tenfold has added two new capabilities to its free Community Edition identity governance tool, a small release with an outsized signal. Free, functional IGA matters because the largest ungoverned population in most organisations is not the workforce with enterprise licences: it is the mid-market, the subsidiary, the lab environment and the project team that never qualified for a governance programme budget.
The problem: governance licences follow headcount, not risk
Identity governance and administration has historically been priced and scoped as an enterprise purchase. Implementation projects run for months, require professional services and presuppose a mature identity data model. That economics works for a 20,000-seat estate and fails entirely for a 400-person business, a regional division or a university department.
The result is predictable. Those environments govern access with spreadsheets, shared mailboxes and manager memory. Entitlements are granted by whoever holds the admin password and revoked only when someone notices. Orphaned accounts persist because nobody owns the review. When those smaller estates connect to a parent organisation through acquisition, federation or supply chain, the ungoverned access becomes an enterprise problem without ever appearing in an enterprise governance report.
Why a capable free tier changes the calculus
A lower entry point for lifecycle controls. Community editions typically deliver the fundamentals: automated joiner-mover-leaver workflows, visibility into assigned entitlements and out-of-band change detection. Those are the controls that prevent the most common findings, and they do not require a six-figure programme to operate. Extending them to a free tier means identity lifecycle management starts where identity data already exists rather than waiting for a central programme.
Faster proof of value. Governance business cases are hard to build on projected benefit alone. A tool that can be deployed in days against a real directory lets a practitioner demonstrate reduced revocation time or detected privilege drift with evidence. That artefact is far more persuasive to a budget holder than a maturity assessment.
Standardisation before scale. Organisations that adopt a governance model in one small environment create the role definitions, approval patterns and ownership conventions that a later enterprise rollout inherits. Starting small with a coherent tool produces cleaner data than retrofitting governance onto years of ad hoc entitlement grants.
Coverage of the acquisition tail. Acquisitions bring in directories that will never receive a full enterprise IGA deployment. A free, functional tooling option is often the only realistic way to bring those identities under review rather than leaving them in a spreadsheet indefinitely.
What still needs scrutiny
A free tier is not a governance strategy. Practitioners evaluating one should check three things: whether it ingests authoritative identity data automatically or depends on manual imports; whether revocation actually propagates to connected systems rather than producing a ticket; and where the boundary sits between community and paid capability, particularly for privileged and non-human identities. The last point matters most, because workload and service identities are where ungoverned authority concentrates.
The direction of travel is clear. Identity governance is being unbundled from enterprise procurement and pushed toward the environments where access risk actually accumulates. Features arriving in a Community Edition are a useful reminder that good governance practice, not licence tier, is what determines whether entitlements stay under control.