Cons:

• Documented multi-hour outages and reviewer reports of connectivity glitches raise reliability concerns.
• Scope is SSO and MFA first; needs beyond those core functions outgrow the platform.
• A May 2017 breach exposed customer data, and the ability to decrypt encrypted data, and trust concerns linger in practitioner communities.

OneLogin fits focused access-management projects better than broad identity-governance programs.

What Users Say About OneLogin

End users are satisfied; administrators are more guarded.

• G2 reviewers like the fast, reliable MFA and one-click account termination, and consistently flag slow support resolution times.
• An enterprise cloud engineer on G2 sums up the trade as simpler and cheaper than most alternatives but slower to ship critical features.
• r/sysadmin threads position OneLogin as a solid non-Microsoft IdP rather than a feature-for-feature Entra challenger for Microsoft-centric environments.

User sentiment sourced from G2 reviews, Reddit, a Hacker News outage discussion, and Krebs on Security as of August 2026.

OneLogin Pricing

• Basic: $3/user/month with authentication and limited user management.
• Essentials: $6/user/month. It adds full user management plus Entra ID and Google Workspace directory sync.
• Business: $10/user/month. It adds SmartFactor Authentication, automation, and HR directory sync.
• Enterprise: quote only. It adds delegated administration, LDAP directory sync, and API access management.
• Workflows add-on: $2/user/month.

Pricing from OneLogin's pricing page. Verified August 2026.

Best fit: teams of any size consolidating SSO across SaaS apps where AD-driven instant offboarding is the priority and identity budgets are tight.

Look for OneLogin alternatives if you need device management, access certification and separation-of-duties controls alongside identity or if the outage and breach history is a dealbreaker for your risk profile.

5. CyberArk

CyberArk Workforce Identity is an identity security platform that pairs SSO and adaptive MFA with privileged access management (PAM). CyberArk is now part of Palo Alto Networks and sells its products under the Idira platform brand.

CyberArk Key Features

• Adaptive MFA and SSO: SAML, OpenID Connect, OAuth2, and WS-Fed coverage for standard workforce access.
• Secure Web Sessions: enforces zero-trust controls inside application sessions and works with apps managed by another IdP.
• Modern PAM: continuous discovery with AI-driven analytics and dynamic just-in-time access that removes always-on standing privileges.
• Third-party vendor access: browser-based, agentless, just-in-time-scoped external access with session isolation and recording.
• Agentic identity: scans SaaS, cloud, and developer environments for active AI agents and enforces task-scoped privilege controls.

These controls matter most when privileged sessions and external vendor access carry material risk.

CyberArk Pros and Cons

Pros:

• Privileged access and workforce access converge in one platform instead of two vendors.
• Federal and regulated buyers can run privileged and workforce identity in a FedRAMP High authorized environment, with phishing-resistant MFA at National Institute of Standards and Technology (NIST) authenticator assurance level 3 (AAL3).
• Session-level controls, isolation, recording, and continuous authentication extend security past the login event.

Cons:

• Initial setup is complex, and troubleshooting is painful when something breaks.
• The credential-retrieval workflow forces repeated MFA on session timeouts, a recurring usability complaint.
• The platform includes more privileged-access capability than teams with few privileged accounts need.

Small teams should confirm that their privileged-account volume justifies the administrative overhead.

What Users Say About CyberArk

CyberArk's extensive PAM capability drives both its strongest reviews and its usability complaints.

• r/IdentityManagement practitioners call it the dominant PAM platform and run it beside Okta or Entra ID for SSO rather than instead of them.
• Gartner Peer Insights reviewers describe capabilities like Identity Flows as powerful but slow to configure correctly, with a steep initial admin curve.
• Hacker News engineers report friction integrating with modern auth systems and note that audit and compliance requirements often keep it deployed.

User sentiment sourced from G2 reviews, Gartner Peer Insights, Reddit, and Hacker News as of August 2026.

CyberArk Pricing

• All editions: quote only; CyberArk publishes no per-user list prices.

Pricing from CyberArk's pricing page. Verified August 2026.

Best fit: security-led organizations in regulated or government environments where privileged access, vendor access, and workforce identity in one FedRAMP High platform justify quote-based procurement.

Look for CyberArk alternatives if: you are a small or mid-sized business (SMB) with few privileged accounts, or you need transparent per-user pricing before shortlisting.

6. Google Cloud Identity

Google Cloud Identity is a cloud directory and access management service that provides workforce identity, device, and app management from the same admin console as Google Workspace. It focuses on access management and directory functions.

Google Cloud Identity Key Features

• Cloud directory with SAML SSO: workforce sign-on to SaaS apps managed alongside Workspace, so identity never becomes a second admin silo.
• Company-owned device management: corporate device controls with mobile log event data for investigation.
• Automated mobile management rules: policy responses trigger without an admin watching the console.
• Session length control: admins cap session duration per user. Shorter sessions limit exposure on shared or unmanaged machines.
• SaaS app browsing and recommended app management: surfaces what employees use, a light form of shadow-IT visibility.

The platform is most useful when Google Workspace is already the primary administration console.

Google Cloud Identity Pros and Cons

Pros:

• The no-cost edition covers small organizations' SSO and directory needs with real offboarding control.
• No separate identity vendor to manage for teams already administering Google Workspace.
• Can serve as the identity provider for Microsoft 365 through SAML federation.

Cons:

• No governance capability at all: no access certification, no separation-of-duties checks, no provisioning governance.
• SAML app access control works only at the organizational-unit level, not per group.
• No RADIUS support, and Windows endpoint management does not match the Entra-plus-Intune stack.

Windows-heavy organizations should test endpoint and federation requirements before replacing Microsoft identity tooling.

What Users Say About Google Cloud Identity

Sentiment splits cleanly by environment: Google-first admins are content, while mixed-stack admins report more friction.

• r/sysadmin threads endorse Cloud Identity as a legitimate SSO layer with better offboarding than unmanaged personal accounts.
• One r/gsuite admin ran Google Workspace as the IdP for Microsoft 365 in production for nearly two years without issues, while others in the same thread report Microsoft inconsistently trusting Google MFA and painful incremental rollouts.
• Hacker News threads document business accounts suspended without warning, OAuth credentials revoked, and support effectively unreachable when it happens.

User sentiment sourced from Reddit, Reddit, and Hacker News as of August 2026.

Google Cloud Identity Pricing

• Free: 50 user licenses at no cost.
• Premium, annual or fixed-term plan: $7.20/user/month ($72/user/year).
• Premium, flexible plan: $8.40/user/month.
• Edition coverage: Premium includes device management, session controls, and SaaS app management.

Pricing from Google's Cloud Identity pricing page. Verified August 2026.

Best fit: Google Workspace shops that want SSO plus mobile device management from the console they already run, including small teams federating Microsoft 365 access for Google-first users.

Look for Google Cloud Identity alternatives if: your Windows fleet needs Intune-grade endpoint management, or you need governance, RADIUS, or group-level SAML access control.

7. Saviynt

Saviynt Identity Cloud is a cloud-native identity governance and administration (IGA) platform that folds privileged access management into the same product. It governs who holds access and proves it to auditors alongside whichever IdP handles sign-in.

Saviynt Key Features

• Unified IGA and PAM: lifecycle governance and privileged access share one data model, replacing two point products.
• Access certification: automated review campaigns produce the who-has-what evidence audits actually demand.
• Cross-application separation of duties (SoD): enforcement across app boundaries catches toxic access combinations that single-app controls miss.
• Just-in-time access: privileges are granted for the task and then expire.
• US federal deployment path: governance and cloud privileged access run in a FedRAMP-authorized SaaS environment, the only product covering both.

These capabilities address audit evidence and privileged-access governance, not workforce sign-in.

Saviynt Pros and Cons

Pros:

• Governance capabilities such as certifications, SoD, and lifecycle controls go beyond what access-management suites include natively.
• One platform for governance and privileged access simplifies regulated and federal procurement.
• Handles multi-cloud and SAP estates that stretch lighter tools past their limits.

Cons:

• No native SSO or MFA; an access-management IdP remains mandatory.
• Delivered as SaaS; no self-hosted deployment option is listed.
• Built for enterprise and federal scale; teams without audit mandates will leave most of it unused.

Saviynt belongs on a shortlist for governance projects, not as a standalone SSO replacement.

What Users Say About Saviynt

Governance buyers are enthusiastic about the scope and pointed about the execution.

• r/sysadmin practitioners comparing governance tooling rate Microsoft's native governance as significantly more limited than Saviynt-class platforms, since Microsoft requires custom builds for any custom API integrations.
• Gartner Peer Insights reviewers describe a strategic product vision that outruns execution, citing support and development hurdles.
• The same reviewer base also flags configuration complexity in the privileged access modules.

User sentiment sourced from G2 reviews, Gartner Peer Insights, and Reddit as of August 2026.

Saviynt Pricing

• All editions: quote only; Saviynt publishes no list prices and has no public pricing page.

Saviynt publishes no public list prices. Verified August 2026.

Best fit: enterprises with audit-driven mandates around access reviews and SoD that will keep their existing IdP for sign-in and bolt governance on top.

Look for Saviynt alternatives if: you need to replace Entra ID's SSO and MFA, or you want published pricing and a lighter governance footprint.

8. Keycloak

Keycloak is an open-source identity and access management server, licensed under Apache 2.0, that provides SSO, federation, and user management on infrastructure you host yourself. It suits engineering-led teams that want full control of the identity layer and its operations.

Keycloak Key Features

• Protocol coverage: SAML 2.0 and OpenID Connect plus Kerberos and LDAP federation, brokering identity for nearly any web application.
• SCIM provisioning: experimental in release 26.6 (April 10, 2026) and promoted to preview in 26.7.0 (July 9, 2026). It was built explicitly to support integrations such as Microsoft Entra ID, with full create, read, update, and delete coverage for users and groups, but no custom schemas yet.
• Step-up authentication for SAML clients: conditional-access-style controls arrived in 26.7 alongside existing client policies.
• Custom authentication flows: login logic is fully customizable in code, beyond what commercial policy engines expose.
• Self-hosted deployment: runs wherever you run Java infrastructure.

The feature set rewards teams that can own deployment, customization, and maintenance internally.

Keycloak Pros and Cons

Pros:

• You control upgrade timing and version pinning instead of accepting a vendor's release schedule.
• Identity data stays inside your own perimeter, so residency requirements are settled by where you deploy rather than by contract terms.
• A mature federation broker with deeper flow customization than commercial SaaS IdPs expose.

Cons:

• No Windows domain join, so it cannot replace hybrid Active Directory for Windows fleet management.
• SCIM provisioning is still preview-grade and lacks custom schema support.
• All operations are yours: upgrades, high availability, and security patching require real internal expertise.

Keycloak is practical only when the team can operate a production identity service reliably.

What Users Say About Keycloak

Self-hosters weigh Keycloak's control against its operational cost.

• r/devops practitioners running Keycloak as their main IdP describe it as far easier to manage, with less overhead, than Entra.
• Self-hosters on r/homelab counter that it is resource-heavy compared with lighter authentication options.
• Hacker News practitioners hunting for a self-hosted Entra ID replacement report that Keycloak leaves Windows domain join unsolved.

User sentiment sourced from Reddit, Reddit, and Hacker News as of August 2026.

Keycloak Pricing

• Open source: free under the Apache 2.0 license, with no paid tiers from the Keycloak project; infrastructure and operations costs are yours to carry.

The Keycloak project has no paid tiers. Verified August 2026.

Best fit: organizations with in-house Java or Kubernetes expertise that need self-hosted SSO for web applications and want to customize authentication flows in code.

Look for Keycloak alternatives if: you need a managed service, Windows domain join, or production-grade automated provisioning today.

Where Siit Fits

Siit is an AI Service Desk for the employee requests that surround workforce identity providers: access grants, password resets, group changes, onboarding. It lives in Slack and Microsoft Teams. Employees raise those requests conversationally in Slack or Microsoft Teams, and Siit routes or resolves them with attached directory context.

Siit deliberately scopes its identity work to what its integrations document. Through its Okta actions, Siit resets passwords, suspends or activates users, adds or removes group members, and assigns apps from inside workflows, request side panels, and the IT Agent. 

Its Entra connection syncs directory data and group membership; it does not reset passwords or provision applications. Device and directory data from JumpCloud syncs in the same way, and 500+ connectable apps round out the rest of the stack.

Teams comparing IdPs can explore Siit's integrations to see which identity actions their shortlisted platform would expose to the service desk.