One directory, one sign-in, and conditions on every request

Workforce identity and access for cloud, legacy and internal applications, from one console.

Akku IAM holds your workforce identities in one cloud directory and puts every application behind a single sign-in, including the ones that never supported a modern protocol. Adaptive MFA steps up when something about a request looks wrong. Access conditions on IP, device, location and time, applied by group or role rather than one policy for the whole business. And every login, session and factor used is recorded, so the question of who reached what has an answer rather than an estimate. Run it as your primary directory or alongside the AD and LDAP you already have.

What is workforce identity and access management?

Workforce identity and access management is how a business decides who its people are, what they can sign in to, and under what conditions. It covers the directory that holds those identities, the sign-in that gets someone into an application, the additional factors that prove they are who they claim, the conditions that allow or deny a request, and the record of what happened. Akku does all of it from one console. Identities live in a cloud directory that can replace your AD or sit alongside it. Applications connect through SAML, OpenID Connect, OAuth and WS-Fed, or through credential replay where none of those exist. Authentication factors, access conditions and password policy are set per group or per role, and everything that happens is logged.

Unified cloud identity store and directory synchronisation

One directory for every workforce identity.

A cloud-native directory holding all your workforce identities and attributes, extensible with your own custom attributes. Run it as your standalone primary directory in place of legacy AD or LDAP, or keep the directory you have and synchronise with it. A federation gateway extends trust to external identity providers and other domains, and replication keeps connected systems consistent.

Learn more

Single sign-on and application access

Every application behind one sign-in, including the old ones.

Over 500 pre-built connectors for common SaaS applications, and support for SAML, OpenID Connect, OAuth and WS-Fed for anything else. Desktop SSO extends it to domain-joined machines. And credential replay reaches applications that never supported a modern protocol, which is usually the internal system nobody wants to touch and nobody can replace.

Learn more

Adaptive multi-factor authentication

Factors that escalate when the request looks wrong.

An AI engine detects threats and abnormal behaviour and triggers risk-based step-up authentication, so a routine sign-in stays routine and an unusual one meets another challenge. Passwordless authentication removes the password as the primary factor. A library of factors covers the standard methods, and you can bring your own.

Learn more

Password management

Policy, self-service resets and sync across connected systems.

Define complexity, length, expiry, history and lockout rules at organisation, group or role level. Let people reset their own passwords through identity-verified self-service instead of raising a ticket. And synchronise password changes across connected directories and applications so one credential works everywhere.

Learn more

Contextual access control

IP, device, location and time deciding each request.

Permit or deny by source IP range, restrict to known or company-owned devices, allow access only inside defined hours, and gate by geography. Each control applies per group or per role, so the finance team's conditions and the field team's conditions are not the same policy.

Learn more

Identity and access security monitoring

Every login, session and factor, in one view.

Successful and failed login attempts, which user reached which application, and when, from where, with which factor. Risk and audit dashboards surface what needs attention. Logs are tamper-evident, so they hold up as evidence. Reporting runs automatically, and you can bring your own report format.

Learn more

See how it works.

One cloud directory, one sign-in for every application including the ones that never supported a modern protocol, and access conditions set per group or role. Run it as your primary directory or alongside the AD you already have.

One directory, one sign-inWorks alongside existing ADConditions per group or role