For a regulated firm already deep in the Microsoft ecosystem, the identity platform decision often comes down to a specific question: do we use Microsoft Entra, which is right there in our stack, or Okta, the best-of-breed independent? Both are capable of meeting the access-governance expectations that DORA and NIS2 now attach to identity, so the decision is not really about capability — it is about the trade-off between integration and independence, and which one serves a regulated firm’s needs better.
The genuine trade-off
Entra’s case is integration. If your firm runs on Microsoft — Entra identity, Microsoft 365, Azure, the security tooling — then Entra is native to that world, licensed within agreements you may already hold, and tightly coupled to the rest of the estate. That integration is real value: fewer seams, unified management, and often a lower apparent cost. Okta’s case is independence and breadth. As a dedicated identity platform not tied to one vendor’s ecosystem, it tends to be strong on integrating a heterogeneous application estate, and it avoids concentrating your identity — a critical control — with the same vendor that provides your infrastructure and productivity stack. For a regulated firm, that concentration question is not trivial: putting identity, infrastructure and productivity all with one provider is a supplier-concentration decision a supervisor might reasonably ask about.
What matters for a regulated firm specifically
- Evidence, not just access. Both must produce the access reviews, certifications and privileged-access governance that DORA and NIS2 expect. Evaluate each on how well it evidences least privilege, not just how well it logs people in.
- The heterogeneous estate. Few regulated firms are purely Microsoft. How well each platform governs the non-Microsoft applications — the legacy systems, the specialist regulated tools — often decides real-world fit.
- Concentration and resilience. Consolidating identity with your primary infrastructure vendor is efficient but concentrates dependency; an independent identity layer is one answer to the concentration risk regulators increasingly scrutinise.
- Non-human and privileged access. Service accounts, machine identities and privileged access are where scrutiny concentrates; assess each platform on these, not the everyday user experience.
Making the call
There is no universally right answer, and the honest driver is usually context. A deeply Microsoft-committed firm with a relatively homogeneous estate and a comfort with the concentration trade-off will often find Entra the pragmatic choice. A firm with a heterogeneous estate, a deliberate independence stance, or a supervisor likely to probe supplier concentration may prefer Okta’s separation. The mistake is defaulting to Entra purely because it is bundled and appears cheaper, without weighing the concentration and heterogeneous-estate questions that matter more for a regulated firm than the licensing line.
Free · 4 minutes
Would you survive contact with a determined attacker — or an auditor?
Fourteen questions on access, patching, detection, and recovery — the basics that prevent most real incidents, and the ones most often assumed rather than verified. Banded finding on screen, full sheet by email.
The identity platform is the control plane a regulator now inspects, so the decision deserves to be made on evidence-production, estate fit and concentration — not on which option was already in the Microsoft bundle. Either can be the right answer; choosing deliberately between integration and independence is what makes it the right one for your firm.
Who this is for
This reading is for:
- CTOs and identity leads at Microsoft-centric regulated firms
- Security teams choosing an identity platform under DORA and NIS2
- Firms weighing the bundled option against the best-of-breed one
- Boards approving identity spend and wary of hidden trade-offs
Sixteen Pillars runs the identity-platform decision on evidence-production, estate fit and supplier concentration, not on which option was already in the Microsoft bundle. Pricing is published at /pricing/. If this is live for your organisation and you would like an independent reading, the place to start is a conversation.
Sixteen Pillars is a technology governance consultancy based in Cyprus. Engagements run remote across the EU, UK, and Middle East, with on-site time where the engagement requires it.
Free interactive tool
Website compliance checklist
What your site has to do, based on what it actually does
Answer as much or as little as you like — the list builds as you go. Nothing is stored against your name and no email is required.
Everything that applies
Ordered by what to do first: legal requirements you can close quickly, then larger pieces of work, then what is expected rather than required. Not exhaustive, and not a legal audit.
Dated PDF, yours to keep or circulate.
Free interactive tool
Interactive deadline calculator
Check which regulations apply to you and when
Regulation across the EU, UK, US and Asia-Pacific has moved considerably in the past eighteen months, and several headline dates have shifted more than once. Twelve questions, about three minutes.
Results are shown on screen — no email required. A dated summary is available to download, and can be sent on if that's more useful. What we do with your answers.
Most technology problems are not technology problems. They are control problems.
The systems exist. The investment has been made. The question is whether leadership can understand, direct, evidence, and sustain what those systems produce. Find out where control exists — and where it only appears to.
Full Governance by Sixteen Pillars
Govern your business. Prove your compliance.
A board assurance cockpit for EU-regulated financial firms — tamper-evident, hash-chained proof of governance across DORA, GDPR, NIS2, ISO 27001, the EU AI Act and MiCA. In development.
See what's coming