Identity RFP Question Bank

Copy-ready RFP questions for workforce IAM and SSO, CIAM, PAM, IGA and ITDR, plus security, pricing and exit questions, each with a note on why it matters and what a weak answer looks like.

An identity RFP works when every vendor answers the same specific questions in a form you can compare. This question bank gives you those questions by category: workforce IAM and SSO, CIAM, PAM, IGA and ITDR, plus questions every vendor should answer on security, pricing and exit. Each question has a short note on why it matters and what a weak answer looks like. Pick the questions that match your requirements; an RFP with 400 questions gets copy-pasted answers.

How to use this question bank

Generate the skeleton with the RFP Builder, which outputs a markdown RFP with requirements per category and a "meets / partially meets / does not meet" response format.
Add 15 to 30 questions from this bank that map to your actual requirements. Mark each Must, Should or Nice.
Ask for evidence, not adjectives: a documentation URL, a screenshot, or a live demo of the specific behavior. Score "yes, see docs URL" above "yes".
Send everyone the same scope for pricing (section 7) so the quotes can be compared.
Shortlist with the vendor selector and capability checker, and compare multi-year cost with the TCO calculator.

Response format to require for every question: Answer (Yes / Partial / No / Roadmap with date) | How (one paragraph) | Evidence (URL) | Plan or add-on required (name).

1. Workforce IAM and SSO

#	Question	Why it matters
IAM-1	Which protocols do you support for inbound SSO to your platform and outbound SSO to apps: SAML 2.0, OIDC, WS-Federation, others? Which are certified (for example OpenID Certification)?	Determines whether your legacy and new apps can both connect.
IAM-2	How many pre-built app integrations support SSO and SCIM provisioning, as opposed to SSO only? Provide the list for our top `[20]` apps.	Integration catalogs often count SSO-only connectors. Provisioning is what removes leavers.
IAM-3	Which phishing-resistant authenticators can an admin require (not just allow) per user group: FIDO2 security keys, device-bound passkeys, synced passkeys, certificate-based authentication?	Offering is not enforcing. See the MFA and authentication standard.
IAM-4	Describe your help desk MFA reset and account recovery options, including identity verification integrations.	Recovery is where attackers go after MFA is deployed (help desk social engineering).
IAM-5	What conditions can policies evaluate (device compliance, network, risk score, authentication strength, user action) and can policies run in a report-only or simulation mode?	You need to test policies before enforcing them; see the conditional access worksheet.
IAM-6	How do you protect sessions after sign-in: token binding to device, session revocation on risk, continuous access evaluation, Shared Signals Framework (CAEP/RISC) transmitter and receiver support?	Most current attacks steal sessions, not passwords (session cookie theft).
IAM-7	How are admin roles scoped, and can privileged admin roles be granted just in time with approval?	Super admin accounts are the prize in IdP attacks.
IAM-8	What logs do you retain, for how long, and how are they exported (API, streaming, SIEM connectors)? Is there an extra charge?	Investigations need IdP logs; short retention or paid export slows response.
IAM-9	What are your availability SLA, historical uptime, and options when your service is unavailable (cached authentication, offline MFA, emergency access)?	If the IdP is down, everything is down.
IAM-10	Which directories can you sync from and write back to (Active Directory, LDAP, HRIS), and what agents are required on premises?	Agents are infrastructure you have to patch and protect.

2. CIAM

#	Question	Why it matters
CIAM-1	How is a billable user defined (monthly active user, registered user, retained user), and are inactive, test, bot or deleted users billed?	Unit definitions set the bill more than the headline rate.
CIAM-2	Which passwordless options can customers use (passkeys, magic links, email or SMS OTP) and can you fall back without dropping conversion?	Passkeys reduce account takeover; fallbacks keep sign-up working.
CIAM-3	What bot, credential stuffing and fraud protections are included, and which are add-ons?	These are often priced separately and you will need them on day one.
CIAM-4	Can we fully brand and host the login on our domain, and what does the SDK do versus the hosted page?	Affects security (phishing look-alikes) and engineering effort.
CIAM-5	How do you support B2B customers of ours: organizations, per-organization SSO and SCIM, delegated admin?	Many B2C products grow a B2B tier; see the enterprise-readiness checklist.
CIAM-6	Where is customer data stored, can we choose the region, and how do you support consent records and data subject requests?	Privacy law obligations sit with you, not the vendor.
CIAM-7	What rate limits apply to authentication and management APIs, and what happens when they are hit during a traffic spike?	Launch-day outages often come from rate limits.
CIAM-8	How do we migrate existing users, including password hashes, without forcing resets?	Forced resets lose customers.

3. PAM

#	Question	Why it matters
PAM-1	Can access to servers, databases, cloud consoles and SaaS admin roles be granted just in time and removed automatically? Which targets need agents?	The goal is fewer standing privileges, not a bigger vault.
PAM-2	How is the vault protected (HSM, key custody), and what happens to access if the PAM service is unavailable?	The PAM system is itself tier 0.
PAM-3	Which session types can be recorded (SSH, RDP, database, web, Kubernetes) and is recording searchable by command?	Recordings no one can search do not help investigations.
PAM-4	How do you discover unmanaged privileged accounts and service accounts across `[AD, cloud, SaaS]`?	You cannot vault what you have not found.
PAM-5	How do you rotate service account credentials without breaking dependent applications?	Rotation that breaks production gets turned off.
PAM-6	How is vendor and third-party privileged access handled (no VPN, approval, time limit, recording)?	Third parties are a common entry point; see the third-party access policy.
PAM-7	What does the PAM product require of its own admins (MFA type, separation of duties, break-glass)?	Attackers target the tool that holds every key.

4. IGA

#	Question	Why it matters
IGA-1	How many of our `[N]` applications can you connect with read and write connectors, how many need custom work, and who builds and maintains them?	Connector count and cost decide IGA project success.
IGA-2	How do joiner, mover and leaver workflows trigger from our HRIS, and what is the measured time from HR change to removal?	This is the audit control; see the JML procedure.
IGA-3	What context do reviewers see in an access review (last used, peer comparison, risk) and what stops rubber-stamping?	Review campaigns fail when reviewers have no context.
IGA-4	Can you detect and enforce separation-of-duties conflicts across applications?	SoD is a common SOX and financial audit requirement.
IGA-5	Do you govern non-human identities (service accounts, OAuth apps, API keys) in the same reviews?	Most identities in a modern environment are non-human.
IGA-6	How are revocations confirmed in the target system, not just marked in IGA?	Decisions that never reach the target system are a recurring finding.
IGA-7	What role mining or role suggestion is included, and how are suggestions explained?	Roles reduce review volume; unexplained suggestions get ignored.

5. ITDR

#	Question	Why it matters
ITDR-1	Which identity sources do you ingest (Entra ID, Okta, AD, Google, AWS, SaaS audit logs) and with what delay?	Detection is only as good as its coverage and latency.
ITDR-2	Which identity attack techniques do you detect out of the box? Map them to our list: AitM phishing, MFA fatigue, token replay, OAuth consent phishing, Kerberoasting, password spraying.	Ask for detections by technique, not a count of rules.
ITDR-3	What response actions can you take automatically (revoke sessions, disable user, reset MFA, block app consent) and with what approval?	Detection without containment leaves the session live.
ITDR-4	Do you assess identity posture (stale admins, weak MFA, risky OAuth grants, misconfigured federation)?	Preventing attack paths is cheaper than detecting their use.
ITDR-5	What is your false-positive rate in comparable customers, and how is tuning handled?	Noisy tools get muted.

6. Security, compliance and the vendor's own identity

#	Question	Why it matters
SEC-1	Provide your current SOC 2 Type II report and ISO/IEC 27001 certificate, with scope.	Confirms the product you are buying is in scope.
SEC-2	How do your support staff access customer tenants? Is it customer-approved, time-bound, phishing-resistant and visible in our logs?	Support systems have been the route into customers more than once (Okta 2023 support breach, Okta via Sitel 2022).
SEC-3	What tokens or credentials do you hold for our environment (OAuth tokens, API keys, service accounts), how are they protected, and how fast can they be revoked?	A provider-side compromise can reach every customer at once (fan-out breach).
SEC-4	What is your breach notification commitment to customers (time and content)?	Your own regulatory clocks depend on it; see the incident communication template.
SEC-5	List sub-processors and hosting regions.	Data residency and transfer obligations.

7. Pricing and commercial terms

These questions come from SWI's Identity Pricing Transparency Index 2026, which found that most identity vendors price through sales. Send every vendor the same written scope: identity counts by type, how an active user is defined, connectors and applications, environments, modules, support tier and term.

#	Question	Why it matters
PRICE-1	Who counts toward the license? Are inactive or deprovisioned identities billed? Do service accounts count as identities? Do test environments cost money?	Unit definitions set the bill.
PRICE-2	Give a line-item quote with the per-unit price at our current count and at two and three times it, the overage rate, when overage is billed, and whether the next band applies to the whole volume or only the excess.	One annual total hides how the price grows.
PRICE-3	For each of these, say whether it is in the base price, an add-on, or a higher tier: connectors, SMS, session recording, data residency, sandbox environments, premium support, SLA upgrades.	Identity quotes grow by line item.
PRICE-4	What is the renewal cap, does the price hold if our counts fall, and what is the true-up schedule?	Year-one price is not three-year cost.
PRICE-5	What happens to our pricing and contract if you are acquired or the product is repackaged into a bundle?	Acquisitions are common in identity; see the consolidation report.

8. Exit

#	Question	Why it matters
EXIT-1	In what formats can we export users, groups, policies, logs and (for CIAM) password hashes?	Lock-in is mostly data you cannot take with you.
EXIT-2	How long after termination is data retained and when is it deleted?	Contract end obligations.
EXIT-3	Which configuration is portable via standards (SAML metadata, OIDC, SCIM) and which is proprietary?	Standards-based configuration is cheaper to move.

Scoring tip

Weight Must questions so that a single "No" removes a vendor, and score "Partial" only when the vendor names the plan, add-on or date that closes the gap. Record the evidence URL for each answer so the decision can be checked later.