An Identity-Aware Proxy (IAP) can enforce who gets in, what they can see, and what they can do — before your app even answers the request. It’s the gate you control, with rules that live outside your code. But for many teams, the existing IAP features stop short. They need more.
The top Identity-Aware Proxy feature requests follow a clear pattern: deeper integration, finer access control, and more flexible policy management. Engineers want granular roles down to the method or endpoint. They want seamless support for multiple identity providers, including custom SAML and OIDC setups. They want policy changes to apply instantly without redeploying the application. And they want visibility: detailed audit logs, real-time risk scoring, and alerts when access patterns shift.
Scalability is a constant requirement. A modern IAP must handle thousands of simultaneous sessions without latency spikes. It must support zero trust architectures, verifying each request against up-to-date identity rules rather than relying on a single initial authentication event. For some, multi-tenancy support is now a baseline expectation, with isolated identity contexts per tenant.