Rippling alternatives in 2026 for a 150-person company that only needs IT, not HR or payroll
Keep your HR system and buy only IT. 7 options ranked: Caspian, JumpCloud, Okta plus MDM, Iru, BetterCloud, Primo, and when Rippling wins.
Updated 27 October 2026 by Simon Mestdagh, founder of Caspian.
TL;DR
- If you want HR, payroll and IT in one suite, pick Rippling. If you are a 150-person company that only needs IT, not HR or payroll, because HR already lives in HiBob, Personio, BambooHR or Workday, pick an IT management platform that reads that HR system. Caspian is one, and we rank it first for that fit.
- Rippling sells Identity and Access Management, Device Management, Inventory Management, Helpdesk, Automated Compliance and AI Governance, and says IT can "sync data from your existing HRIS" (Rippling IT, checked 27 October 2026). Whether you can buy IT without the core Rippling platform is not stated. Ask Rippling.
- Other IT-only options: JumpCloud (directory, SSO and MDM), Okta plus an MDM, Iru (endpoint, identity and compliance), BetterCloud (SaaS workflows) and Primo (all-in-one IT for small teams).
- Caspian is not an identity provider. Sign-in stays with Google Workspace or Microsoft Entra.
Caspian publishes this article and sells a product in this space. We rank Caspian first for the fit described below, and we say where another tool is the better pick. Facts were checked on 27 October 2026.
Who this is for
You are the one IT person at a Mac-first company of about 150 people. Sign-in runs on Google Workspace or Microsoft Entra. HR already runs in its own system, and nobody wants to move payroll. You are looking at Rippling because its IT demo looks good, and you want to know the alternatives for employee lifecycle management and identity access management without the HR suite.
Your current state: HR adds a new hire. Someone tells you on Slack. You create accounts in a dozen SaaS apps, add the person to channels and teams, and set up their Mac. When someone leaves, you do it backwards and check each app.
The future state: the HR system you already have starts the work. One IT platform makes the accounts, sets the access inside each app, installs the Mac apps, and asks you to approve removals.
What Rippling IT is
Rippling builds IT on top of its employee data. Its IT page says: "Updates in your HR system instantly trigger device and app provisioning for onboarding, offboarding, and when roles change" and "Rippling automatically provisions and deprovisions access across all apps using SSO, SCIM, and lifecycle management" (Rippling IT).
| Rippling IT product | What it covers |
|---|---|
| Identity and Access Management | SSO, custom SAML and SCIM, MFA, conditional access, RBAC |
| Device Management | macOS, Windows, iOS and iPadOS MDM, OS patching, EDR, device trust |
| Inventory Management | Device store, warehousing, retrieval and buyback |
| Helpdesk | Tickets |
| Automated Compliance | Compliance automation |
| AI Governance | Listed as a solution |
Source: Rippling IT, checked 27 October 2026.
Rippling's strength is one data model. The page says "Most tools solve one layer of IT (identity or devices or compliance), but Rippling unifies all three".
The platform question
Rippling's IT page says you can "sync data from your existing HRIS or identity provider to automatically trigger workflows". On 16 October 2026, the FAQ on Rippling's pricing page said each product is bought alongside the core Rippling Platform. On 27 October 2026, that line no longer appears on the pricing page (Rippling pricing), and Rippling publishes no IT prices there. We could not confirm either way, so ask Rippling two things in writing: do you need the core platform to buy IT, and what does it include.
Why the leaver decides the choice
NIST SP 800-53 control PS-4, Personnel Termination, asks organizations to "disable system access within [Assignment: organization-defined time period]" of termination and to revoke the person's credentials (NIST SP 800-53 Rev. 5; control text via CSF Tools, checked 27 October 2026). Verizon's 2026 Data Breach Investigations Report says breach causes "continue to heavily involve the human element", including stolen credentials (Verizon DBIR, checked 27 October 2026). Whichever tool you pick, ask how it handles the apps that have no SCIM, because that is where leavers keep access.
How we picked
We ranked IT-only options for a 150-person, Mac-first company on Google Workspace or Entra with HR already in place:
- No HR or payroll required. The tool reads the HR system you have.
- SaaS accounts and resources inside apps, including apps without SCIM.
- Laptop apps and device checks on Macs.
- BYOD Macs without enrollment.
- Sign-in stays on Google Workspace or Entra, or the tool says it replaces it.
- Removals are checked and approved.
We read each vendor's own pages on 27 October 2026. "Not stated" means the page does not say, not that the tool cannot. We sell Caspian and rank it first for this fit. If you want HR and payroll too, Rippling is the better pick. If you need Windows and phones today, look at JumpCloud, Iru or Primo.
The ranked list
1. Caspian
Best for: a 150-person company that only needs IT, keeps its HR system, and runs sign-in on Google Workspace or Entra.
This section describes our own product. Caspian is an IT management platform: one place for all of IT, so a one-person IT team works like a team of five. It covers three layers, in and out: apps on the laptop, the account in each SaaS app, and the resources inside (teams, repos, channels, roles).
- HR stays where it is. Caspian reads HiBob, Personio, BambooHR, Workday and Rippling. A hire, a move or a last day starts the workflow.
- Changes reach apps with no API. Caspian uses the app's API integration first. If there is none, Caspian's cloud browser signs in as an admin and makes the change, even with every laptop off. Next comes the browser extension in an admin's Chrome, and last an Inbox task for a person. So Caspian automates apps with no API and no SCIM.
- Every change is checked. Caspian reads the app back after each change.
- Removals wait for a person. They sit in "Access beyond the rules" until someone approves, and Caspian proposes the least destructive step, such as deactivating before deleting.
- Access requests happen in Slack. People ask, the owner approves, Caspian makes the change.
- Discovery. Caspian finds apps and AI tools from Google Workspace or Entra, the browser extension and the desktop agent.
- Macs. Caspian Desktop installs and updates Mac apps, offers Self Service through the assistant, and checks FileVault, firewall, Gatekeeper, screen lock, OS version and app versions. It works on Macs with no MDM, which covers BYOD. If you run Iru (Kandji), Fleet, JumpCloud, SimpleMDM or Hexnode, Caspian reads it. Caspian MDM, its own Apple MDM, is in early access and moves Macs from another MDM without a wipe on macOS 26 and later.
Limits: Windows, iPhone and Android management, helpdesk tickets, laptop ordering, licence cleanup and SaaS spend are on the roadmap, not in the product. Caspian is not an identity provider. Caspian.
2. JumpCloud
Best for: teams that want directory, SSO and MDM from one vendor and will move sign-in to it.
JumpCloud's pricing page sells Device Management, SSO and Device Identity Management bundles, and Platform packages that combine "identity, device, and access management", with User Lifecycle Management. Platform Prime adds SaaS Discovery, SaaS Access Control and SaaS Insights (JumpCloud pricing, checked 27 October 2026). It does not require an HR or payroll product.
Limits: HR integration is not listed in the pricing table. Apps without SCIM, resources inside apps and BYOD without enrollment are Not stated.
3. Okta plus an MDM
Best for: companies that already run Okta and want best-of-breed identity with a separate Mac MDM such as Jamf or Iru.
Okta Lifecycle Management uses your HR system "as the source of truth" and "supports automated provisioning for thousands of apps using the SCIM standard" (Okta Lifecycle Management, checked 27 October 2026). Okta Workflows adds no-code flows for apps with a public API (Okta Workflows).
Limits: Okta is not an MDM, so you buy and run a second tool for Macs. Apps without SCIM need a flow or a person. Our view: for a company on Google Workspace, this means two extra systems where one IT platform would do.
4. Iru (formerly Kandji)
Best for: teams that want endpoint, identity and compliance from one vendor, across Apple, Windows and Android.
Iru describes itself as "a single view of your users, apps, and devices". It sells Endpoint (endpoint management, EDR and vulnerability management "in a single agent"), Workforce Identity ("passwordless workforce identity that grants secure access to every app") and Compliance Automation with a Trust Center (Iru, checked 27 October 2026).
Limits: its identity product is a sign-in layer, so it replaces Google or Entra sign-in. HR-triggered joiners and apps without SCIM are Not stated. Caspian reads Iru if you run it.
5. BetterCloud
Best for: teams whose main pain is SaaS onboarding and offboarding, with no device need.
BetterCloud offers a "no-code drag-and-drop workflow builder" to "automate employee onboarding and offboarding", with "100+ integrations and 1,000+ actions provided out-of-the-box" (BetterCloud, checked 27 October 2026).
Limits: you build the workflows yourself. Its home page says nothing about devices.
6. Primo
Best for: small teams that want one vendor for devices, SaaS, hardware buying and Slack tickets, including Windows.
Primo says it "unifies devices, access, SaaS, and ticketing, then lets agents operate them". It applies policies "across Mac, Windows, Linux and mobile", ships "a configured device and the right access on day one" and lets staff ask for help in Slack (Primo, checked 27 October 2026).
Limits: apps without SCIM and BYOD without enrollment are Not stated. It is a full MDM, so it replaces your current one.
7. Rippling
Best for: companies that want HR, payroll and IT from one vendor.
See the Rippling section above.
Limits: buying IT without the core platform is not stated. Rippling is its own identity provider.
Compared
| Tool | HR or payroll required | Laptop apps | SaaS accounts | Resources inside apps | Apps without SCIM | BYOD Macs, no enrollment | Sign-in |
|---|---|---|---|---|---|---|---|
| Rippling | Not stated, ask | Yes | Yes | Not stated | Not stated | Not stated | Rippling |
| Caspian | No, reads your HR system | Yes | Yes | Yes | Yes | Yes | Google Workspace or Entra |
| JumpCloud | No | Yes, MDM | Yes, in lifecycle packages | Not stated | Not stated | Not stated | JumpCloud |
| Okta plus MDM | No | Via the MDM | Yes, via SCIM | A flow per app | Needs a public API and a flow | Not stated | Okta |
| Iru | No | Yes | Not stated | Not stated | Not stated | Not stated | Iru Workforce Identity |
| BetterCloud | No | Not stated | Yes | Yes, via workflow actions | Custom integration | Not stated | Uses your IdP |
| Primo | Not stated | Yes | Yes | Not stated | Not stated | Not stated | Not stated |
Sources are the vendor pages linked in each entry, checked 27 October 2026.
Rippling and Caspian, side by side
| Question | Rippling IT | Caspian |
|---|---|---|
| Need to move HR? | Ask Rippling (see above) | No, Caspian reads your HR system |
| Sign-in | Rippling Identity | Google Workspace or Entra |
| Apps with no SCIM or API | Not stated on the IT page | Cloud browser, extension or Inbox task |
| Change checked afterwards | Not stated on the IT page | The app is read back |
| Removals | Automatic, per the IT page | A person approves each one |
| Mac management | Rippling MDM | Caspian Desktop, your MDM, or Caspian MDM (early access) |
| Windows and phones | Yes | No (roadmap) |
| Laptop logistics | Yes | No (roadmap) |
| Published prices | No | Yes |
When Rippling is the right choice
- You want HR, payroll and IT from one vendor and one contract.
- You are replacing your HR system anyway.
- You want laptop procurement, shipping and buyback from the same vendor.
- You need Windows or phone management next to Macs.
These are Rippling strengths, and Caspian does not do all of them today.
Trust and price
Caspian keeps data in the EU (AWS Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress. Caspian starts read-only, and you roll out one app at a time. The Software scan is free and read-only.
Caspian's own prices: See is free. Act, where Caspian does the work on your rules, is €10 per active user per month, excluding VAT, with all their laptops included. There is no minimum, Act is free for 30 days from install with no card, and billing is monthly and can be cancelled anytime (pricing).
Questions to ask any vendor
- Can we buy only IT, with no HR or payroll product?
- Which HR systems can trigger your workflows?
- Do we have to move sign-in to your product?
- What happens to an app with no SCIM and no API when someone leaves?
- How do we know a removal actually happened?
- Is the price published, annual or monthly, and is there a minimum?
FAQ
What is a Rippling alternative for a 150-person company that only needs IT, not HR or payroll? An IT management platform that reads the HR system you already have, such as Caspian, runs joiner, mover and leaver work in each SaaS app and on the Mac without moving HR or payroll. Sign-in stays on Google Workspace or Microsoft Entra. JumpCloud, Iru and Primo are other IT-only options if you also want to change sign-in or MDM.
Can I buy Rippling IT without Rippling HR? Rippling's IT page says it can sync data from an existing HRIS or identity provider. Whether IT can be bought without the core Rippling platform is not stated on Rippling's pricing page as of 27 October 2026. Ask Rippling in writing.
Which tools do employee lifecycle management without an HR suite? Caspian reads HiBob, Personio, BambooHR, Workday and Rippling and runs the lifecycle in each app. Okta Lifecycle Management uses your HR system as the source of truth for SCIM apps, and BetterCloud runs onboarding and offboarding workflows you build. JumpCloud includes user lifecycle management in its packages.
Is JumpCloud or Caspian better for a Mac-first company on Google Workspace? JumpCloud fits if you want to move sign-in, directory and MDM to one vendor. Caspian fits if you want to keep Google Workspace sign-in and need accounts and access set in each SaaS app, including apps with no SCIM. Caspian is not an identity provider.
Does Caspian replace identity access management? No. Caspian is not an identity provider; Google Workspace or Microsoft Entra handles sign-in. Caspian handles what happens after sign-in: the account in each SaaS app, the access inside it, and the apps on the laptop.
Request access to run Caspian next to the HR system you already have.
Sources
| Source | Publisher | Date | Confidence |
|---|---|---|---|
| IT | Rippling | Checked 27 Oct 2026 | High |
| Pricing | Rippling | Checked 16 and 27 Oct 2026 | High (no IT prices), medium (platform FAQ) |
| Pricing | JumpCloud | Checked 27 Oct 2026 | High |
| Lifecycle Management | Okta | Checked 27 Oct 2026 | High |
| Workflows | Okta | Checked 27 Oct 2026 | High |
| Iru | Iru | Checked 27 Oct 2026 | High |
| BetterCloud | BetterCloud | Checked 27 Oct 2026 | High |
| Primo | Primo | Checked 27 Oct 2026 | High |
| SP 800-53 Rev. 5 and PS-4 text | NIST, CSF Tools | Checked 27 Oct 2026 | High |
| 2026 Data Breach Investigations Report | Verizon | Checked 27 Oct 2026 | High |
| Pricing | Caspian | Checked 27 Oct 2026 | High (our own page) |
