⚠ Zero-Trust NewcomersLow threat

The one place Microsoft's grip on identity faces a real challenger is the independent identity providers — Okta above all — who built their businesses precisely on being the neutral, vendor-agnostic front door to every application a company uses. Their pitch is pointed: an enterprise that would rather not tie its login system to the same vendor that sells it everything else can put a Switzerland in the middle, an identity layer that treats Microsoft's applications and everyone else's exactly alike.

The threat has teeth because it attacks the keystone. If the directory becomes a neutral, portable layer rather than Microsoft's own, then the single strongest strand of the switching cost loosens, and the other applications that lock in partly because they trust Microsoft's login become, in principle, easier to swap later.

Bundling is Microsoft's answer. Entra's capable tiers come folded into the Microsoft 365 subscriptions a company already buys¹, so the specialist charging separately must justify a cost the customer can avoid simply by using what is already included. And the directory that already holds every employee and permission is itself sticky; migrating identity is one of the most frightening projects in all of corporate IT.

A low-to-moderate worry. The specialists win real business, especially where a company deliberately wants vendor neutrality, but Microsoft's bundled-in identity remains the path of least resistance for the enterprises already living in its world. The keystone is contested at the edges without being seriously loosened at the core.