Which open-source option replaces SailPoint, and when should you move?
If your SailPoint renewal, licensing change, data residency rule or lock-in concern is forcing a decision, the short answer is this: midPoint is the option for full identity governance, covering certification, role-based access control, lifecycle and auditing, while Apache Syncope fits lighter provisioning needs where you mainly want to create, change and remove accounts across systems. Both are open source with no license fees, so the cost question shifts to infrastructure, staff time, support and migration effort. Start by deciding which of those two scopes matches what your SailPoint deployment actually does today, not what its module list suggests.
If you run SailPoint IdentityIQ, the decision is genuinely a choice between two paths. The first is to stay on IdentityIQ and evaluate SailPoint's modernization route, which SailPoint announced on October 6, 2026 as IdentityIQ 9.0 for hybrid and on-premises customers. The second is to move to a self-hosted platform. Ask SailPoint directly what 9.0 requires in terms of upgrade effort, supported deployment models and timelines for your version, and compare those answers with the effort of mapping your existing roles, certification campaigns and connectors. If you run Identity Security Cloud, SailPoint is positioning Human Fabric as the evolution of that product for cloud customers, so confirm what it changes for your contract and data location before assuming the cloud path is the same as today. Where the answer is unclear, a written scope comparison is more useful than a sales conversation.
Open-source does not mean unsupported. midPoint is developed by Evolveum, which sells support subscriptions, consulting and training, so you pay for those services only if you need them, and you can run the platform with your own staff or a partner such as DeployOpen. Syncope is an Apache Software Foundation project under the Apache License 2.0, and its support model depends on whether you engage a commercial provider. Plan costs in components: one-time migration and role redesign, recurring infrastructure and operations, and any support contract you choose. Before committing, check the midPoint release documentation for the current long-term support release and its end-of-support date, and confirm your target connector coverage in the ConnId documentation.
midPoint, Apache Syncope and where each fits
Both candidates are self-hosted, Apache or EUPL licensed, and built for identity lifecycle work. They differ in how much governance depth they carry out of the box and how much configuration effort they demand, so the choice depends on your certification and role model requirements.
midPoint as the governance candidate
midPoint is an identity governance and administration platform developed by Evolveum since 2011, dual-licensed under EUPL and Apache 2.0. It covers provisioning, role-based access control, auditing, self-service access requests and role mining, which map closely to the governance scope most SailPoint IdentityIQ customers use. Its main trade-off is a large configuration model, so plan time for object design, mappings and role structure before building connectors.
midPoint release choice
Choose the release line before design starts. midPoint 4.8 (Curie) is a long-term support release supported until October 17, 2028, which suits a platform meant to run for several years. midPoint 4.10 (Braille) is the latest feature release, supported until November 26, 2027. Confirm the current support terms with Evolveum and your own upgrade policy before committing.
Apache Syncope for lighter scope
Apache Syncope is an Apache Software Foundation project for managing digital identities, distributed under the Apache License 2.0. It fits teams that need account provisioning, self-service and workflow-driven user management without a full certification and role mining program. Check whether its approval workflows and attestation features cover the campaigns your auditors expect, because its governance scope is narrower than midPoint's.
Syncope release and support
Syncope 4.1.3 was released on September 11, 2026. Read the downloads page for the supported release line, upgrade notes and the Apache License 2.0 terms before you pin a version. Ask your implementation partner which release line they will support, and who patches the platform between upgrades.
Connector coverage through ConnId
Both platforms reach target systems through connectors. midPoint uses the ConnId framework, where each connector is Java code behind a uniform interface that speaks the target system's protocol. Inventory your Active Directory, SaaS, mainframe and database targets early, then confirm which connectors exist, which you must write, and who maintains each one after go-live.
Sibling options for other products
If your current platform is Saviynt or One Identity, the sibling topics on this site cover those migrations in detail, including module gaps and connector rebuilds. Use this card set to compare the two open-source candidates first, then read the sibling page that matches your incumbent before you scope the work.
How midPoint and Syncope cover SailPoint's modules
This table maps each SailPoint IdentityIQ and Identity Security Cloud function to the nearest midPoint or Apache Syncope capability and flags where the reader must verify coverage. Read the last column first: it marks the gaps that decide whether a migration needs an extra tool or a custom build. Treat every cell as a starting point for a proof of concept against your own target systems and certification requirements.
| SailPoint function | midPoint | Apache Syncope and what to confirm |
|---|---|---|
| Compliance Manager (certification campaigns) | Access certification and audit are part of the midPoint scope. Confirm campaign depth, reviewer delegation and escalation rules in your environment. | Syncope covers provisioning and identity management, but certification campaigns are not a core focus. Expect custom work or a separate tool. |
| Lifecycle Manager (joiner, mover, leaver) | Identity lifecycle, provisioning and deprovisioning are core midPoint capabilities. Map your HR sources and lifecycle states during design. | Provisioning and lifecycle workflows are supported through Syncope. Confirm how approval steps and rule engine logic match your current policies. |
| Password Manager (self-service reset) | Self-service password reset is covered. Confirm integration with your directory, MFA and help desk workflow. | Self-service password functions are available. Test each target system's password policy against the connector you plan to use. |
| File Access Manager (unstructured data access) | Not a stated midPoint capability. Confirm whether an equivalent is needed, or plan a separate file governance tool. | Not a stated Syncope capability. Treat this as a gap to close with a separate product or a documented exception process. |
| Access requests (Identity Security Cloud) | Self-service access requests are covered, including approval flows. Verify request forms and approver routing against your requirements. | Self-service requests are supported. Confirm approval routing and audit trail depth before committing to a design. |
| Role model and role mining | Role-based access control and role mining, including simulations against production data, are part of the product. Validate results with business owners. | RBAC is supported. Role mining and simulation depth should be confirmed with a pilot dataset. |
| Connector coverage per target system | Connectors use the ConnId framework, where each connector is Java code behind a uniform interface. Inventory each target system and confirm a connector exists or must be built. | Uses ConnId as well, so connector work is shared. Confirm which target systems have maintained connectors before you plan the cutover. |
How do certification campaigns and role models carry over?
Certification campaigns and role models do not move as exports. In SailPoint IdentityIQ, reviewers, campaign definitions, role definitions and the policies that trigger reviews are usually built up over years of configuration, and many of those choices live in rules and workflows rather than in a simple list of roles. In midPoint, the equivalent work is to rebuild access certification definitions, the reviewer assignment logic and the escalation paths as midPoint objects, then test them against a copy of current assignments. Start by inventorying which campaign types, reviewer rules, remediation actions and role-based exclusions your current environment actually uses, because unused features do not need a rebuild.
For role design, midPoint's role mining capability, which runs analysis of existing assignments against production data, gives you a data-driven starting point for proposing roles. Treat the output as candidates, not finished roles. Business owners must still validate each proposed role, and the approval and policy logic attached to it (who may request it, which separation-of-duties constraints apply, and which exceptions require a second approver) must be rewritten in midPoint's own policy and approval model. Simulations against production data help confirm that a rebuilt role model grants the same effective access before anything is enforced. Confirm with your SailPoint administrators which role mining or role model features are actually in use, and with your auditors which campaign evidence they rely on, before you estimate the effort for this work.
What the multi-year cost of self-hosting midPoint includes
This table sets the SailPoint subscription against the cost components of running midPoint in your own environment, and marks each as one-time or recurring. Use it to build a like-for-like comparison, since midPoint carries no license fee but still needs people, infrastructure and connector work. No prices are given here, so ask each party for the components listed in the right-hand column before comparing totals.
| Cost component | Who is paid or who pays | One-time or recurring | What drives it |
|---|---|---|---|
| SailPoint license or subscription | SailPoint, under your contract | Recurring, usually per contract term | Contracted modules, identity count and renewal terms. Confirm the IdentityIQ 9.0 upgrade path and any migration credits in writing. |
| midPoint software | No license fee under EUPL or Apache 2.0 | None for the software itself | Confirm which features you need from the midPoint release in use, such as release support windows. |
| midPoint support subscription | Evolveum, optional | Recurring | Whether you want vendor-backed support, the release you run and your internal skill depth. |
| Infrastructure in your environment | Your cloud account, data center or hosting provider | Mostly recurring, with some setup | Identity volume, high availability design, environments for test and production, and backup retention. |
| Implementation and role model design | Your staff or an implementation partner | One-time | Number of applications in scope, role complexity and the amount of existing role data to clean up. |
| Connector build and rebuild | Your staff or a partner, through ConnId connectors | One-time, with recurring upkeep | Number of target systems, custom connectors and how often target APIs change. |
| Migration and parallel running | Your staff or a partner | One-time | Campaign history to carry over, cutover approach and how long both platforms must run together. |
| Testing and certification campaign validation | Your staff, auditors or a testing partner | One-time for setup, recurring for each review cycle | Frequency of access reviews and the evidence your assessors expect. |
| Internal skills and operations | Your staff | Recurring | Staff time for upgrades, patching, connector maintenance and incident response. |
What you give up when you leave SailPoint
Leaving SailPoint changes who maintains connectors, who runs the platform day to day, and who answers when something breaks. Each risk below has a common workaround, but each one carries its own cost and ownership question that should be settled before a migration plan is signed off.
Vendor-provided prebuilt connectors
SailPoint ships connectors for many target systems, and teams often rely on them without tracking the work behind them. With midPoint, each source or target system is reached through a ConnId connector, which is Java code that speaks the target's protocol. Before migration, list every system in scope, confirm whether a ConnId connector already exists for it, and decide who will build, test and patch the ones that do not, for example an internal team or a partner under a written scope.
SailPoint ecosystem integrations
Ticketing, HR, cloud marketplace and SIEM integrations built around SailPoint APIs or events will not carry over automatically. Inventory every inbound and outbound integration, including scheduled exports and reports that business teams depend on. For each one, decide whether to rebuild it against midPoint interfaces, route it through a middleware layer, or retire it after review by the owners of the downstream process.
Managed cloud operations
Identity Security Cloud removes patching, scaling and upgrade work from the customer. Self-hosting moves those tasks to your team or to a services provider, including database backups, certificate rotation, monitoring and upgrade testing. Ask who will hold on-call duties, how recovery will be tested, and which tasks will be written as runbooks so that operations do not depend on one administrator.
In-house midPoint skills
midPoint configuration relies on XML and object models, role and policy design, and connector tuning that most SailPoint administrators have not practiced. Plan for training, for pairing experienced staff with newer ones, and for a documented role model that survives staff changes. Evolveum offers training and consulting, and the internal team should decide how much of that knowledge it must hold in-house.
Vendor service levels
A commercial contract typically defines response times, uptime commitments and escalation paths. With open-source software, support comes from a subscription, a partner or your own team, and each option has different terms. Confirm the response times, severity definitions and named contacts in any support agreement you sign, and map them against the incident response commitments your regulators or customers expect from you.
How a SailPoint to midPoint migration runs
The sequence moves identity governance from SailPoint to self-hosted midPoint in controlled stages, so each role, certification and connector is proven against live data before SailPoint is switched off. It ends with SailPoint retired and its audit evidence kept in a form auditors can still read. The work needs an identity owner, application owners and a security reviewer at every stage.
Inventory modules, roles, campaigns and connectors
Document every SailPoint IdentityIQ module in use, including Compliance Manager, Lifecycle Manager, Password Manager and File Access Manager where licensed, along with each role, access policy, certification campaign, connector, workflow and integration with HR, ticketing or directory systems. The identity owner signs off the list, and each application owner confirms which target systems they rely on. The inventory is complete when every item is mapped to a midPoint capability, a ConnId connector, a custom build or a deliberate retirement decision. Items with no open-source equivalent are logged as gaps for the security reviewer.
Export and map identities, entitlements and history
Extract identities, account correlations, entitlements, role assignments and certification decisions from SailPoint in a documented format, then map them to midPoint objects such as users, roles, resources and assignments. Historical certification decisions and access request records are exported separately so that they can be retained as evidence rather than replayed. The check is a reconciliation report showing identity counts, entitlement counts and sample records matching between the source export and the midPoint test instance. Mismatches are resolved with the application owners before any step continues.
Build role model and confirm connector coverage
Design the role model in midPoint using the exported entitlements, and use midPoint's role mining capability to test whether the proposed roles match actual usage. Confirm that every target system has a ConnId connector that speaks its protocol, or scope a custom connector build. The security reviewer checks that least-privilege boundaries carried over from SailPoint policies are preserved. This step is complete when each target system has a tested connector and the role model has been reviewed against the inventory from the first step.
Pilot one application end to end
Select one lower-risk application and run the full cycle in midPoint: provisioning, a joiner, mover and leaver event, an access request with approval, a password reset and one certification campaign. Run the same scenario in SailPoint for comparison. The application owner validates the resulting accounts in the target system, and the security reviewer checks the audit trail for each action. The pilot is closed when the results match the expected outcomes and every defect found has a fix or an accepted workaround.
Run midPoint and SailPoint in parallel
Expand the migrated scope gradually while SailPoint remains authoritative for the applications not yet moved. Compare provisioning results, certification outcomes and access request decisions between the two platforms each cycle, and record every difference with its cause. The identity owner reviews the discrepancy log, and the security reviewer confirms that no access is granted or removed unintentionally. The parallel run ends when discrepancies are explained and the migrated scope has run through the agreed number of certification cycles, which the organization sets in its own governance terms.
Cut over authority to midPoint
Switch authoritative provisioning and certification for each application to midPoint in a scheduled change window, with a documented rollback path back to SailPoint. Freeze changes in SailPoint for the cut-over scope, then confirm that joiner, mover and leaver events trigger the expected actions in the target systems. The application owner signs off on production access, and the security reviewer records the cut-over decision and its evidence. Cutover is complete for a scope when midPoint is the only system issuing changes to it.
Decommission SailPoint and retain audit evidence
After every scope has been cut over and the rollback window has closed, shut down SailPoint and archive its configuration, logs, certification records and exports in read-only storage. Confirm with your auditors which records they will need for the retention period that applies to your organization, and check that the archived format remains readable without SailPoint. The step is complete when the archive is verified, access to it is restricted, and the decommissioning record is signed by the identity owner and security reviewer.
Which option fits your SailPoint situation
If you run IdentityIQ in hybrid or on-premises environments, your first question is whether SailPoint's IdentityIQ 9.0 path meets your requirements for the next several years. SailPoint announced IdentityIQ 9.0 on October 6, 2026 as the modernization path for hybrid and on-premises customers. Before deciding, confirm with SailPoint what 9.0 changes for your modules, upgrade effort and support windows. If the answer is a move, midPoint is the more complete option for governance workflows, while Apache Syncope fits narrower provisioning needs.
- Module mapping: List which of Compliance Manager, Lifecycle Manager, Password Manager and File Access Manager you actually use. File Access Manager has no direct equivalent in midPoint, so plan a separate tool for that scope.
- Custom rules and workflows: Count the customizations in your current deployment. These drive most of the effort in either path.
- Connector inventory: Check each target system against ConnId connectors. Gaps need custom Java connectors.
- Parallel running: Plan a period where both platforms reconcile the same identities before cutover.
- Release choice: For midPoint, compare the long-term support release 4.8 with the feature release 4.10 against your change tolerance.
Confirm module coverage and support dates in writing before committing to either path.
If you use Identity Security Cloud and your concern is where identity data is processed and stored, your first question is which residency and control requirements are binding on you. SailPoint describes SailPoint Human Fabric as the evolution of Identity Security Cloud for cloud customers, so a self-hosted move is a deliberate choice away from that managed service. For this group, midPoint or Apache Syncope deployed in your own cloud account or data center is the natural candidate.
- Data location: Document every region and tenant where identity attributes, logs and certification records currently live.
- Operating responsibility: Self-hosting moves patching, backup, high availability and monitoring to your team or a partner.
- Integration surface: Inventory the connectors that feed the cloud service, since each one needs a self-hosted equivalent.
- Evidence continuity: Confirm that historical certification and access records can be exported before the cloud tenant is retired.
- Network reach: Self-hosted connectors must reach on-premises and cloud targets, which affects where the platform runs.
Ask your legal and privacy teams to confirm the residency requirement in writing, since it determines whether a self-hosted move is required or only preferred.
If the trigger is a renewal, your first question is what share of your current spend is license fees and what share is the internal and partner work to run the platform. midPoint is released under EUPL and Apache 2.0 with no license fees, so the license line disappears. Costs move to support subscriptions if you buy them from Evolveum, consulting, training, hosting and the staff who operate the platform. Apache Syncope is also Apache 2.0 licensed, and its 4.1.3 release came out on September 11, 2026.
- One-time costs: Discovery, migration of roles and connectors, testing and parallel running.
- Recurring costs: Infrastructure, support subscriptions, patching, upgrades and staff time.
- Cost drivers: Number of identities, number of target systems, custom connectors and the amount of role redesign.
- Quote requests: Ask for a written scope covering each connector, each workflow and each environment, so that quotes can be compared.
- Exit terms: Ask your current vendor for export formats and data retention terms before negotiating renewal.
Build a comparison that includes the work your team carries after go-live, not only the license line.
If you operate in a regulated sector and need certification evidence generated and stored inside your own environment, your first question is which controls you must demonstrate and who will assess them. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Independent auditors and certification bodies make that determination. midPoint provides auditing, access request, certification-style governance and role-based access control that can feed that evidence, while Saviynt's cloud-native platform is a different model that you would need to assess against the same requirements.
- Evidence sources: Map each control to the log, approval or certification record that proves it.
- Retention: Confirm how long audit records are kept and where they are stored.
- Segregation: Verify that the platform administrators cannot alter their own approvals or audit trails.
- Testing: Plan security testing of the deployed platform and its connectors before assessment.
- Assessor alignment: Agree with your assessor which evidence formats they accept.
Confirm your control scope with your assessor before designing the evidence model, since the required evidence determines the architecture.
What do teams ask before moving off SailPoint?
How much does it cost to move off SailPoint to midPoint?
The software itself has no license fee, so the cost sits in people, infrastructure and support. midPoint is developed by Evolveum and dual-licensed under EUPL and Apache 2.0, so the platform carries no license charge. Your costs fall into four components: the implementation work (role design, connectors, workflow and certification setup), hosting and database operations, the connectors you need beyond what ships, and optional support from Evolveum or a partner. Implementation is usually the largest one-time cost and depends on how many applications, roles and approval paths you migrate. Ask any vendor for a quote built from a written scope that lists each of these components separately.
How long does a SailPoint to midPoint migration take?
The pace is set by scope and governance decisions, not by the tool. The main drivers are the number of connected systems, how much of your current role model you rebuild rather than reduce, how many certification campaigns and approval workflows must be reproduced, and how long your audit evidence must run in parallel. Connector work is often the least predictable item, because each target system needs its own ConnId connector or an adapted one. Because no duration was supplied for this comparison, ask any implementation partner for a timeline tied to a written scope with named milestones, and ask how parallel running and cutover are handled.
Can our internal team run midPoint without outside help?
Many teams run midPoint in-house after the first build, but the skill set is specific. Operating it needs people who understand identity lifecycle, role-based access control, and Java-based connector development through the ConnId framework, along with database and Linux operations. Check whether you have staff who can write or modify a connector, maintain the object model and XML or configuration objects, and run upgrades between supported releases. midPoint 4.8 (Curie) is a long-term support release supported until October 17, 2028, and 4.10 (Braille) is supported until November 26, 2027, so plan your upgrade calendar around those dates. Assess your skills honestly before you decide who owns the platform after go-live.
Does DeployOpen support a midPoint migration from SailPoint?
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, including cloud accounts, data centers and air-gapped networks. For a SailPoint exit, that can cover scoping the migration, rebuilding roles and certification campaigns, building or adapting connectors, and documenting the result. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ongoing support, upgrades and continuous testing are available as retainers. DeployOpen does not publish a price list, so a quote follows from the written scope. DeployOpen also prepares controls and evidence for compliance assessments, but independent auditors and certification bodies issue any audit report.
How do we compare midPoint support with SailPoint support?
Compare the two by what each model covers, not by headline price. SailPoint support is bundled with a commercial subscription, while midPoint is free to use and Evolveum sells support subscriptions, consulting and training separately. Ask each side for the same list: response channels and hours, which releases are covered and for how long, upgrade assistance, connector support for your specific target systems, escalation paths, and who is accountable for defects in custom code. Ask Evolveum for its current support terms in writing, and ask any third-party provider which parts of the stack it supports and where its responsibility ends.
Which SailPoint IdentityIQ modules do we need to replace?
Map each IdentityIQ module to a midPoint capability before you estimate scope. IdentityIQ includes Compliance Manager, Lifecycle Manager, Password Manager and File Access Manager. midPoint covers provisioning and deprovisioning, identity lifecycle, role-based access control, auditing, self-service access requests, password reset and role mining. File Access Manager and some certification features may not have a direct equivalent in midPoint, so confirm these gaps with the platform documentation and your own testing. Also confirm whether any module is used only in a single business process, because unused features are a common source of hidden scope.
Should we move to IdentityIQ 9.0 or leave SailPoint entirely?
This is a decision about risk, cost and the future of your identity platform, and it should be made on written facts from your vendor. On October 6, 2026, SailPoint announced IdentityIQ 9.0 as the modernization path for hybrid and on-premises customers, while Human Fabric is described as the evolution of Identity Security Cloud for cloud customers. Ask SailPoint for the upgrade effort, the supported migration path from your current version, and the end-of-support dates for your release. Then compare that against the effort of a move to midPoint, including connector rebuilds and parallel running. Keeping a current platform and leaving it are both valid outcomes if the numbers are documented.
How DeployOpen scopes and delivers a SailPoint replacement
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source identity platforms inside the client's own infrastructure, including their cloud accounts, data centers or air-gapped networks. For a SailPoint replacement, that means the midPoint or Apache Syncope deployment, its connectors, its role model and its certification workflows run in an environment the client controls. Most engagements are fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts. A quote follows from that written scope, and DeployOpen does not publish a price list. Ask any provider to show the scope document, the list of connectors and target systems it covers, and the named acceptance criteria before you compare figures.
The first decisions in a written scope are practical. Confirm which IdentityIQ modules you run today (Compliance Manager, Lifecycle Manager, Password Manager or File Access Manager), which source and target systems depend on them, and whether a connector exists in the ConnId ecosystem for each system or must be built. Ongoing support, upgrades and continuous testing are available as retainers, and they are usually priced separately from the one-time migration work. Ask whether the retainer covers midPoint or Syncope version upgrades, connector maintenance and security testing of the deployed platform, since those recur for as long as you run the platform.
DeployOpen prepares systems, controls and evidence for compliance assessments, including documentation of certification campaigns, access reviews and deprovisioning records. It does not issue audit reports, attestations or certifications. Independent auditors and certification bodies perform those assessments, so plan the evidence package with your auditor before cutover. DeployOpen is also not an official partner of Evolveum or the Apache Software Foundation. Confirm any vendor relationship directly with Evolveum or the Apache project, and ask your implementation provider to state in writing which vendor support, if any, sits outside its own scope.
