The headline IdP price isn't what you'll pay.
Identity Provider pricing pages publish per-user-per-month figures. The end-to-end Year-1 cost is materially higher across every IdP in this cohort because of category-specific hidden cost lines: SAML tax (SSO connection caps and annual minimums), MAU-based pricing surprises (Auth0), audit-log retention overhead, MFA upgrade tiers, and migration cost on exit.
This memo walks the 8 enterprise IdPs in the 2026 buyer cohort and surfaces the actual end-to-end cost. For the vendor list-pricing comparison view, see idppricing.com. This site is the buyer-lens companion — same vendors, framed around what the procurement / security team actually budgets for over 3 years.
1.Year-1 TCO by IdP
Representative buyer: 200 employees · 30 SaaS apps · full SAML + MFA + lifecycle automation + 90-day audit retention.
| IdP | Cheapest published rate | Year-1 at 200 seats | How that figure is reached |
|---|---|---|---|
| Okta Workforce Identity | $6 | $33,600 | 200 × $14 × 12 at Core Essentials |
| Microsoft Entra ID | $7 | $0 or $16,800 | $0 if already on E3, Business Premium or E5; otherwise 200 × $7 × 12 for P1 |
| JumpCloud | $3 | $26,400 | 200 × $11 × 12 on the SSO package |
| Auth0 | Quote only | From $1,800not seat-priced | $150/mo B2B Essentials floor at 500 MAU, priced on active users not seats |
| OneLogin | $3 | $24,000 | 200 × $10 × 12 on Business |
| Ping Identity | $3 | $180,000 | 5,000-user minimum × $3 × 12, the floor binds at 200 seats |
| Duo (Cisco) | $3 | $21,600 | 200 × $9 × 12 at Premier |
| Authentik | $5 | $0 or $12,000 | $0 on Open Source; 200 × $5 × 12 on Enterprise. Excludes your hosting and ops |
2.The four hidden cost categories every IdP touches
SAML tax. SAML SSO is usually available at IdP entry tiers, but the cost shows up as caps rather than outright gating: Auth0 includes only 3 enterprise (SAML) connections on B2B Essentials and charges $100/mo per connection beyond the cap; OneLogin includes unlimited SSO from Basic ($3) but caps lifecycle at 5 apps; Entra includes SAML to SaaS apps free but charges P1 ($7) for on-prem; Okta's Starter ($6) includes SSO but carries a $1,500/yr annual minimum. Model the caps and minimums, not just the headline tier. Deep dive: the SAML tax
MAU-based pricing surprise. Auth0 charges per monthly active user, not per seat. For B2C deployments with traffic spikes, this drives unexpected bill volatility. Other IdPs (Okta, Entra, JumpCloud) charge per provisioned user, which is more predictable but typically more expensive at low MAU/seat ratios. The choice between MAU and seat pricing matters more than the headline rate.
Log retention, which is usually not a tier upgrade. Default retention is short and the fix is rarely a bigger plan. Auth0 is the tightest in this cohort at 5 days on B2B Essentials, 10 on Professional, 30 only on Enterprise. Entra ID is 7 days on Free and 30 on P1 and P2, with longer retention via a Log Analytics workspace billed as Azure consumption. Okta is fixed at 90 days on every tier and sells no extension at all — its own guidance is to export via the UI or API, or stream to a third-party SIEM. JumpCloud sells audit logging as the separate Directory Insights module at $3/user/mo. For most of this cohort, multi-year retention is a pipeline you build and a storage bill you carry, not a line on the vendor quote. Log retention cost math
Migration cost on exit. The swing factor is not app count, it is how much of your identity logic sits in something proprietary. Okta's Workflows and Auth0's Rules and Actions do not port to another IdP — they are re-authored from intent — and on-prem PingFederate customisation is the same problem at greater depth. A 200-person company running fifty Auth0 Actions is a harder migration than a 2,000-person company running stock SAML. Nobody publishes what these projects cost, so size yours from the drivers. Migration cost deep-dive
3.3-year TCO matters more than Year-1
IdP procurement is typically a 3-year decision because of (a) integration cost amortisation, (b) typical enterprise contract length, and (c) migration cost on exit. Year-1 TCO understates total commit because tier upgrades, MAU growth, and add-on modules accumulate. 3-year TCO deep-dive walks the math for each IdP at three buyer profiles (SMB / mid-market / enterprise).
4.Buyer profiles — which IdP fits which buyer
- M365-native (already on E3, Business Premium or E5): Entra ID is already paid for. E3 and Business Premium both include P1; E5 includes P2. Marginal cost is zero. Don't over-engineer.
- On M365 Business Standard: the reflex is to price an E3 upgrade, but Business Premium also includes Entra ID P1 and is the cheaper route to the same entitlement. Price both.
- SMB under 100 seats: JumpCloud module stack or Entra. Okta is workable but the $1,500/yr minimum dominates below about 21 seats.
- Mid-market 100-500 seats: Okta Core Essentials or a JumpCloud package. Ping is out on the 5,000-user minimum regardless of its headline rate.
- Enterprise 500+ seats: Okta, Ping or Entra ID P2. Okta's Professional and Enterprise tiers are quote-only, so model the published Essentials rate as your floor. Migration cost dominates the decision.
- B2C or B2B app: Auth0 if MAU is predictable. Check the log retention window first — 5 days on B2B Essentials catches people out.
5.The lens that's missing from idppricing.com
idppricing.com presents what each IdP publishes. This site presents what each IdP actually costs. The two views are complementary — IT directors comparing vendors generally want the vendor list-pricing comparison; engineering and security leaders budgeting for 3-year IdP spend need the end-to-end cost view. Both audiences exist; both lenses are valid.