SSO cost and IAM pricing in 2026: 23 options, the units they bill and the costs they leave out

What drives SSO cost and IAM pricing in 2026?#

SSO cost and IAM pricing in 2026 are set by the unit a vendor bills, a seat, a monthly active user, an enterprise connection or your own servers, more than by the vendor. Each unit tracks a different count in your business. A seat price tracks staff. An MAU price tracks the people who sign in at least once in a month. A connection price tracks how many customer companies plug in their own login system. Finally, self-hosting tracks servers and the hours someone spends keeping them patched.

Microsoft's IAM overview splits the job into "Authentication of users" and "Authorization of users", and every option below sells both. The base plans differ more than most shortlists expect. On pricing pages read 26 October 2026, the first paid plan runs from $20 a month on Clerk Pro to $799 a month on Descope Growth.

However, a base price says little on its own, because each base buys a different allowance. For example, in the worked examples below on pages read 26 October 2026, a 200-person workforce pays $7,200 to $40,800 a year at list. Then 10 enterprise connections cost $150 to $1,250 a month. Those spreads come from the unit, not from one vendor being greedy.

Every figure here is a list price read on 26 October 2026. So treat each total as a planning estimate, not a quote. Vendors change pages often, and a sales call can move any of them. Confirm the number with the vendor before you sign. These 23 options are the ones most shortlists start from, and other vendors exist.

Which pricing unit fits a workforce suite and which fits a B2B product?#

A workforce suite grows with headcount, so per-seat pricing fits it, while a B2B product grows with customer organisations, so per-connection or per-MAU pricing usually fits better. B2B means business-to-business, a product sold to other companies. An identity provider is the system that already holds a company's staff logins, such as Okta or Entra ID. An enterprise connection is one customer's identity provider wired to your app. It usually runs on Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), the two common sign-in standards.

Source: each vendor's own pricing page or repository, read 26 October 2026.

In practice, most vendors mix units, so the table shows the unit that moves the bill most, not the only one. For example, Descope charges a base price, then per MAU, then per connection above its allowance. Clerk does the same with its own numbers. So read every plan as a base plus one or two counters.

The rule that falls out is simple. First, write down three counts: staff, monthly active users and enterprise customers who want their own login. Then price the unit tied to your smallest count first. An internal suite for 200 staff should read seat prices. Meanwhile, take for example a product with 40,000 users and 8 enterprise customers. It should read connection prices before MAU prices.

What do Okta Workforce Identity, Microsoft Entra ID and Ping Identity charge per seat?#

Per-seat workforce SSO listed between $3 and $17 per user a month on the Ping Identity, authentik, Okta and Microsoft pricing pages read 26 October 2026. Because seat prices sit in a narrow band, the choice turns on the tier and the minimum contract.

At a 200-person headcount, the same pages read 26 October 2026 give a yearly bill from $7,200 on PingOne Essential to $40,800 on Okta Essentials. The 200-person size is an illustrative example, and the arithmetic is price times 200 times 12. The tier matters as much as the vendor here, since Okta alone spans $14,400 to $40,800 across its three suites.

Source: Okta, Microsoft and Ping Identity pricing pages, read 26 October 2026.

Okta Workforce Identity#

Okta's pricing page, read 26 October 2026, sells suites per user a month, billed annually: Starter at $6, Core Essentials at $14 and Essentials at $17. A footnote adds a "$1,500 annual contract minimum required for Okta Workforce Identity". At $6 a seat, that floor covers about 20 people. So a smaller team pays for seats it does not have. The pro is breadth, since the Starter suite lists "Unlimited OIDC & Outbound SAML apps". The con is the yearly contract. So it is the wrong pick when you have a handful of staff and want to pay month to month.

Microsoft Entra ID#

Microsoft's Entra pricing page, read 26 October 2026, lists Entra ID P1 at $7 and P2 at $10 per user a month, paid yearly. This is what most people mean by Azure SSO pricing, since Entra ID is the identity service behind Azure. The pro is reach, because P1 bundles "Single Sign-On and application access" with multi-factor authentication (MFA). It also bundles Conditional Access, Microsoft's rule-based sign-in policies. Also, the same page says Microsoft 365 E3 already includes Entra ID P1. So it is the wrong pick when your staff do not work in Microsoft 365.

Ping Identity#

Ping Identity's pricing page, read 26 October 2026, lists PingOne for Workforce Essential at $3 and Plus at $6 per user a month. However, both figures are "Based on annual contract for 5,000 user minimum". So a 200-person company would still pay for 5,000 seats on either plan. The pro is protocol cover, since the page lists OAuth 2.0, OpenID Connect, SAML and SCIM. SCIM, the System for Cross-domain Identity Management, is the standard for syncing user accounts between systems. So it is the wrong pick for a company far below that 5,000-user floor.

How does per-MAU pricing work on Auth0, Entra External ID, Cognito and Identity Platform?#

On pricing pages read 26 October 2026, free allowances run from 7,500 monthly active users on Descope to 50,000 on Clerk and Microsoft Entra External ID. Every MAU price is that free allowance plus an overage rate for each user above it. Also, both parts differ more between vendors than base prices do.

The overage rate is where the bill grows. On the same pages, read 26 October 2026, the first rate above the allowance runs from $0.0055 per user on Google Cloud Identity Platform to $0.05 on PropelAuth and Descope. That is a ninefold gap per user.

One catch sits under almost every MAU price. A federated user is one who signs in through their employer's identity provider over SAML or OIDC. Several platforms bill those users on a separate, smaller allowance.

Amazon Cognito#

Amazon Web Services (AWS) runs Cognito user pools, its user directories for apps you build. Its Cognito pricing page, read 26 October 2026, gives direct sign-in "a free tier of 10,000 monthly active user (MAU)". Above that, the Essentials tier charges $0.015 per MAU. However, for SAML or OIDC users, the free tier is "50 MAUs per month per account or per AWS organization" on the same page. The pro is a large free tier for direct sign-in on infrastructure you may already run. The con is that federated allowance of 50. So it is the wrong pick when your app does not run on AWS. It is also wrong when most users arrive through company logins.

AWS IAM Identity Center#

AWS prices SSO in two halves, and the workforce half carries no extra charge. Its IAM Identity Center FAQ, read 26 October 2026, says "IAM Identity Center is offered at no extra charge." It gives staff one sign-in to AWS accounts, to business apps such as Salesforce, Microsoft 365 and Box, and to custom apps that support SAML 2.0. Its FAQ adds that it can sync users from Okta, Entra ID, OneLogin and PingFederate over SCIM. The pro is workforce SSO with no licence line on the bill. The con is reach, because it signs staff into AWS and SAML apps, not customers into your product. So it is the wrong pick when the users are your customers, which is the job Cognito does.

Google Cloud Identity Platform and Firebase Authentication#

Google Cloud's Identity Platform page, read 26 October 2026, prices standard sign-in at $0.0055 per MAU in its first paid tier. Then SAML or OIDC costs $0.015 per MAU. Meanwhile, Firebase's pricing page, read the same day, offers sign-in at "No-cost up to 50K MAUs". For SAML and OIDC, Firebase stops at "No-cost up to 50 MAUs". The pro is the lowest overage rate on the market for consumer sign-in. So it is the wrong pick when most of your users sign in through their employer.

Auth0#

Auth0 is owned by Okta. Its pricing page, read 26 October 2026, lists a Free plan for "Up to 25,000 monthly active users" with "1 Enterprise Connection". Essentials costs $35 a month and Professional $240 a month, each at the page's entry user count. But both paid plans carry a footnote: "Upgrade to B2B to continue using EC, Self-Service SSO, and SCIM". EC means enterprise connections. The pro is a free tier that already includes one enterprise connection. So it is the wrong pick when you need many enterprise connections on a small budget.

Microsoft Entra External ID#

Microsoft's Entra page, read 26 October 2026, says to "Get started with Microsoft Entra External ID free up to the first 50,000 monthly active usages (MAUs)". That allowance ties Clerk's for the largest here. But the page prints no rate above it, so you must ask Microsoft for the rest. So it is the wrong pick when you need a fixed budget above 50,000 users.

Source: AWS pricing and IAM Identity Center FAQ pages, plus the Google Cloud, Firebase, Auth0 and Microsoft pricing pages, read 26 October 2026.

How does the bill move as monthly active users grow?#

In a worked example at 100,000 monthly active users, plan prices read on 26 October 2026 run from $1,020 a month on Clerk Pro to $4,749 on Descope Pro. At 10,000 users the same five plans cost $0 to $249. So per-MAU plans look alike when small and pull apart fast.

The arithmetic is the same for every plan: base price, plus users above the allowance times the overage rate. For example, Clerk Pro's page, read 26 October 2026, lists $20 a month with 50,000 users included and $0.02 for each one above. At 100,000 users that comes to $20 plus 50,000 times $0.02, or $1,020. On Descope's page, read the same day, Pro is $249 with 10,000 included and $0.05 above. At 100,000 users, the dataset above puts it at $4,749 a month.

The order also changes along the curve. At 50,000 users on those 26 October 2026 pages, Clerk Pro still costs $20 while Cognito costs $600. By 100,000, Cognito at $1,350 is close behind Clerk at $1,020, because Cognito's rate is lower above the allowance. So read your own count off the curve, then read the count you expect later.

Federated users run on their own meter. On the Amazon Cognito page read 26 October 2026, SAML or OIDC users cost $0.015 each above a free 50. As a result, 1,000 federated users cost $14.25 a month, 5,000 cost $74.25 and 20,000 cost $299.25. Google Cloud Identity Platform prints the same $0.015 rate for SAML and OIDC.

That line is small next to a per-connection fee, which is the point. A product whose 5,000 enterprise users arrive through company logins pays $74.25 a month on Cognito's 26 October 2026 page. It pays $625 on WorkOS for five connections. Meanwhile, Cognito leaves the work of wiring each customer's identity provider to you.

What do WorkOS, Clerk, Stytch, Descope, Frontegg, Kinde and PropelAuth charge per enterprise connection?#

On pricing pages read 26 October 2026, WorkOS lists $125 a month per SSO connection for the first 15, falling to $65 from the 51st connection. These developer-first platforms sell enterprise SSO per customer connection or as a flat plan. So your count of enterprise customers sets the bill, and SSO pricing per connection falls only with volume.

In practice, a connection is one customer organisation. So the unit is really a tenant, one customer's walled-off space in your product. Our multi-tenant Laravel review covers how tenants map to organisations in a codebase. On the platforms below, each tenant that wants its own login becomes a line on the bill.

WorkOS#

The WorkOS pricing page, read 26 October 2026, offers user management free for the "First 1 million active users". So the pro is that sign-ins themselves cost nothing at almost any size. The con is the per-connection line, $125 each for the first 15. So it is the wrong pick when your customers are many small firms that all want SSO.

Clerk#

Clerk's pricing page, read 26 October 2026, lists Pro at $20 a month, billed annually, with 50,000 users included per app. One enterprise connection is included, and each further one is "Additional $75/mo each". The pro is the lowest entry price here. But the second connection already costs more than the plan. So it is the wrong pick when you expect dozens of enterprise customers early.

Stytch#

Stytch's pricing page, read 26 October 2026, includes 10,000 monthly active users and "5 SSO or SCIM Connections" free. After that, each connection costs $125. The page also promises no "hard caps or pricing cliffs" above the free tier. The pro is a free start that covers five enterprise customers. But SSO and SCIM share that allowance of five. So it is the wrong pick when you will pass five connections fast.

Descope#

Descope's pricing page, read 26 October 2026, lists Pro at $249 a month with 5 SSO connections and 10,000 users. Growth costs $799 a month with 10 connections and 25,000 users, and each extra connection costs $50 on both. The pro is the cheapest extra connection here. But the base is high. So it is the wrong pick for a product with one or two enterprise customers.

Frontegg#

Frontegg's pricing page, read 26 October 2026, starts free with "7,500 Monthly Active Users" and "5 Enterprise Connections (SSO/SCIM)". Above that, every tier says "Contact sales". The pro is a free start with five connections. But you cannot price growth from the page. So it is the wrong pick when you need a written price before you commit.

Kinde#

Kinde's pricing page, read 26 October 2026, lists Pro at $25 and Plus at $75 a month, each with 10,500 users free. Plus offers "Free enterprise SSO", while Pro includes one connection. That low price for unlimited SSO is the pro. But the same page lists "SCIM (Coming soon)". So it is the wrong pick when your customers need user sync today.

PropelAuth#

PropelAuth's pricing page, read 26 October 2026, lists Growth at $150 a month with "Unlimited SAML/enterprise SSO connections" and 10,000 users. Above that allowance, each user costs $0.05. Directory sync through SCIM needs Growth Plus, at $500 a month on the same page. The pro is a flat connection price. So it is the wrong pick when you need SCIM on a small budget. It also costs more once active users pass the allowance.

Source: WorkOS, Clerk, Stytch, Descope, Frontegg, Kinde and PropelAuth pricing pages, read 26 October 2026.

What do 10 enterprise SSO connections cost at list price?#

In a worked example at 10 enterprise connections, list prices read on 26 October 2026 run from $150 to $1,250 a month, so the billing unit decides the bill more than the vendor. The whole gap comes from the unit. In fact, the steepest ladder sits on the vendor whose sign-ins are free.

Each line uses the vendor's own page read 26 October 2026. On WorkOS, 10 connections at $125 each come to $1,250. Then on Stytch, 5 are included, so 5 more at $125 come to $625. On Clerk Pro, the $20 plan plus 9 extra connections at $75 comes to $695. Also, Descope Pro is $249 plus 5 extra at $50, or $499. Descope Growth covers all 10 at its $799 base. Finally, PropelAuth Growth stays a flat $150 with unlimited SAML.

The lines also cross. At three connections on those pages, read 26 October 2026, Stytch costs nothing and WorkOS costs $375. At 15, Descope Pro at $749 has moved below Clerk Pro at $1,070. So the cheapest plan at your count today may not stay the cheapest as you grow.

These totals are list prices for planning, so treat each one as an estimate, not financial advice or a quote. Also, a flat plan wins on connections but may charge elsewhere. PropelAuth Growth, for example, bills $0.05 for each user above 10,000 on its 26 October 2026 page. So an enterprise SSO pricing comparison only holds when you run your own counts through every line a plan bills.

What is the SSO tax and which plans put SAML behind an enterprise tier?#

The SSO tax is the practice of putting SAML behind an enterprise plan, and the add-ons that now grow a bill are SCIM provisioning, audit log streaming and custom domains. The headline SSO price leaves those out, along with support tiers. On some platforms, SCIM alone doubles the fee for one customer.

The Cybersecurity and Infrastructure Security Agency (CISA), the US federal cyber agency, sets the baseline on its Secure by Design page. It says products should ship with "single sign-on (SSO) available at no extra cost". Meanwhile, the community list at sso.tax tracks the vendors that do the opposite. It says some "gate SSO behind an 'Enterprise' paywall".

The pricing pages read 26 October 2026 show where the boundary sits now. Auth0's paid plans tell you to upgrade to B2B for enterprise connections. Kinde puts unlimited enterprise SSO on Plus rather than Pro. ZITADEL's pricing page includes "3 identity providers" on both its Free and Pro plans. So check which plan carries SAML before you compare any seat or MAU price.

Then come the add-ons. On those pages, read 26 October 2026, one add-on unit costs from $10 a month to $125 a month. The low end is a Clerk satellite domain, and the high end is a WorkOS Directory Sync connection.

SCIM is the add-on most enterprise customers ask for next. The SCIM protocol is defined in RFC 7644. It lets a customer's identity provider create, update and remove accounts in your app on its own. Without it, a person who leaves the customer keeps their account in your product until someone removes it by hand.

For example, take one enterprise customer who wants both SSO and SCIM. On pages read 26 October 2026, the connection fees come to $250 a month on WorkOS. That is $125 for SSO plus $125 for Directory Sync. Stytch also comes to $250 above its free five, since each customer uses two connections at $125. PropelAuth Growth Plus includes SSO and adds $100 for SCIM, so it comes to $100.

Two more lines rarely show on the first page. First, on the WorkOS page read 26 October 2026, a log stream to a security information and event management (SIEM) tool costs $125 a month. Then an audit log export costs $50 per connection on the PropelAuth page, read the same day. Support tiers and contract floors are the last lines, and the honest-exit section below charts the floors.

What do Keycloak, ZITADEL, authentik, Ory, FusionAuth, SuperTokens, Authelia and FerrisKey cost to run yourself?#

Self-hosted IAM such as Keycloak or FerrisKey carries no licence line under Apache 2.0, so the cost moves to servers, upgrades, on-call time and the people who run them. Self-hosting therefore pays only when someone on your team owns upgrades and incidents. For a full three-year Keycloak and Auth0 comparison at 5,000 users, see our Keycloak vs Auth0 cost breakdown.

The people line is the one to price honestly. An identity server needs patching when a security fix lands. It needs a database that is backed up and tested. And it needs someone to answer when sign-in fails at night. If that person already runs your other servers, the extra load is small. If not, the saving on the licence goes into a hire or a support contract.

Source: each project's repository or pricing page, read 26 October 2026.

Keycloak#

The Keycloak repository, read 26 October 2026, is under the Apache License 2.0, so the pro is no licence fee. But the upkeep is real. The Keycloak production guide asks for TLS, a set hostname, a database and "a reverse proxy / load balancer component". TLS, Transport Layer Security, is the encryption behind HTTPS. So it is the wrong pick when your team cannot own those parts.

ZITADEL#

The ZITADEL repository, read 26 October 2026, is under AGPL-3.0, the GNU Affero General Public License. That is a copyleft licence, which requires that changes you offer to others as a service are shared too. The repository lists "OpenID Connect certified · SAML 2.0". Also, ZITADEL's pricing page, read the same day, lists a cloud Pro plan at US$100 a month. So the pro is SAML in the open source server plus a hosted route. But copyleft terms need a legal read before you change and ship the code. So it is the wrong pick when your lawyers will not accept them.

authentik#

authentik's pricing page, read 26 October 2026, keeps the open source edition free. Enterprise costs "$5 / user / month" and "$0.02 / external user* / month". Enterprise Plus is "Starting at $20k annually". However, the page says "We do not currently provide a hosted version of authentik". Still, the same page promises it "will not move any features from the open source version to the enterprise version". So it is the wrong pick when you want someone else to run it.

Ory#

Ory's pricing page, read 26 October 2026, lists its hosted Production plan at $770 a year and Growth at $9,350 a year. The pro is the lowest yearly entry price for a hosted plan here. But for a B2B product, Growth lists "B2B SSO (OIDC only)". So SAML customers need a higher plan or another route. So it is the wrong pick when your first enterprise customer insists on SAML.

FusionAuth#

FusionAuth's pricing page, read 26 October 2026, says "FusionAuth Community is free and unlimited" when you host it. If you want FusionAuth to host it, the Starter plan begins at $162 a month, billed annually. The pro is a free edition with no user cap. So it is the wrong pick when you want a hosted plan on a very small budget.

SuperTokens#

SuperTokens' pricing page, read 26 October 2026, says "Self hosting the open source features is free without any limits!". Its cloud plan charges $0.02 per MAU, and paid add-ons carry a "Minimum Billing of $100 / month". So it is the wrong pick when you need paid add-ons for only a few hundred users.

Authelia#

The Authelia repository, read 26 October 2026, describes a sign-in server for web apps. It provides "two-factor authentication and single sign-on (SSO) for your applications via a web portal". It also says it "acts as a companion for reverse proxies", under the Apache 2.0 licence. So the pro is a small footprint for guarding staff tools. But it is the wrong pick for a B2B product whose customers need their own SAML connection.

FerrisKey#

The FerrisKey site, read 26 October 2026, labels the project "Early Access · v0.9.0" under Apache 2.0. Its repository describes "an identity and access management (IAM) server written in Rust" that "implements OpenID Connect and OAuth 2.0". It keeps each tenant's users, roles and clients in a separate realm, which is FerrisKey's name for an isolated tenant space. The repository also states "FerrisKey is Apache-2.0 only, with no CLA, no open-core model and no enterprise edition". A CLA is a contributor licence agreement. So the pro is a clean licence with no paid tier waiting later. But neither page lists SAML, and v0.9.0 is a pre-1.0 release. So it is the wrong pick for production sign-in today, or for any customer who needs SAML.

What does SSO implementation cost on top of the licence?#

SSO implementation cost is mostly people time, not licence fees: discovery, merging user records, integrating each app by its protocol, testing and cutover, and it grows with every app and user store. No pricing page above includes it, so single sign-on implementation cost is a separate line from the licence. It is usually the larger line in the first year for a company with several apps.

Protocol choice moves the per-app effort. The OpenID Connect specification calls OIDC "a simple identity layer on top of the OAuth 2.0 protocol". OAuth 2.0 is the open standard for delegated access. Apps that already speak OAuth 2.0 often need less work than apps that need SAML added from scratch.

For the project itself, phase by phase, read what SSO implementation costs across existing apps. It covers discovery, the user record merge, per-app work by protocol, testing, cutover and rollback, with the cost at three company sizes.

When is each SSO option the wrong fit?#

Every option here is the wrong fit somewhere, from Okta Workforce Identity's $1,500 annual minimum, read 26 October 2026, to FerrisKey's Early Access v0.9.0 release. In short, an option is the wrong fit when its unit grows faster than your counts. It is also wrong when its running cost lands on a team that cannot carry it.

Contract floors are the first filter. On the pages read 26 October 2026, the lowest published yearly commitment runs from $770 on Ory Network Production to $50,000 on PingOne for Customers Plus. Okta Customer Identity starts at $3,000 a month, billed annually, which is $36,000 a year.

If you sell to consumers, per-seat suites such as Okta, Entra ID and Ping are the wrong tool. Instead, per-MAU options such as Cognito, Firebase or Entra External ID fit better. When most users sign in through their employer, the 50-user federated allowance on the Cognito and Firebase pages, read 26 October 2026, runs out at once. Then a per-connection or flat plan such as PropelAuth, Kinde Plus or Descope Growth fits better.

If you expect many small customers on SSO, every per-connection price adds up, and a flat or MAU plan fits better. If your team cannot cover server patches at night, skip Keycloak, ZITADEL, authentik and Authelia. A managed plan costs more on paper but less in risk. When you only guard staff tools behind a reverse proxy, Authelia or the Entra ID seats you already hold may be all you need.

Three sizes make the path concrete. A 30-person company with staff tools only should price Entra ID P1 or Okta Starter first, and check the Okta floor. A product with a few thousand users and three enterprise customers should price the free allowances on Stytch, Frontegg and Descope. A product with 20 or more enterprise customers should price the flat plans against the WorkOS volume bands.

FerrisKey sits apart. On its 26 October 2026 site it is Early Access v0.9.0. So watch it as a clean Apache 2.0 option, but keep production sign-in elsewhere for now.

Where should the shortlist go next?#

Two sibling posts go deeper: one prices the SSO implementation project across existing apps, and one prices Keycloak against Auth0 over several years. For the project, read what SSO implementation costs. For the two-option comparison, read the Keycloak vs Auth0 cost breakdown.

When the next step is moving users, the Keycloak user migration guide shows one merge without a password reset. For wiring one sign-in across many apps, our API integrations page shows how we approach it. And when the push comes from an audit, see security and compliance. If your own enterprise customers want to sign in with their identity provider, our enterprise SSO in a product page covers that build. Still, each vendor's own pricing page, linked above, is enough to weigh SSO cost and IAM pricing yourself.