iidppricing.com
Methodology

How we verify every IdP price

Every tier price on this site links to the IdP's own pricing page and carries a verifiedOn date. As of the last full verification (2026-06-02), 17 of 18 vendors were successfully fetched live (no anti-bot blocks, no SPA-rendered gaps). 1 vendor is quote only and do not publish per-user rates.

What counts as the per-user price

The cheapest paid tier at which SAML 2.0 SSO is enabled. OAuth-only and consumer-grade tiers do not count. The tracked feature is enterprise IdP capability. Where the IdP prices per MAU (Auth0, Stytch, AWS Cognito, Frontegg, Clerk Pro) rather than per seat, we show the flat-rate floor and flag that per-user comparison requires assumptions about traffic.

Quote-only vendors and tiers

We never infer a per-user rate for a vendor or tier marked quote only. IBM Verify is quote only at every tier. Several other vendors (Frontegg, JumpCloud Platform Prime, Auth0 Enterprise, Ping Premium, Okta Professional / Enterprise) are quote only at the top tier. The site lists each with a link to the vendor's contact path on the quote-only vendors page.

Annual minimums

Several IdPs have annual minimums that materially change the buying decision:
  • Okta: $1,500/yr across all tiers. Prices out teams below about 21 seats.
  • Ping: 5,000-user contractual minimum on Essential = $180,000/yr floor. Effectively enterprise only.
  • Auth0: B2B Essentials floor at $150/mo (about $1,800/yr). Professional at $800/mo.
  • Authentik Enterprise Plus: from $20,000/yr.
  • Clerk: Pro is $25/mo flat; SAML SSO via the $100/mo Enhanced Authentication add-on.
  • Descope: Pro is $249/mo flat.
The TCO calculator on the home page factors these in. Below-minimum projections trigger a "min-floor" flag on the result row.

The M365 bundle math

Microsoft Entra ID is included in Microsoft 365 E3 (P1) and E5 (P2). For any organisation already on those M365 tiers, the marginal cost of using Microsoft as the IdP is $0. They are already paying. The calculator's "Already on M365 E3" toggle reflects this. We treat this as the single most under-recognised insight on the IdP cost side.

Self-host vs SaaS

Authentik Community, Keycloak, and FusionAuth Community are open source and free to self-host. The real cost is operational. Hosting infrastructure (typically $200-400/mo on Hetzner / Linode / AWS for a redundant setup) plus admin time. Below about 30 internal seats, self-hosted Community is usually the cheapest credible IdP. Above that, the operational burden typically justifies a commercial alternative. The calculator models a $3,600 to $4,800/yr ops cost for self-host depending on vendor.

Feature matrix accuracy

Twelve features tracked across the cohort. Support is recorded at the IdP's top tier, not the starter tier. The per-IdP pages list which features kick in at which tier. We re-check feature support at each quarterly pass. Vendor docs do shift over time (OneLogin added WebAuthn / passkey support in 2025 - we caught this in the most recent pass).

No fabricated benchmarks

We never publish "industry average", "typical", or "based on observation" without a named published reference. Where we cite analyst data (Gartner Magic Quadrant, Forrester Wave, IDC MarketScape) we name the report and report year. Where a claim cannot be sourced, we mark it as an estimate or remove it.

Re-verification cadence

Every IdP is re-checked at least quarterly. Material vendor repricing events trigger off-cycle updates within seven days. Pre-deploy CI gate refuses to publish if any row is more than 90 days stale.

Twin site coordination

ssopricing.com tracks the SaaS-vendor side of the SSO procurement decision (what each SaaS charges to integrate with your IdP). The two sites publish coordinated re-verification dates. When one finds material IdP pricing changes, the other updates its IdP cost matrix in the same pass. Same independence rules apply to both: no affiliate revenue on any IdP or SSO vendor.

Conflicts of interest

idppricing.com is published by Digital Signet. Digital Signet does not sell identity, SSO infrastructure, or access management services. We do not accept sponsored placements that influence pricing claims or methodology. The advertiser exclusion list specifically forbids IdP and access-management ads on this property.

Full source list

Every vendor source URL with its verification date and status is maintained at /sources/. The same data underpins the per-vendor pages and the homepage calculator.

Updates and corrections

If you spot a stale tier price, broken source URL, or a feature support claim that does not match the vendor's docs, email hello@digitalsignet.com with the source URL. Updates land within seven days.

Last verified June 2026.