SSO cost and IAM pricing in 2026: 22 options, their real units and the retrofit bill

What drives SSO cost and IAM pricing in 2026?#

SSO cost and IAM pricing in 2026 follow four billing units, per seat, per monthly active user, per enterprise connection or self-hosted time, plus a retrofit project billed in people time. Each unit tracks a different count in your business. A seat price tracks staff, and an MAU price tracks the users who sign in at least once a month. A connection price tracks how many customer companies plug in their own login system. Finally, self-hosting tracks servers and the hours someone spends keeping them patched.

Microsoft's IAM overview splits the job into "Authentication of users" and "Authorization of users", and every option below sells both. In practice, the licence is only half of the single sign-on cost. The other half is the work of putting one sign-in in front of apps that each kept their own users. None of the pricing pages below puts a price on that work.

What does retrofitting SSO onto existing apps actually involve?#

Retrofitting SSO means four jobs, merging user records, wiring each app, testing every sign-in path and cutting over, and one shipped retrofit finished all four with no downtime. In our Keycloak retrofit, we put Keycloak, an open source identity server, in front of a suite of separate web apps. Before that, each app kept its own copy of every user. We moved those users into one store and kept every app in service while they moved. Then we added OAuth 2.0 and OpenID Connect, the open sign-in standards, plus multi-factor authentication (MFA).

As a result, authentication support tickets fell 70%. That outcome came from the project, not from a licence line, since Keycloak itself is free to use. So hold the retrofit in mind while you read the prices below, because SSO implementation cost is the line most comparisons leave out.

Which pricing unit fits a workforce suite and which fits a B2B product?#

Per-seat pricing fits a workforce suite with a known headcount, while per-connection and per-MAU pricing fit a B2B product whose customers bring their own identity providers. B2B means business-to-business, a product sold to other companies. An identity provider is the system that already holds a company's staff logins, such as Okta or Entra ID. An enterprise connection is one customer's identity provider wired to your app. It usually runs on Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), the two common sign-in standards.

Source: each vendor's own pricing page or repository, read 22 October 2026.

For example, a team that sells to a few large customers should read per-connection prices first. Meanwhile, an internal suite for staff should read seat prices first. But many vendors mix units, so the table shows the unit that moves the bill most, not the only one.

What do Okta Workforce Identity, Microsoft Entra ID and Ping Identity charge per seat?#

Okta lists Workforce Identity suites at $6 and $17 per user per month and Microsoft lists Entra ID P1 at $7 and P2 at $10, both read on 22 October 2026. Because seat prices sit in a narrow band, the choice turns on the minimum contract and what each tier includes.

Okta Workforce Identity#

Okta's October 2026 pricing page sells suites billed annually, with a "$1,500 annual contract minimum required for Okta Workforce Identity". The pro is breadth, since the same page lists "Unlimited OIDC & Outbound SAML apps". But the con is the yearly contract and its floor. So it is the wrong pick when you have a handful of staff and want to pay month to month.

Microsoft Entra ID#

Microsoft's October 2026 Entra pricing page lists P1 at $7.00 per user a month and P2 at $10.00 per user a month, paid yearly. The pro is reach, because P1 bundles "Single Sign-On and application access", MFA and Conditional Access, Microsoft's rule-based sign-in policies. Also, Entra ID Free already comes with a Microsoft 365 or Azure plan. But the page sells an annual plan that renews on its own. So it is the wrong pick when your staff do not work in Microsoft 365.

Ping Identity#

Ping's October 2026 pricing page lists PingOne for Workforce Essential at $3 per user per month and Plus at $6 per user per month. However, both figures are "Based on annual contract for 5,000 user minimum". The pro is protocol cover, since the page lists OAuth 2.0, OpenID Connect, SAML and SCIM. SCIM is the standard for syncing user accounts between systems. So it is the wrong pick for a company far below that floor.

How does per-MAU pricing work on Auth0, Entra External ID, Cognito and Identity Platform?#

Amazon Cognito and Google Cloud Identity Platform both list $0.015 per federated SAML or OIDC monthly active user above a free tier, read on 22 October 2026. A federated user is one who signs in through their company's identity provider. So per-MAU pricing is cheap at low federated volume and grows in a straight line with active users.

Amazon Cognito#

Amazon Web Services (AWS) says on its October 2026 Cognito pricing page that "the price for MAUs above the 50 MAU free tier is $0.015" for SAML or OIDC users. The pro is a large free tier for direct sign-in, at 10,000 MAU a month on Essentials and Lite, but the federated free tier is only 50 users. So it is the wrong pick when your app does not already run on AWS.

Google Cloud Identity Platform and Firebase Authentication#

Google Cloud's October 2026 Identity Platform page prices SAML and OIDC at $0.015 per MAU above 50. Also, Firebase's October 2026 pricing page offers sign-in at no cost up to 50K MAUs, and that consumer allowance is the pro. But it allows only 50 SAML or OIDC users before Google Cloud pricing applies. So it is the wrong pick when most of your users arrive through company logins.

Auth0#

Okta's October 2026 Auth0 pricing page lists a Free plan for up to 25,000 monthly active users, with 1 Enterprise Connection. So the pro is a free tier that already covers one enterprise connection. Then Essentials costs $35, and Professional costs $240, each a month for 500 monthly active users. But the con sits in a footnote on both paid plans. It reads "Upgrade to B2B to continue using EC, Self-Service SSO, and SCIM", where EC means enterprise connections. So it is the wrong pick when you need many enterprise connections on a small budget.

Microsoft Entra External ID#

Microsoft's October 2026 Entra page offers External ID "free up to the first 50,000 monthly active usages". That allowance is the pro. But the page prints no price above it, so you must ask Microsoft for the rest. So it is the wrong pick when you need a fixed budget above that allowance.

What do WorkOS, Clerk, Stytch, Descope, Frontegg, Kinde and PropelAuth charge per enterprise connection?#

WorkOS lists $125 per SSO connection per month for the first 15 connections, falling to $65 from 51 to 100, read on 22 October 2026. So SSO pricing per connection falls with volume, but each enterprise customer still adds a fixed monthly line.

WorkOS#

The October 2026 WorkOS pricing page keeps user management free up to 1 million users. So the pro is that sign-ins themselves cost nothing. But the con is the per-connection line itself. As a result, it is the wrong pick when your customers are many small firms that all want SSO.

Clerk#

Clerk's October 2026 pricing page lists Pro at $20 per month, billed annually, with 1 SSO connection included. Each further connection is "Additional $75/mo each". So the pro is a low entry price. But the second connection already costs more than the plan. So it is the wrong pick when you expect dozens of enterprise customers early.

Stytch#

Stytch's October 2026 pricing page includes 10,000 MAUs and 5 SSO or SCIM connections free. After that, each extra connection costs $125. The page also promises "no hard caps or pricing cliffs". Still, it is the wrong pick when you will pass 5 connections fast.

Descope#

Descope's October 2026 pricing page lists Pro from $249 a month with 5 SSO connections, and Growth from $799 a month with 10. Beyond those, each extra connection costs $50. The pro is that Growth already covers 10 connections. But the base is high, so it is the wrong pick for a small product with one or two enterprise customers.

Frontegg#

Frontegg's October 2026 pricing page includes 7,500 Monthly Active Users and 5 Enterprise Connections at $0 a month. Above that, every tier says "Contact sales". So the con is that you cannot price growth from the page. The pro is the free start, but it is the wrong pick when you need a written price before you commit.

Kinde#

Kinde's October 2026 pricing page lists two paid plans: Pro at $25 USD per month and Plus at $75 USD per month. Both include 10,500 MAU free each month. Also, Kinde's page gives Free and Pro 1 enterprise SSO connection, while Plus offers "Free enterprise SSO" with no cap. That low price for unlimited SSO is the pro. But the page lists "SCIM (Coming soon)", so it is the wrong pick when you need user sync today.

PropelAuth#

PropelAuth's October 2026 pricing page lists Growth at 150/month with "Unlimited SAML/enterprise SSO connections". But directory sync through SCIM needs Growth Plus, at 500/month on the same page. So it is the wrong pick when you need SCIM on a small budget.

What do 10 enterprise SSO connections cost at list price?#

In a worked example at 10 enterprise connections, list prices read on 22 October 2026 run from a flat $150 a month to $1,250 a month. At the same count, the models differ by a factor of about eight. So the model matters more than the headline rate.

Each line below uses the vendor's own October 2026 page. On WorkOS, 10 connections at $125 each come to $1,250. Then on Stytch's October 2026 page, 5 are included, so 5 extra at $125 come to $625. For Clerk Pro on Clerk's October 2026 page, the plan's $20, plus 9 extra connections at $75, comes to $695. Finally, PropelAuth's October 2026 page makes Growth a flat $150 with unlimited SAML.

These are list prices for planning, so treat them as an estimate, not financial advice or a quote. Also, a flat plan wins on connection count but may charge elsewhere, such as SCIM or extra users. So an enterprise SSO pricing comparison only holds when you run your own counts through every line a plan bills.

What is the SSO tax and which plans put SAML behind an enterprise tier?#

The SSO tax is the price step when a vendor keeps SAML single sign-on for its enterprise plan, and CISA's Secure by Design pledge asks for SSO at no extra cost. Because the tax is a plan boundary rather than a unit price, read it off each plan's feature list first.

The Cybersecurity and Infrastructure Security Agency (CISA) is the US federal cyber agency. On its Secure by Design page, it says products should ship with MFA, logging and "single sign-on (SSO) available at no extra cost". Meanwhile, the community list at sso.tax catalogues vendors that "gate SSO behind an 'Enterprise' paywall".

What do Keycloak, ZITADEL, authentik, Ory, FusionAuth, SuperTokens and Authelia cost to run yourself?#

Keycloak, ZITADEL, authentik, Ory, FusionAuth, SuperTokens and Authelia replace the licence line with hosting and the people time to patch, upgrade and run them. So self-hosting is cheaper only when someone on your team already runs identity servers. For a full three-year Keycloak and Auth0 comparison, see our Keycloak vs Auth0 cost breakdown.

Keycloak#

The Keycloak repository is under the Apache License 2.0, so the pro is no licence fee. But the upkeep is real. The Keycloak production guide asks for TLS, a set hostname, a database and "a reverse proxy / load balancer component". TLS, Transport Layer Security, is the encryption behind HTTPS. So it is the wrong pick when your team cannot own those parts.

ZITADEL#

The ZITADEL repository is under AGPL-3.0, the GNU Affero General Public License, a copyleft licence that makes changes you ship open too, and it lists SAML 2.0 and OIDC. Also, the ZITADEL pricing page lists a cloud Pro plan at US$100/Month in October 2026. But copyleft terms need a legal read before you change and ship the code. So it is the wrong pick when your lawyers will not accept copyleft terms.

authentik#

authentik's October 2026 pricing page keeps the open source edition free and lists Enterprise at $5 / user / month. However, the page says "We do not currently provide a hosted version", so you must host it yourself. The pro is a promise on the same page that it "will not move any features from the open source version to the enterprise version". So it is the wrong pick when you want someone else to run it.

Ory#

Ory's October 2026 pricing page lists its hosted Production plan at $770/year and Growth at $9,350 / year. But for a B2B product, Growth lists "B2B SSO (OIDC only)", so SAML customers need another route. The pro is a low yearly entry price for a hosted plan.

FusionAuth#

FusionAuth's October 2026 pricing page says "FusionAuth Community is free and unlimited" when you host it. If you want FusionAuth to host it, the Starter plan begins at $162 a month, billed annually. Also, some features need a free licence key. So it is the wrong pick when you want hosting on a very small budget.

SuperTokens#

SuperTokens' October 2026 pricing page says "Self hosting the open source features is free without any limits". But paid add-ons carry a "Minimum Billing of $100 / month", which is a floor for a small app. So it is the wrong pick when you need paid add-ons for only a few hundred users.

Authelia#

The Authelia repository describes it as "a companion for reverse proxies" that adds two-factor sign-in and SSO through a web portal. So the pro is a small footprint for staff tools. But it is the wrong pick for a B2B product that needs customer SAML.

What does it cost to retrofit single sign-on across existing apps?#

A retrofit has four phases, merging user records, integrating each app, testing every sign-in path and cutting over, and each phase is paid in people time rather than licence. The single sign-on implementation cost grows with the number of apps and the number of duplicate user records. So count both before you choose a vendor.

First comes the merge. Two apps often hold the same person twice, with two passwords. Google Cloud's account consolidation guide, last updated 11 July 2024, warns that federation and consolidation interact. It says you must "temporarily set up federation in a way that is safe for account consolidation". Our user migration guide shows one merge done without a password reset.

Second, each app needs its sign-in code changed to trust the new identity provider. AWS's SAML guide for Cognito shows the steps for one user pool, which is Cognito's user directory. And those steps repeat for every app.

Then comes testing, across every path: password, MFA, reset, sign-out and a session that expires mid-task. Finally, cut over one app at a time, so a fault reaches one app, not all of them.

When is each SSO option the wrong fit?#

Every option here is the wrong fit somewhere, from per-seat plans for a consumer product to self-hosting for a team with nobody to run it. In short, the wrong fit is the case where its unit grows faster than your counts. It is also the case where its running cost lands on a team that cannot carry it.

If you sell to consumers, per-seat suites such as Okta, Entra ID and Ping are the wrong tool. Instead, per-MAU options such as Cognito, Firebase or Entra External ID fit better. When most users sign in through their employers, the 50-user federated free tier on the October 2026 Cognito and Identity Platform pages runs out at once. Then a per-connection or flat plan such as PropelAuth, Kinde Plus or Descope Growth fits better.

If you expect many small customers on SSO, every per-connection price adds up, and a flat or MAU plan fits better. If your team cannot cover server patches at night, skip Keycloak, ZITADEL, authentik and Authelia. A managed plan costs more on paper but less in risk. Finally, when you only guard staff tools behind a reverse proxy, Authelia or Entra ID Free may be all you need.

Where should the shortlist go next?#

The next step depends on the shortlist, either a two-option cost comparison, a user migration plan, or tenancy design for a multi-tenant product. For Keycloak against Auth0 over three years, read the Keycloak vs Auth0 cost breakdown. And for the merge phase, read the Keycloak user migration guide.

When your product bills per customer company, read our multi-tenant Laravel review, since tenants are what per-connection pricing counts. For wiring SSO across many apps, our API integrations page shows how we approach it. And when the push comes from an audit, see security and compliance. Still, each vendor's own pricing page, linked above, is enough to make the call yourself.