Optimal IdM is an identity and access management (IAM) company that controls how workforce, external and customer users sign in to systems and applications across cloud and on-premises environments.
It serves organisations from commercial enterprises to federal, state and local government agencies.
At A Glance
| Vendor | Optimal IdM |
|---|---|
| Category | Identity and access management (cloud, hosted, on-premises) |
| Identities covered | Workforce users, external and customer users, AI agents |
| Deployment | Multi-tenant or single-tenant cloud, hosted, on-premises, hybrid |
| Agentic AI | AI agents managed as first-class identities |
| Certifications | SOC 2 Type II, ISO/IEC 27001:2022, GDPR compliance |
| Customers | United Nations, US Department of Energy, AXA, ADP, FDIC |
| Market classification | Identity Verification |
What Optimal IdM Does
Many organisations run a mix of cloud applications, on-premises directories and legacy databases, each holding part of the picture of who a user is. Optimal IdM’s approach is to leave that data where it is and put a single layer over it: one sign-in for users, with multi-factor authentication included in every package, and one live view of identity data for applications, without copying directory objects between stores. Customers choose how to run it, as a cloud service, a hosted service, on premises or through the company’s IAM managed services.
Products
The OptimalCloud
The OptimalCloud is the company’s cloud IAM platform, aimed at organisations of any size that want sign-on, directory and user administration in one service. Its universal directory is a cloud LDAP delivered through a virtual directory, and lifecycle management handles users, groups, organisations and applications with delegated administration.
- Adaptive rules for authentication and authorisation, including step-up authentication
- Reporting driven by Splunk and a central audit trail
- SCIM, authorisation and management APIs
- Self-service password reset and self-registration
Multi-Factor Authentication
Multi-factor authentication helps teams add a second factor without forcing one device or method on every user. It accepts any TOTP-compliant authenticator app as well as SMS, email and voice passcodes. Optimal Push Authentication can add fingerprint verification and supports passwordless sign-in. MFA prompts can also be delivered inside Microsoft Teams, and behavioural biometrics check mouse, keyboard or touch patterns.
Virtual Identity Server
The Virtual Identity Server suits organisations with several directories that need a joined view for their applications. Written in Microsoft .NET managed code, it combines directories in real time with Union, Object Precedence and Attribute Precedence join modes. A virtual schema means Active Directory does not have to be extended for third-party applications, and the server exposes LDAP v3, REST and PowerShell interfaces with LDAP proxy firewall behaviour.
Other Offerings
Federation identity services, LDAP Proxy, multi-forest Office 365 and SharePoint support, Authentication as a Service, LDAP migrations and an Optimal License Management Assistant round out the portfolio.
How It Works
| Component | What it does |
|---|---|
| OptimalCloud deployment | Customers choose private dedicated single-tenant or multi-tenant cloud, and pick the data centre location. In broker mode users stay on premises and are not synchronised to the cloud, while hybrid mode syncs on-premises users and groups in real time. |
| On-premises connectivity | Software installed during onboarding synchronises with, and can authenticate against, on-premises Active Directory. A VPN option removes the need to sync at all. |
| Virtual Identity Server | VIS installs from a standard MSI and keeps its configuration in one XML file shared across instances behind a load balancer. It uses Active Directory or AD LDS as its repository, adapters translate LDAP queries into SQL for database sources, and every LDAP operation is logged to Microsoft SQL Server. |
Identities And Systems Covered
| Workforce users | Single sign-on, MFA, lifecycle management and self-service for employees. |
|---|---|
| External and customer users | CIAM and external user options. |
| AI agents | A central repository for agent identities with lifecycle management. |
| Directories | Multi-forest Active Directory, AD LDS, eDirectory, Oracle Internet Directory, OpenLDAP and generic LDAP v3. |
| Databases and cloud | Microsoft SQL Server, Oracle Database, Azure Active Directory including Office 365, and Google Cloud. |
Agentic AI Capabilities
AI Agent Identity Management
The OptimalCloud “treats AI agents as first-class identities”, keeping them in a dedicated repository where they can be monitored, controlled and audited:
- Agents authenticate with MFA and cryptographic keys
- Their activity streams in real time to Splunk
- Their lifecycle runs from provisioning and onboarding through access reviews to deprovisioning
- Agent environments can be isolated from one another
Integrations
| Area | Integrations |
|---|---|
| Applications | Pre-integrated SSO for Salesforce, Workday, ServiceNow, Slack, GitHub, AWS |
| MFA | Microsoft Teams, SecurID, SafeNet |
| Reporting | Splunk |
Company Background
| Founded | 2005. |
|---|---|
| Headquarters | Lutz, Florida, United States. |
| Ownership | Privately held and reportedly profitable in every quarter since it began. |
| Recognition | Included in the KuppingerCole Leadership Compass for Identity as a Service: Single Sign-On. |
Note: This overview is compiled from Optimal IdM’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.