# Best CMS for Intranets in 2026

> Most content management systems were built to talk to customers, not staff. A few can run an intranet without a second product. Here is which ones, and where every one of them still needs help.

Buyer Guide by DXP Scorecard Analyst Team · Published 2026-10-24 · Reviewed 2026-10-24 · Ratings updated 2026-10-24
Source: https://www.dxpscorecard.com/editorials/best-cms-for-intranets

## The short answer

Liferay and Salesforce Experience Cloud are the best CMS platforms for an intranet in 2026. Liferay ships the fullest employee toolkit among the platforms we score: knowledge base, message boards, personalized dashboards and Microsoft 365 connectors behind best-in-class permissions. Experience Cloud suits organizations whose employee portal is a front end to Salesforce. Drupal is the open-source route, Squiz DXP fits universities and government, and Progress Sitefinity and Umbraco serve Microsoft shops.

## Key takeaways

- Most CMS products are not intranet products. If you need read receipts, an org chart synced from HR, mandatory-read policies and a frontline mobile app on day one, a dedicated employee experience product will beat every platform here. This guide is for organizations that want their web platform to run the intranet too.
- Permissions decide the shortlist. An intranet shows different content to different people, and Liferay, Salesforce Experience Cloud, Drupal and HCL Digital Experience set access on a single item and inherit it through an organization hierarchy, with SAML and LDAP sign-on built in rather than sold as an upgrade.
- Search is the second decider. Squiz's Funnelback indexes SharePoint, Google Drive, Confluence and Jira alongside the CMS and respects document permissions; Liferay and Drupal tune Elasticsearch relevance without code. Most other platforms search only their own content.
- The gaps are the same everywhere: read receipts and acknowledgment tracking, learning system connectors and native mobile apps are missing or custom on almost every platform in this guide. Decide early whether each is in scope, and budget for it if it is.
- Portals cost by the head. Salesforce internal seats and HCL's session-based pricing grow with the workforce, while Drupal and Umbraco are free to license and Liferay publishes a $0 Free Tier that excludes SAML and multi-factor authentication.

## Our picks at a glance

- **Best overall intranet platform:** Liferay. The fullest employee toolkit behind the best permissions.
- **Best for Salesforce organizations:** Salesforce Experience Cloud. Knowledge, cases and HR agents on CRM data.
- **Best open-source intranet:** Drupal. Open Intranet, Group permissions, nothing to license.
- **Best for enterprise search:** Squiz DXP. Funnelback indexes SharePoint and respects permissions.
- **Best for EU data residency:** Jahia. Single-tenant EU hosting with GDPR terms included.
- **Best for Microsoft shops:** Progress Sitefinity. Marketer editor, SOC 2 report, SharePoint connectors.

## Our analysts' take

The intranet brief usually arrives sideways. The web team already runs a CMS for the public site, the communications team is publishing company news in email and a shared drive, HR wants policies with proof that people read them, and somebody asks whether the website platform could just do all of it. Sometimes it can. More often the honest answer is that a CMS will do the publishing half well and the employee half badly, and the difference between the platforms here is how much of that second half they cover.

The failure modes are predictable. A marketing CMS with no audience-level permissions ends up with a flat intranet where everyone sees everything, or a tangle of hidden pages that leak the moment someone searches. A platform with no connection to Microsoft 365 or Google Workspace becomes the place nobody visits, because the documents live somewhere else. And a portal product bought for its permissions and connectors can leave the communications team waiting on developers for every new page, which is the problem the CMS was supposed to solve.

This guide rates eight platforms that can credibly run an intranet. Security, permissions and compliance carry the heaviest weight, because an intranet is a system of access control that happens to publish news. Then come an editor the communications team can run alone, the ability to serve many departments, sites and languages from one place, how much effort it takes to keep running and what it costs per employee. Dedicated employee experience products are not rated here; several picks say plainly where one would do better.

## What to look for

1. **Permissions by department and role.** Every page, document and news item should be visible only to the people it concerns, with access set once on a department or team and inherited by everything beneath it. Single sign-on through SAML or OpenID Connect and a directory connection to Entra ID or LDAP should be included, not an add-on.
2. **An editor communications can run.** Internal communications publish daily and rarely have a developer. Look for a page builder with approved components, scheduled publishing, approval workflows per department and a way to target a story at a location or role without filing a ticket.
3. **Search across the tools people already use.** Employees look for a form in SharePoint, a runbook in Confluence and a policy in the CMS from the same box. Ask whether search federates those sources, honors their permissions and reports the queries that found nothing.
4. **Many departments, sites and languages.** A group with several business units or countries needs department sites with local administrators, shared templates and translation, all under central governance. Check whether a new division is a configuration task or a new installation.
5. **Running cost per employee.** Intranets are paid for by headcount, not by revenue. Compare licensing that meters internal users or sessions against flat or free software, and add the operations team, the upgrade cadence and the add-ons for analytics, personalization and workflow before comparing quotes.

## The ratings at a glance

Fit score out of 10, weighted for this topic. Ratings run Limited, Fair, Good, Strong, Excellent.

| Rank | Platform | Fit | Security & compliance | Marketer self-service | Global & multi-brand | Low IT upkeep | Budget predictability | AI for marketers |
|---|---|---|---|---|---|---|---|---|
| 1 | [Liferay](https://www.dxpscorecard.com/platform/liferay) | 6.5 | Strong | Good | Good | Limited | Limited | Fair |
| 2 | [Progress Sitefinity](https://www.dxpscorecard.com/platform/sitefinity) | 6.4 | Good | Good | Good | Fair | Limited | Good |
| 3 | [Salesforce Experience Cloud](https://www.dxpscorecard.com/platform/salesforce-experience-cloud) | 6.4 | Strong | Fair | Fair | Fair | Limited | Fair |
| 4 | [Squiz DXP](https://www.dxpscorecard.com/platform/squiz) | 6.3 | Good | Good | Good | Good | Limited | Limited |
| 5 | [Umbraco](https://www.dxpscorecard.com/platform/umbraco) | 6.2 | Good | Fair | Fair | Fair | Strong | Fair |
| 6 | [Jahia](https://www.dxpscorecard.com/platform/jahia) | 6.1 | Fair | Good | Good | Fair | Limited | Fair |
| 7 | [Drupal](https://www.dxpscorecard.com/platform/drupal) | 5.7 | Fair | Fair | Good | Limited | Strong | Fair |
| 8 | [HCL Digital Experience](https://www.dxpscorecard.com/platform/hcl-dx) | 5.6 | Good | Fair | Fair | Limited | Limited | Limited |

## The shortlist, reviewed

### 1. Liferay (Fit 6.5/10)

Knowledge Base, wikis, message boards, announcements and personalized dashboards all ship in the product, with connectors for Microsoft 365, Google Drive, Salesforce and SAP. Permissions reach a single item and inherit through organizations, and SAML, OpenID Connect and LDAP are built in rather than sold as upgrades.

- **Best for:** Enterprises with central IT running an employee portal, a partner extranet or both, with Java skills in house or at a partner.
- **Watch out for:** A production team of three to five specialists, quarterly releases with breaking changes and a mandatory move from javax to Jakarta. Analytics and segments are separately licensed, and the free tier excludes SAML and multi-factor authentication.
- **What it costs:** Quote-only for the enterprise subscription. A $0 Free Tier is published; enterprise contracts reportedly start at $25,000 to $50,000 a year.
- **Full scorecard:** https://www.dxpscorecard.com/platform/liferay (Markdown: https://www.dxpscorecard.com/platform/liferay.md)

### 2. Progress Sitefinity (Fit 6.4/10)

Progress markets Sitefinity for intranets and backs it with per-item permissions, single sign-on and multi-factor authentication, a drag-and-drop page editor, and Sitefinity Insight for role- and department-targeted news. The Integration Hub connects SharePoint, Teams and HR systems, and an AI assistant answers questions over company content.

- **Best for:** Mid-sized organizations on the Microsoft stack that want a marketer-friendly editor for internal communications and a vendor that holds a SOC 2 report and signs a business associate agreement.
- **Watch out for:** No people directory, org chart, social layer or content lifecycle management, personalization and the AI assistant are paid add-ons, and five critical vulnerabilities disclosed in June 2026 make the upgrade cadence a real cost.
- **What it costs:** Quote-only. Licensed per server or domain, with editor seats in blocks of five. Third-party estimates run $20,000 to $60,000 a year.
- **Full scorecard:** https://www.dxpscorecard.com/platform/sitefinity (Markdown: https://www.dxpscorecard.com/platform/sitefinity.md)

### 3. Salesforce Experience Cloud (Fit 6.4/10)

The Salesforce sharing model gates every record and page by role, and Salesforce Knowledge brings article versioning, approval workflows and data categories. Chatter supplies feeds, groups and mentions, Slack integration is native, and Agentforce puts HR and IT service agents in front of employees.

- **Best for:** Organizations already on Salesforce whose intranet is really an employee service portal: cases, knowledge, HR requests and approvals on CRM data.
- **Watch out for:** Content types are flat records capped at 15 fields, there is no org chart without an AppExchange component, and internal seats rose to $195 and $395 per user per month in September 2026.
- **What it costs:** Quote-only for portal licenses. Internal seats start at $195 per user per month on the Core edition, and Agentforce usage is billed in credits on top.
- **Full scorecard:** https://www.dxpscorecard.com/platform/salesforce-experience-cloud (Markdown: https://www.dxpscorecard.com/platform/salesforce-experience-cloud.md)

### 4. Squiz DXP (Fit 6.3/10)

Squiz Workplace is a purpose-built employee hub with a staff directory, org chart, communities, classifieds, events and emergency alerts, and Funnelback search indexes SharePoint, Google Drive, Confluence and Jira beside the CMS while honoring document permissions. Squiz hosts and patches everything under a published 24/7 support agreement.

- **Best for:** Universities, councils and government agencies in Australia, the UK and North America that want a managed intranet with enterprise search and no servers to run.
- **Watch out for:** Page-view metered pricing with no trial, no native mobile app or push notifications, no learning system integration, and a proprietary Matrix model that takes new developers months to learn.
- **What it costs:** Quote-only. No published tiers, free tier or trial; the subscription meters page views, indexed documents, storage and data transfer with overage charges.
- **Full scorecard:** https://www.dxpscorecard.com/platform/squiz (Markdown: https://www.dxpscorecard.com/platform/squiz.md)

### 5. Umbraco (Fit 6.2/10)

Umbraco gates content for authenticated member groups, restricts editors to their own section of the tree, and runs many sites and languages from one free installation. The open-source Uintra framework adds news feeds, groups and activity streams, and .NET teams extend it with skills they already have.

- **Best for:** .NET organizations with a small development team that want a low-cost intranet they control, where the content tree and member groups cover most of the need.
- **Watch out for:** No people directory, read receipts, learning integration or Teams connector, approval workflow is a paid add-on, and Umbraco 13 reaches end of life on December 14, 2026.
- **What it costs:** Free software. Umbraco Cloud from €45 per month, Standard €280, Professional €730; Umbraco Workflow and Engage are paid add-ons.
- **Full scorecard:** https://www.dxpscorecard.com/platform/umbraco (Markdown: https://www.dxpscorecard.com/platform/umbraco.md)

### 6. Jahia (Fit 6.1/10)

Permissions attach to any content node and inherit down the tree with configurable breaks, Portal Factory delivers role- and department-personalized pages with pre-filled forms, and Augmented Search 4.0 federates external sources into Elasticsearch results. StackConnect, built on Workato, supplies Teams, Slack, SharePoint and Workday connectors.

- **Best for:** European organizations that need an EU-hosted intranet with GDPR paperwork included, strong multilingual delivery and single-tenant infrastructure.
- **Watch out for:** No social layer, employee directory or read receipts in the core, no SOC 2 report, a small talent pool concentrated in French-speaking Europe, and confidential multi-year contracts.
- **What it costs:** Quote-only. CMS Enterprise and DXP Enterprise plans are published as a feature matrix with no dollar figures; Cloud contracts meter API calls, page views, profiles, storage and bandwidth.
- **Full scorecard:** https://www.dxpscorecard.com/platform/jahia (Markdown: https://www.dxpscorecard.com/platform/jahia.md)

### 7. Drupal (Fit 5.7/10)

Drupal's permission system runs to hundreds of grants, with the Group module for department spaces and SAML or LDAP sign-on from mature modules. The Open Intranet distribution adds an employee directory, targeted news, peer recognition, courses and adoption analytics, and Search API with Solr or Elasticsearch handles findability.

- **Best for:** Universities, governments and nonprofits with Drupal developers or an agency, who want an intranet they own outright and can host behind their own firewall.
- **Watch out for:** You carry hosting, patching and the two-year major upgrade cycle, Drupal 10 reaches end of life on December 9, 2026, and read receipts, org chart sync from HR systems and a native mobile app are all custom work.
- **What it costs:** Free software. Budget for hosting, a managed Drupal host or your own operations team, and a developer or agency.
- **Full scorecard:** https://www.dxpscorecard.com/platform/drupal (Markdown: https://www.dxpscorecard.com/platform/drupal.md)

### 8. HCL Digital Experience (Fit 5.6/10)

The former IBM WebSphere Portal still does what it was built for: permissions on pages, portlets and content items with role inheritance, SAML, OpenID Connect, LDAP and Kerberos sign-on, and personalized dashboards that embed enterprise applications. Virtual Portals give each division its own intranet on one installation.

- **Best for:** Large organizations already running HCL Digital Experience or HCL Connections, especially in banking, insurance and government, that need on-premises or sovereign hosting.
- **Watch out for:** No Microsoft 365 or Teams integration, a social layer only with the separately licensed HCL Connections, teams of five to ten specialists, and session-based quote-only pricing with 6 percent annual renewal uplifts.
- **What it costs:** Quote-only, priced on annual user sessions, with a 6 percent yearly uplift on term licenses. The only free option is a 30-day trial.
- **Full scorecard:** https://www.dxpscorecard.com/platform/hcl-dx (Markdown: https://www.dxpscorecard.com/platform/hcl-dx.md)

## Three kinds of intranet, three kinds of platform

Intranet is one word for three different systems. Decide which one you are buying before you compare editors, because each one favors a different part of this shortlist.

- **The communications intranet.** Company news, leadership updates, policies and a handful of department pages. Every platform here does this, and the decision comes down to the editor and the price: Progress Sitefinity, Umbraco, Jahia and Squiz DXP are the natural fits, with Drupal for teams that already run it.
- **The employee service portal.** Staff log in to raise requests, read knowledge articles, check approvals and complete HR tasks. This is a permissions and integration problem first. Salesforce Experience Cloud, Liferay and HCL Digital Experience were built for it; the others need the service layer bolted on.
- **The digital workplace.** One place to find documents, people and tools across Microsoft 365, Google Workspace and the line-of-business systems. Liferay, Squiz Workplace and Drupal's Open Intranet get closest, and this is also the point at which a dedicated employee experience product deserves a seat at the table.

## What the scorecards found missing almost everywhere

A few capabilities that intranet buyers ask for in every request for proposal turn out to be rare across content platforms. Treat each as a line item to confirm, not an assumption.

- **Read receipts and mandatory acknowledgment.** No platform in this guide ships acknowledgment tracking for policies as a turnkey feature. Liferay and Drupal can build it with their workflow engines, Salesforce can model it in Flow, and the rest leave it to custom development or a compliance tool.
- **A people directory synced from HR.** Liferay and Squiz Workplace ship a directory and org chart, Drupal's Open Intranet adds one, and Salesforce profiles come close. None of them connect to Workday or BambooHR without integration work, and Sitefinity, Umbraco and Jahia have no directory at all.
- **Frontline and mobile access.** Salesforce's Mobile Publisher can wrap a portal as a branded native app with push notifications. Everywhere else, deskless staff get a responsive website or a progressive web app, with no offline mode and no push, unless you build a mobile app on the platform's APIs.
- **Learning and training.** Only Drupal, through the Opigno distribution and Open Intranet's courses recipe, offers learning paths with completion tracking. Salesforce's myTrailhead is a separate license. Everyone else hosts the training pages and hands tracking to a learning management system.
- **Adoption analytics.** Squiz Workplace and Drupal's Open Intranet report engagement by item and by user. Liferay and Salesforce need their separately licensed analytics products for department-level views. Most platforms here can tell you page views and nothing about who is not reading.

## What to verify before you sign

- **Build a department in the trial.** Create a business unit with its own local administrator, publish a page only its members can see, then search for it as an outsider. The result tells you more about the permission model than any diagram.
- **Connect the directory and the documents.** Insist on a trial sign-in through your own Entra ID, Okta or LDAP, and index a real SharePoint or Google Drive folder. Note whether search results respect the source permissions or expose everything the connector can reach.
- **Price the whole workforce.** Ask for the cost at your full headcount, including contractors and frontline staff who log in twice a year. Session-based and per-seat pricing can double the quote; free software shifts the cost to the operations team instead.
- **Count the add-ons.** Analytics, personalization, workflow, search and AI assistants are separately licensed on Liferay, Salesforce, Sitefinity and Umbraco. Get the list of what the base price excludes before the demo shows it.
- **Check the exit and the upgrade calendar.** Liferay's quarterly releases, Drupal's two-year majors and Umbraco's version end-of-life dates are all published. Ask what the next mandatory upgrade costs and how your content and permissions would export if you left.

## Frequently asked questions

### Can you use a CMS as an intranet?

Yes, if it has audience-level permissions, single sign-on and a connection to the tools where documents live. Liferay, Salesforce Experience Cloud, Drupal and Squiz DXP cover those well, and Progress Sitefinity, Umbraco and Jahia handle a communications intranet. Read receipts, learning and native mobile apps are weak or custom on all of them.

### What is the best CMS for an intranet?

Liferay is the strongest content platform for an intranet: it ships a knowledge base, message boards, personalized dashboards, Microsoft 365 connectors and best-in-class permissions. Salesforce Experience Cloud is the better choice when the intranet is an employee service portal on Salesforce data, and Drupal is the leading open-source option.

### Should I use SharePoint or a CMS for my intranet?

If your organization lives in Microsoft 365, SharePoint with Viva is the default and hard to beat for documents, Teams and an employee app. Choose a CMS when you need full design control, external audiences such as partners, many branded department sites, or a non-Microsoft stack. Liferay, Squiz DXP and Progress Sitefinity connect to SharePoint rather than replace it.

### Is Drupal good for an intranet?

Drupal is a strong intranet platform for organizations with developers. Its permission system is among the deepest of any CMS, the Group module creates department spaces, and the Open Intranet distribution adds a directory, targeted news, recognition, courses and adoption analytics. You host, patch and upgrade it yourself, and features such as read receipts are custom work.

### How much does an intranet platform cost?

It ranges from free software to several hundred dollars per employee a year. Drupal and Umbraco cost nothing to license and are paid for in hosting and developers. Liferay enterprise contracts reportedly start at $25,000 to $50,000 a year, Salesforce internal seats start at $195 per user per month, and HCL and Squiz meter sessions or page views under quote-only contracts.

## How we rated these platforms

Each rating combines the relevant criteria from the DXP Scorecard's independent scorecards into a five-point scale. The Fit score blends these ratings, weighted for this topic, into one number out of 10, and is recalculated whenever a scorecard is updated:

- Security & compliance (40%): Will legal, security and procurement sign off?
- Marketer self-service (20%): Can my team build and change pages without filing a ticket?
- Global & multi-brand (20%): Can it run many sites, brands and languages without chaos?
- Low IT upkeep (13%): After launch, how much effort does it take just to keep it running?
- Budget predictability (7%): Will the price be clear up front, and will it stay reasonable as we grow?

Scorecards and platform inclusion are unsponsored: no vendor pays to appear in this guide or to change a rating. Methodology: https://www.dxpscorecard.com/scoring-framework