Updated 27 October 2026 by Simon Mestdagh, founder of Caspian.

TL;DR

• The best IT management platform for a Google Workspace company with 100 to 250 employees covers three layers, in and out: the apps on the laptop, the account in each SaaS app, and the resources inside each app. It starts joiners, movers and leavers from the HR system and leaves sign-in with Google Workspace.
• Our pick for a Mac-first team with one or two IT people is Caspian, because it automates apps that have no SCIM and runs on BYOD Macs. We sell Caspian, so read the "How we picked" section and the "Limits" lines.
• Pick Rippling if you want HR and payroll in the same suite. Keep Jamf if you already run it. Pick JumpCloud or Iru if you need Windows or phones managed today.
• Okta works, but it adds a second user directory next to Google Workspace. For this company size it is the least good fit.
• Ask every vendor how it reaches apps without SCIM. Slack sells SCIM on Business+ and Enterprise (Slack help) and Notion on Enterprise only (Notion help).

This guide is for the one-person IT admin at a Mac-first company on Google Workspace or Microsoft Entra, with Slack at the centre. You know the problem: a new hire needs a laptop, ten accounts and a dozen channels, and a leaver needs all of it gone. You also know the usual answers: an MDM, an identity provider, a spreadsheet. This page compares the platforms that try to replace the spreadsheet. Vendor facts were checked on the vendors' own pages on 27 October 2026. Caspian publishes this article and sells a product in this space. Where we give an opinion, we say so.

What an IT management platform does

An IT management platform is one system for the people side of IT: who gets which laptop apps, which SaaS accounts and which access inside those accounts, from the day they join to the day they leave. It sits between the HR system, which knows who works here, and the apps, which hold the accounts. An MDM handles device management. An identity provider handles sign-in. The platform handles the rest of employee onboarding, offboarding and access management.

The job has nine cells: three layers, each with a joiner, mover and leaver step.

Layer	Joiner	Mover	Leaver
Apps on the laptop	Install Slack, Chrome, Zoom, 1Password and team tools	Add the new team's tools	Remove licensed apps, collect or wipe the Mac
Account in each SaaS app	Create accounts in Slack, Notion, Figma, GitHub, HubSpot	Change roles and plans	Deactivate each account, free the seat
Resources inside the app	Add to channels, repos, teams, folders	Move between them	Hand over files and ownership

Most tools cover one row. An MDM covers the first. An identity provider covers part of the second, for apps with SCIM. The third row is usually a checklist. Our view: for a small IT team with Macs and BYOD, the platform should cover all nine cells, so the admin does not stitch tools together with scripts.

How we picked

We ranked tools for one reader: a company of 100 to 250 people, mostly Macs, on Google Workspace or Entra, with Slack, and one or two people in IT. We scored each tool on seven questions:

1. Apps on the laptop. Can it install and update Mac apps, with self service for employees?
2. SaaS accounts. Can it create, change and remove accounts in each app?
3. Resources inside apps. Can it add and remove people from channels, repos, teams and roles?
4. Apps without SCIM. Does it reach apps where SCIM is missing or sits on a top plan?
5. BYOD Macs. Does it work on a Mac that is not enrolled in its MDM?
6. HR trigger. Does the joiner and leaver workflow start from the HR system?
7. Sign-in. Does it leave single sign-on with Google Workspace or Entra, or bring its own directory?

We rank Caspian first because it was built for this reader. That is a claim from the vendor, so the "Limits" lines matter. When another tool is the better pick for your setup, the list says so. We do not compare prices. Each vendor's pricing page is linked from its section.

The 8 best IT management platforms for small IT teams in 2026

1. Caspian

Best for: a one-person IT team at a Mac-first Google Workspace or Entra company that wants laptop apps, SaaS accounts and access inside apps in one place, including apps with no SCIM and BYOD Macs.

Caspian covers the three layers, in and out.

• Apps on the laptop. Caspian Desktop installs and updates Mac apps. Employees install approved apps themselves through Self Service in the assistant. The agent checks FileVault, firewall, Gatekeeper, screen lock, OS version and app versions. It runs on Macs that are not enrolled in an MDM, which covers BYOD.
• Device management alongside your MDM. Caspian reads Iru (formerly Kandji), Fleet, JumpCloud, SimpleMDM and Hexnode. If you have no MDM, Caspian MDM, our own Apple MDM, is in early access and moves Macs from another MDM without a wipe on macOS 26 and later.
• Accounts and resources in each app. Caspian creates, changes and removes accounts, and adds people to teams, repos, channels and roles. It uses the app's API where one exists. Where none does, it uses a cloud browser signed in as an admin, which works with the laptop closed. Failing that, it uses the browser extension in an admin's Chrome. As a last resort it sends an Inbox task to a person. Every change is checked by reading the app back.
• In and out. Joiner, mover and leaver workflows start from HiBob, Personio, BambooHR, Workday or Rippling. Access requests are answered in Slack. Caspian finds apps and AI tools in use from Google Workspace or Entra, the browser extension and the desktop agent.
• Removals wait for a person. Each removal waits in "Access beyond the rules" until someone approves it, and Caspian proposes the least destructive action first: deactivate before delete.

Data is stored in the EU (AWS Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress. Caspian starts read-only and rolls out in stages. See is free. Act, where Caspian does the work on your rules, is EUR 10 per active user per month, excluding VAT, with no minimum, 30 days free from install with no card, and monthly billing (pricing).

Limits: Caspian is not an identity provider, so sign-in stays with Google Workspace or Entra. It does not manage Windows, iPhones or Android phones yet. It has no helpdesk ticketing, no SaaS spend or licence cleanup, and no laptop ordering. Caspian MDM is in early access.

2. JumpCloud

Best for: a mixed Mac, Windows and Linux fleet where you want one vendor for the directory, single sign-on and device management.

JumpCloud describes itself as one platform for identity, access and devices (JumpCloud platform). Its product list includes a Cloud Directory, Single Sign-On, MFA, Conditional Access, Apple MDM, Windows, Linux and Android management, Patch Management, Identity Lifecycle Management, HRIS and SaaS Management. Its pricing page puts "MDM/Device Management" in the Device Management and Platform plans, and "Single Sign-On (SSO)" and "User Lifecycle Management" in the SSO and Platform plans (JumpCloud pricing). There is a 30-day free trial.

Limits: JumpCloud brings its own directory, so a Google Workspace company runs two user directories or moves its identity to JumpCloud. Its platform page does not say how it reaches apps without SCIM, or whether it manages access inside apps such as channels and repos.

3. Rippling

Best for: a company that wants HR, payroll and IT in one suite.

Rippling IT "combines identity and access management (IAM), device management (MDM), inventory, and compliance" (Rippling IT). It provisions and deprovisions access "across all apps using SSO, SCIM, and lifecycle management", manages macOS, Windows, iOS and iPadOS devices, and ships laptops with zero-touch setup. The page says you can "sync data from your existing HRIS or identity provider", but its pitch leans on Rippling's own HR data as the trigger.

Limits: if HR already lives in HiBob, Personio or BambooHR, you pay for a suite built around an HR system you do not use. The page names SSO and SCIM as the provisioning routes and does not say how it reaches apps that have neither. We cover this choice in Rippling alternative for IT only.

4. Primo

Best for: a scale-up that wants device management, access, SaaS and a ticketing queue from one vendor, on Mac, Windows, Linux and mobile.

Primo calls itself a unified IT platform that brings "device management, access, SaaS and ticketing together" (Primo). It says it will "Ship a configured device and the right access on day one. Revoke all of it the moment someone leaves", applies rules "across Mac, Windows, Linux and mobile", resolves Slack requests with AI, and lists over 200 integrations. Its data is hosted in France.

Limits: Primo's homepage does not say how it reaches apps without SCIM or an API, or whether its agent runs on Macs it does not enrol. It is the closest in shape to Caspian, so ask both vendors the same questions at the end of this page.

5. Iru (formerly Kandji)

Best for: a team that wants Apple device management plus endpoint security, passwordless identity and compliance automation from one agent.

Iru describes "endpoint management, detection & response, and vulnerability management in a single agent" across "Apple, Windows, and Android", plus "Passwordless workforce identity that grants secure access to every app" and compliance automation (Iru).

Limits: Iru centres on the device and sign-in. Its homepage does not describe creating accounts in SaaS apps, changing access inside them, or starting workflows from the HR system. If you run Iru, Caspian reads it and adds the SaaS layers.

6. Mosyle

Best for: an Apple-only fleet where you want MDM, hardening and app patching from a vendor that only does Apple.

Mosyle sells "The only Apple Unified Platform" (Mosyle). It covers device management, hardening and compliance templates, Mac antivirus, privilege management, web filtering, "installation and patching of virtually any compatible application", and Mosyle Auth for Mac login with the company's identity provider.

Limits: Mosyle manages Apple devices. Its homepage does not describe SaaS account provisioning, access inside apps, or HR-triggered workflows. You still need something for the second and third rows of the table.

7. Jamf

Best for: a company with a dedicated Mac admin and deep configuration needs, or one that already runs Jamf.

Jamf Pro is "Complete Apple device management" (Jamf Pro). It offers zero-touch deployment for Mac, iPhone, iPad and Apple TV "including BYOD", policies and scripts, Smart Groups, Declarative Device Management, app lifecycle management and Self Service+, where "Users can install apps, update software and maintain their own devices."

Limits: Jamf manages Apple devices, not SaaS accounts or access inside apps. If you have Jamf, keep it, and fill the gaps for SaaS logins, access and Macs Jamf does not manage. See Keep Jamf, fill the gaps.

8. Okta

Best for: a company that already runs Okta for sign-in and has the budget and time to build workflows.

Okta Lifecycle Management "automates the entire joiner, mover, leaver process by connecting your HR system to your IT infrastructure" (Okta Lifecycle Management). It uses HR systems such as Workday and BambooHR as the source of truth, says it "supports automated provisioning for thousands of apps using the SCIM standard", and adds Okta Workflows for no-code automation.

Limits: Okta is a second identity provider next to Google Workspace, which already includes SAML single sign-on. Its provisioning runs through SCIM, so apps without SCIM need custom Workflows. It does not manage laptops. Our advice for this company size: move sign-in to Google Workspace or Entra and move lifecycle to an IT management platform. Keeping Okta works too, but it is the least good fit here. More in Okta and its alternatives in 2026.

Comparison table

Based on each vendor's own pages, checked 27 October 2026. "Not stated" means the vendor page we read does not say, not that the feature is missing.

Tool	Laptop apps	SaaS accounts	Resources inside apps	Apps without SCIM	BYOD Macs	HR-triggered joiner and leaver	Sign-in
Caspian	Yes, Mac	Yes	Yes	Yes: API, cloud browser, extension, task	Yes, agent without MDM	Yes	Stays with Google Workspace or Entra
JumpCloud	Yes	Yes, lifecycle management	Not stated	Not stated	Not stated	Yes, HRIS listed	Own directory and SSO
Rippling	Yes	Yes, SSO and SCIM	Groups	Not stated	Not stated	Yes	Own SSO
Primo	Yes	Yes	Not stated	Not stated	Not stated	Yes	Not stated
Iru	Yes	Not stated	Not stated	Not stated	Not stated	Not stated	Own passwordless identity
Mosyle	Yes, Apple	Not stated	Not stated	Not stated	Not stated	Not stated	Mac login via your IdP
Jamf	Yes, Apple	No	No	No	Yes, BYOD enrolment	Not stated	Integrates with Google, Microsoft, Okta
Okta	No	Yes, SCIM	Groups via SCIM	Custom Workflows	No	Yes	Own identity provider

Device management, access management and app provisioning: which layer is your gap?

Most small IT teams already own part of the stack. The useful question is which row of the nine-cell table is still a spreadsheet.

• No MDM yet. Apple Business gives you device enrolment. We list what to add on top in Apple Business Manager: what to add.
• MDM, no SaaS automation. This is the most common gap. Keep the MDM and add a platform for accounts and access inside apps.
• SCIM on some apps, not others. Count the apps where SCIM sits on a plan you do not pay for. Figma offers SCIM on Education (K-12), Organization, Government and Enterprise plans (Figma help). The sso.tax list tracks the same pattern for single sign-on. The routes into those apps are in Offboarding without SCIM.
• BYOD Macs. An MDM cannot see a laptop it does not manage. Check that the platform's agent runs on a Mac without MDM enrolment.

Day one without scripts

With all nine cells covered, a new hire's first day at a 150-person company can run like this:

1. HR adds the person in HiBob or Personio. The platform starts the joiner workflow.
2. It creates the Google Workspace account and the accounts in each app the team uses, then adds the person to the right channels, repos and folders.
3. The person opens the Mac. The agent installs the team's apps.
4. Anything the platform cannot do through an API or a browser lands as a task with the right person.
5. The IT admin sees one list with each step's checked state.

The leaver day runs the same list in reverse, with one difference: each removal waits for a person to approve it.

When another tool fits better

Our view, not a sourced claim:

• You want HR and payroll in the same suite. Pick Rippling.
• You need Windows or phones managed today. Pick JumpCloud, Iru or Primo. Caspian does not do that yet.
• You have a dedicated Mac admin and deep configuration needs. Keep Jamf, and add a platform for the SaaS layers.
• You only need Apple device management. Mosyle or Jamf is enough.

Questions to ask

1. Which of the nine cells (three layers, joiner, mover, leaver) do you cover without scripts?
2. Do you start from our HR system, and which ones do you read?
3. How do you reach apps without SCIM or without an API?
4. Do you read each app back after a change?
5. Does your agent run on a Mac that is not enrolled in an MDM?
6. Do you replace Google Workspace for sign-in, or work next to it?
7. Who approves a removal, and is deactivation the default?

FAQ

What is the best IT management platform for a Google Workspace company with 100 to 250 employees?

For a Mac-first company of that size with one or two IT people, we recommend Caspian, which we sell. It covers laptop apps, SaaS accounts and access inside apps, starts from the HR system, reaches apps without SCIM, and leaves sign-in with Google Workspace. Pick Rippling if you want HR and payroll in the same suite.

Do I need Okta if I already have Google Workspace?

Usually not for sign-in, because Google Workspace includes SAML single sign-on. Okta adds lifecycle management, but it works through SCIM and brings a second user directory. A platform that works next to Google Workspace avoids running two directories.

Can one tool handle device management and SaaS access management?

Some can. JumpCloud, Rippling, Primo and Caspian each cover devices and SaaS accounts, while Jamf, Mosyle and Iru centre on the device. Check whether the tool also handles access inside apps, such as Slack channels and GitHub repos, and apps without SCIM.

What should a small IT team with Macs and BYOD look for?

An agent that runs on a Mac without MDM enrolment, so BYOD laptops are covered, and joiner and leaver workflows started from the HR system. Ask how the tool reaches apps without SCIM, because many vendors sell SCIM only on top plans.

Should I replace Jamf?

No, if Jamf works for you. Jamf manages Apple devices well. The gaps are SaaS logins, access inside apps and Macs Jamf does not manage, and an IT management platform can fill those next to Jamf.

Sources

Source	Publisher	Date	Confidence
SCIM provisioning	Slack	Checked 27 Oct 2026	High
Provision users and groups with SCIM	Notion	Checked 27 Oct 2026	High
Set up automatic provisioning via SCIM	Figma	Checked 27 Oct 2026	High
SSO Wall of Shame	sso.tax	Checked 27 Oct 2026	Medium (community list, covers SSO only)
JumpCloud platform	JumpCloud	Checked 27 Oct 2026	High (vendor page)
JumpCloud pricing	JumpCloud	Checked 27 Oct 2026	High (vendor page)
Rippling IT	Rippling	Checked 27 Oct 2026	High (vendor page)
Primo	Primo	Checked 27 Oct 2026	High (vendor page)
Iru	Iru	Checked 27 Oct 2026	High (vendor page)
Mosyle	Mosyle	Checked 27 Oct 2026	High (vendor page)
Jamf Pro	Jamf	Checked 27 Oct 2026	High (vendor page)
Okta Lifecycle Management	Okta	Checked 27 Oct 2026	High (vendor page)
Pricing	Caspian	Checked 27 Oct 2026	High (our own page)

Try it on your own estate: request access.

← All resources