How we verify every IdP price

The cheapest paid tier at which SAML 2.0 SSO is enabled. OAuth-only and consumer-grade tiers don't count — the tracked feature is enterprise IdP capability. Where the IdP prices per MAU (Auth0) rather than per seat, we show the flat-rate floor and flag that per-user comparison requires assumptions about traffic.

Several IdPs have annual minimums that materially change the buying decision:

• Okta: $1,500/yr across all tiers — prices out teams below ~21 seats.
• Ping: 5,000-user contractual minimum on Essential = $180,000/yr floor. Effectively enterprise-only.
• Auth0: B2B Essentials floor at $150/mo (≈$1,800/yr); Professional at $750/mo.
• Authentik Enterprise Plus: from $20,000/yr.

The TCO calculator on the home page factors these in. Below-minimum projections trigger a "min-floor" flag on the result row.

Microsoft Entra ID is included in Microsoft 365 E3 (P1) and E5 (P2). For any organisation already on those M365 tiers, the marginal cost of using Microsoft as the IdP is $0 — they're already paying. The calculator's "Already on M365 E3" toggle reflects this. We treat this as the single most under-recognised insight on the IdP cost side.

Authentik is open-source and free to self-host. Its real cost is operational — hosting infrastructure (typically $200-400/mo on Hetzner/Linode/AWS for a redundant setup) plus admin time. Below ~30 internal seats, self-hosted Community is usually the cheapest credible IdP. Above that, the operational burden typically justifies a commercial alternative. The calculator models a $3,600/yr ops cost for self-host at the 50-seat boundary.

Twelve features tracked across eight IdPs. Support is recorded at the IdP's top tier — not the starter tier. The per-IdP pages list which features kick in at which tier. We re-check feature support at each quarterly pass; vendor docs do shift over time (e.g., OneLogin added WebAuthn / passkey support in 2025 — we caught this in the most recent pass).

Every IdP is re-checked at least quarterly. Material vendor repricing events trigger off-cycle updates within seven days. Pre-deploy CI gate refuses to publish if any row is >90 days stale.

ssopricing.com tracks the SaaS-vendor side of the SSO procurement decision (what each SaaS charges to integrate with your IdP). The two sites publish coordinated re-verification dates — when one finds material IdP pricing changes, the other updates its IdP cost matrix in the same pass. Same independence rules apply to both: no affiliate revenue on any IdP or SSO vendor.

idppricing.com is published by Digital Signet. Digital Signet does not sell identity, SSO infrastructure, or access management services. We do not accept sponsored placements that influence pricing claims or methodology. The advertiser exclusion list specifically forbids IdP and access-management ads on this property.

If you spot a stale tier price, broken source URL, or a feature support claim that doesn't match the vendor's docs, email hello@digitalsignet.com with the source URL. Updates land within seven days.