Enterprise IAM Pivots to AI Agent Controls as Workday, IonQ Buy Identity Platforms

Acquisitions Signal Shift from Workforce IAM to Agent Governance

Workday agreed to acquire C1.ai, an identity platform built to manage access for both people and AI agents, in a transaction expected to close January 31, 2027. The deal extends Workday's human-capital position into territory currently occupied by SailPoint, Okta, Microsoft Entra, and CyberArk, with one critical difference: C1.ai grants and removes access based on current need across email, CRM, code repositories, finance applications, and cloud infrastructure, treating AI agents as first-class identities rather than service accounts.

Workday disclosed no purchase price, customer count, or migration timeline. For buyers, the acquisition is a roadmap signal, not an immediate product. Organizations whose applications center on Microsoft, SAP, or Salesforce should expect integration questions. Workday customers may eventually consolidate employee and AI-agent access through a platform already holding authoritative HR data, potentially reducing duplicate identity-governance infrastructure but increasing dependence on Workday for access policy.

Separately, IonQ announced an all-stock agreement to acquire Elisity, a zero-trust platform built around identity-based network access, for up to $1.3 billion. The transaction, expected to close in Q4 2026, targets the convergence of identity-based access control, zero trust, and quantum-resistant security. Elisity's IdentityGraph maps the identity and behavior of network assets; IonQ contributes post-quantum cryptography and quantum key distribution. The combination places IonQ against Microsoft, Cisco, Zscaler, Palo Alto Networks, Okta, CyberArk, and Netskope in zero-trust and identity security.

The reported $1.3 billion is a maximum transaction value. No revenue, customer count, or ARR was disclosed, making the operating valuation difficult to assess. The deal does, however, indicate that identity-aware segmentation and asset-level access policy are attracting strategic premiums. Enterprises with long-lived sensitive data—government, defense, financial services, healthcare, critical infrastructure—should evaluate whether quantum-safe cryptography belongs in near-term identity and network-security road maps.

SailPoint Adds Autonomous Controls and On-Premises Upgrade

SailPoint announced autonomous identity-security capabilities and IdentityIQ 9.0 at Navigate 2026. The updates include autonomous agents intended to enforce policy and reduce excessive privileges, autonomous identity security posture management (A-ISPM) for identifying dormant accounts and orphaned access, just-in-time provisioning and zero-standing-privilege controls for human users, service accounts, and AI agents, and AI-agent discovery, runtime authorization, and emergency kill-switch controls.

A-ISPM, the Harbor Pilot Policy Agent, and a Proofpoint integration are expected in Q4 of fiscal 2027. Broader capabilities begin rolling out from Navigate 2026. IdentityIQ 9.0 adds time-based access for roles and entitlements, a rebuilt technical foundation, and an automated upgrade tool.

SailPoint is positioning against Microsoft Entra ID Governance, Okta Identity Governance, CyberArk, Saviynt, Omada, and newer AI-agent security products. Existing IdentityIQ customers could gain a migration path toward agentic controls without immediately replacing on-premises governance. Buyers should distinguish generally available functionality from roadmap items and require demonstrations using their own service accounts, workload identities, and AI-agent workflows before assigning incremental budget. No pricing or quantified performance results were disclosed.

Infotech Acquires Zluri, Combines SaaS Discovery and Identity Governance

Infotech completed its acquisition of Zluri on October 14, 2026. Financial terms were not disclosed. Zluri had raised $32 million in venture funding through 2023, with Lightspeed leading its last disclosed round. The company said in March 2026 that more than 250 organizations used its identity-security platform, which covers employees, service accounts, and AI agents.

Zluri's Application Discovery and Identity Governance and Administration modules launched within Infotech's CIO Analytics offering on October 14. The combination addresses a common IGA weakness: incomplete visibility into the applications and accounts requiring governance. Enterprises may gain a lower-friction route from SaaS discovery to access certification and deprovisioning, but buyers should validate retention, integration depth, supported applications, and whether existing Zluri customers face packaging or pricing changes. The customer figure is from Zluri's own disclosure, and deal terms were undisclosed.

What to Watch

Microsoft is reportedly planning to retire SMS- and voice-based MFA in Entra ID on February 1, 2027, with automatic passkey-registration prompts starting September 1, 2026. Organizations still using phone-based MFA face a forced migration to passkeys, authenticator apps, or hardware tokens.

The convergence of human and non-human identity governance creates three near-term procurement questions. First, whether to extend existing IGA platforms to cover AI agents or buy purpose-built agent-security products. Second, whether quantum-safe cryptography belongs in identity and network-security road maps for organizations with long data retention. Third, whether SaaS discovery and identity governance should be procured from a single vendor or remain separate. The acquisitions indicate that vendors are betting on consolidation; buyers should validate integration depth and avoid paying twice for overlapping capabilities.