Identity and access management has one vendor-neutral certification from a professional body and many vendor credentials, and most IAM job adverts never say which of them they value. This guide sets out what IDPro publishes about CIDPRO (Certified Identity Professional) and what Microsoft, Okta, SailPoint, CyberArk and Ping Identity publish about their own IAM certifications: exam format, content, fees, experience and renewal, where each body states them. It adds a preparation plan, a decision table and a non-human identity (NHI) angle, because service principals, workload identities and secrets now appear in exam objectives. It is for IAM engineers, administrators, architects and the managers who fund their training. Facts were checked on each body's own pages on 24 October 2026; gaps are marked where a page did not state a detail, and fees and rules change, so confirm before you book. The order of vendors below is not a ranking.
Key takeaways
- CIDPRO is the vendor-neutral option. IDPro describes it as a vendor-neutral IAM certification; the exam is about 150 multiple-choice questions over three hours, online and virtually proctored, for US$750.
- Vendor credentials prove product skill, not identity theory. They follow the product: Entra ID for SC-300, Okta Workforce and Customer Identity for Okta, PAM for CyberArk, PingFederate, PingAccess and PingDirectory for Ping.
- Renewal rules differ sharply. Microsoft role-based certifications expire annually with a free online renewal assessment; Okta certifications must be renewed every 24 months; IDPro says CIDPRO currently needs no continuing education.
- NHIs are now exam content. SC-300 has a full domain, weighted 20 to 25%, on planning and implementing workload identities: managed identities, service principals, app registrations, consent and risky workload identities.
- Pair one neutral and one platform credential. The common pattern is CIDPRO for concepts plus the credential for the platform you run, rather than collecting several vendor badges.
Who the certification is for
| Credential family | Issuer | Typical holder | What it signals |
|---|---|---|---|
| CIDPRO (Certified Identity Professional) | IDPro | IAM engineers, analysts, architects, consultants on any platform | Breadth across identity concepts, independent of product |
| SC-300 Identity and Access Administrator | Microsoft | Administrators running Microsoft Entra ID | Ability to configure users, authentication, workload identities and governance in Entra |
| Okta Certified Professional, Administrator, Consultant, WIC Developer, CIC Developer, Technical Architect | Okta | Okta administrators, implementers, developers and architects | Graded Okta platform skill, from entry to architect |
| SailPoint knowledge credentials and professional certifications | SailPoint | IGA engineers and implementers | SailPoint says professional certifications need professional experience and a proctored exam |
| CyberArk Defender, Sentry, Guardian | CyberArk | PAM operators, implementers, architects | Daily operation (Defender), deployment and configuration (Sentry), advanced cross-solution skills (Guardian) |
| Ping Identity Certified Professional (PingFederate, PingAccess, PingDirectory) | Ping Identity | Federation and directory administrators | Product features, installation, configuration and basic server administration |
If you are early in an identity career, read the IAM Engineer Career Guide first; the concepts in IAM and IGA Basics are the floor that every exam above assumes.
Exam format and domains
CIDPRO
- Format: about 150 multiple-choice questions, each with one correct or best answer, in about three hours.
- Delivery: online with virtual proctoring; you need a computer, a camera and internet access. Registration is through the WebAssessor portal linked from idpro.org.
- Scoring: IDPro sets the cut score by criterion-referenced methods and does not publish a number.
- Content: IDPro publishes a "CIDPRO Objectives and Topics" document and points candidates to the IDPro Body of Knowledge and its key terms. Domain weightings were not on the pages read; use the objectives document.
- Language: candidates whose second language is English can ask IDPro for extra time.
Microsoft SC-300
Microsoft's study guide lists the objectives that apply from 28 October 2026. The passing score is 700 or greater, and most questions cover generally available features.
| SC-300 domain | Weight | Identity and NHI content worth noting |
|---|---|---|
| Implement and manage user identities | 20 to 25% | Users, groups, external identities, hybrid identity |
| Implement authentication and access management | 25 to 30% | Entra user authentication, Conditional Access, Global Secure Access |
| Plan and implement workload identities | 20 to 25% | Choosing between managed identities, service principals, user accounts and managed service accounts; app registrations, API permissions, app roles; enterprise app consent; Defender for Cloud Apps; risky workload identities |
| Plan and automate identity governance | 20 to 25% | Entitlement management, access packages, access reviews, Privileged Identity Management including emergency access accounts, Identity Secure Score |
For the wider Microsoft path, see the Microsoft Security Certifications Guide.
Okta, SailPoint, CyberArk and Ping Identity
| Vendor | Format and delivery stated | Not stated on pages read |
|---|---|---|
| Okta | Online exams proctored by ProctorU; current catalogue includes hands-on configuration exams for Professional and Administrator, a developer exam and Workflows and Access Gateway specialty exams; some exams include unscored questions; results within 10 business days (15 for Technical Architect); cut scores not published | Question count, duration |
| SailPoint | Professional certifications use a proctored exam and require professional experience | Credential names, format, fees (detail sits on the SailPoint Community certification pages, not read) |
| CyberArk | Defender and Sentry exams delivered by Pearson VUE, with online proctoring supported | Guardian delivery, question count, fees, renewal |
| Ping Identity | Proctored, delivered remotely; one Certified Professional exam each for PingFederate, PingAccess and PingDirectory (as announced in October 2019) | Current catalogue, fees, duration |
Prerequisites and experience
- CIDPRO: IDPro states no experience requirement; preparation depends on your education and experience.
- SC-300: no prerequisite certification was stated in the study guide read.
- Okta: candidates must be 18 or have a guardian co-sign; the Administrator credential requires an active Okta Certified Professional certification; Technical Architect has extra eligibility rules on a separate page.
- SailPoint: professional certifications require professional experience; knowledge credentials are aimed at anyone building industry knowledge.
- Ping Identity: no training is required before the exams; Ping recommends its administration courses and product documentation.
- CyberArk: prerequisites were not stated on the certification page read.
Preparation plan
- Baseline the concepts (2 to 3 weeks): read the IDPro Body of Knowledge sections on lifecycle, authentication, federation and governance, whichever exam you plan. Take the CIDPRO practice exam (US$50) if CIDPRO is the target.
- Pick the platform exam that matches your job: a credential for a product you do not run is hard to pass and harder to use.
- Build a lab: a developer or trial tenant of your platform. For SC-300, create a managed identity, register an app with API permissions, configure an access package and an access review, and activate a PIM role.
- Study the objectives line by line: mark each objective as done in the lab, read only, or unknown, and close the unknowns first.
- Practise the NHI objectives deliberately: workload identities, consent and secret or certificate credentials on apps are where administrators with only user-lifecycle experience lose marks. The NHI Authentication Guide and Workload Identity Federation Guide cover the concepts.
- Sit the exam, then plan renewal: put the renewal date in your calendar the day you pass.
Cost, renewal and continuing education
| Credential | Exam fee stated | Retakes | Validity and renewal |
|---|---|---|---|
| CIDPRO | US$750; IDPro members get a discount (amount not stated); practice exam US$50 | Buy a new voucher, retake after 30 days | Continuing education not currently required |
| Microsoft SC-300 | Not read; Microsoft prices by country | Not stated in the study guide | Expires annually; renew free by passing an online assessment on Microsoft Learn |
| Okta (Professional, Administrator, Consultant, WIC Developer, CIC Developer) | US$250 each | US$100 per further attempt; 24 hours after the first fail, 14 days after later fails | Renew every 24 months or earn a higher-level certification; maintenance exams exist |
| Okta Certified Technical Architect | US$5,000 | US$2,500 per attempt | As above |
| SailPoint, CyberArk, Ping Identity | Not stated on pages read | Not stated | Ping says holders must recertify as new products and features are released |
Total cost of ownership matters more than the exam fee: an annual Microsoft renewal is free but recurring work, Okta renewal every two years may require a maintenance exam, and CIDPRO currently has no ongoing requirement.
Where it fits on the career path
| Situation | Reasonable first choice | Why |
|---|---|---|
| Administrator on one platform | That vendor's admin credential | Directly testable against daily work; employers using the platform recognise it |
| Consultant or architect across platforms | CIDPRO, then the platform credential clients ask for | Neutral concepts travel between clients |
| Moving from IT support into IAM | Platform admin credential with a lab | Hands-on proof matters more than theory at entry level |
| IGA or PAM specialist | SailPoint or CyberArk credential if you run them, plus CIDPRO | Governance and privileged access are deep product specialisms |
| Small team, one identity person | One platform credential | Budget and time go further on the tool you operate |
| Large enterprise, identity programme lead | CIDPRO, then a broad security credential | See the Cybersecurity Certifications Guide for CISSP and CISM paths |
Where NHI skills fit
None of the credentials above is an NHI certification. SC-300's workload identities domain is the most explicit NHI content in the exams reviewed; CyberArk's PAM tracks touch privileged credentials used by applications. Show NHI skill with project evidence: an inventory of service principals, a secrets rotation programme, or federation replacing static keys. See the Cloud Workload Identity Guide, the Secrets Management Guide and the Top 10 NHI Risks.
Mapping exam content to control frameworks
Hiring managers in regulated organisations often ask how a credential maps to the controls they are audited against. The table links the SC-300 domains and the CIDPRO scope to NIST and ISO references, so you can explain a certification in the language of your control owners. It shows where the exam content overlaps a control area, not that holding the credential satisfies the control.
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | Exam content that exercises it |
|---|---|---|---|---|
| Identity and account lifecycle | PR.AA-01 | AC-2 Account Management | 5.16 Identity management | SC-300 user identities domain; CIDPRO lifecycle topics |
| Authentication of people | PR.AA-01 | IA-2, IA-5 | 5.17 Authentication information, 8.5 Secure authentication | SC-300 authentication domain; Okta and Ping administrator exams |
| Authentication of services and workloads | PR.AA-01 | IA-9 Service Identification and Authentication | 5.17 Authentication information | SC-300 workload identities domain |
| Access rights and reviews | PR.AA-05 | AC-2, AC-6 Least Privilege | 5.15 Access control, 5.18 Access rights | SC-300 governance domain; SailPoint IGA credentials |
| Privileged access | PR.AA-05 | AC-2(7) Privileged User Accounts, AC-6 | 8.2 Privileged access rights | SC-300 PIM objectives; CyberArk Defender and Sentry |
For how these controls are run day to day, see the Access Reviews Guide and the Privileged Identity Management (PIM) Guide.
Practitioner checklist
- Decide whether you need neutral concepts (CIDPRO), platform skill (vendor credential) or both.
- Download the current objectives for your exam on the day you start studying, and check again before booking.
- For SC-300, confirm whether your appointment falls before or after 28 October 2026 and study the matching objectives.
- Build a lab tenant and complete every objective hands-on at least once.
- Give workload identities, app consent and access reviews deliberate practice time.
- Record the renewal date and the renewal method (assessment, maintenance exam, none).
- Ask your employer whether IDPro membership or vendor partner status reduces exam fees.
- Back the credential with NHI project evidence, which no current exam fully covers.
Standards and references
- IDPro: CIDPRO Certified Identity Professional
- IDPro: CIDPRO FAQ
- Microsoft Learn: Study guide for Exam SC-300 Microsoft Identity and Access Administrator
- Okta: Okta Certification Program Handbook
- CyberArk: Certification
- SailPoint: Identity University
- Ping Identity: Technical certification program announcement
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Microsoft Security Certifications Guide · IAM Engineer Career Guide · NHI Authentication Guide