Why pricing pages omit this
Published per-user rates cover the licence only. The second invoice (implementation, migration, training, change management) is rarely smaller than the first and at enterprise scale frequently exceeds three years of licence cost. It comes from systems integrators, vendor professional services, and internal engineering time.
Implementation cost components
- Discovery and design. Application inventory, identity-store mapping, target-state architecture. Typically 4 to 12 weeks of consulting.
- Identity store migration. Moving users, groups, and entitlements from the current source (Active Directory, legacy LDAP, spreadsheet). Migration tooling cost plus engineering hours.
- Application integration. SAML and SCIM configuration per application. Vendor integration catalogue covers the common cases; custom apps require connector engineering.
- Federation and B2B setup. Trust establishment with partner organisations. Each federated relationship is a multi-hour configuration plus governance review.
- MFA rollout. Enrolment campaign, helpdesk training, fallback policy. Plan for a meaningful support volume spike during the cutover window.
- Change management. User communications, training, documentation. Often the most underestimated line item.
Order-of-magnitude budgets
- SMB (under 100 seats): Self-service or single-consultant engagement. $5,000 to $25,000 typical.
- Mid-market (100 to 1,000 seats): Vendor professional services or boutique SI. $30,000 to $150,000 typical.
- Enterprise (1,000+ seats): Large SI engagement spanning 6 to 18 months. $250,000 to seven figures.
These ranges reflect the spread of engagements we have seen, not a benchmarked dataset. They are directional only. Actual cost depends on application count, custom integration depth, and migration complexity.
Last verified June 2026.