All I see when I go to the Cloud Identity part of the Admin Panel's "Get More Services" page is a happy little coffee cup unhelpfully stating "You're getting the best out of Google. We will notify you when new subscriptions become available."
Yes, you need to "upgrade" to "workspace" first then the "Cloud Identity" option becomes visible and after that you can "downgrade" to "Cloud Identity".
So I guess I'm not able to use that then.