The enterprise landscape
At 1,000+ seats every list price is negotiable. Published per-user rates are an opening position rather than a real cost. Multi-year commitments, bundled product purchases (Okta Workforce + Auth0 + Identity Governance), and tier-up commitments typically yield 15 to 35 percent discounts.
Vendors that compete here
Okta (Workforce + governance), Microsoft Entra ID (Suite + Identity Governance), Ping Identity (PingOne + PingFederate hybrid), IBM Verify (quote only), and SailPoint / Saviynt for governance overlay. Self-host Keycloak appears in regulated industries where data residency or air gap is mandatory.
The second invoice
Implementation cost at enterprise scale typically exceeds first-year licence cost. Multi-month systems integrator engagements, custom federation work, identity store migrations, and training together routinely run six to seven figures. See the implementation cost page.
Worked example
Acme Enterprise Holdings Co. (illustrative example, not a real company), 8,000 seats, on Microsoft 365 E5: Entra ID P2 is included. ID Governance Suite upgrade adds $3 to $7/user/mo depending on bundle. Okta Workforce at list (Essentials $17/user/mo) = $1.63M/yr; negotiated typically 20 to 30 percent below list. Ping Plus at $6/user/mo with negotiated discounting often lands around $400,000 to $600,000/yr including PingFederate. IBM Verify is quote only; expect a similar range.
Last verified June 2026.