Per-seat tiered (workforce)
Used by Okta, Microsoft Entra, OneLogin, JumpCloud, Duo, Ping, Google Cloud Identity. Each seat with the right to log in counts as a billable user. Tiers gate feature sets (basic SSO, MFA, conditional access, governance). Most workforce IdPs sit at $3 to $9 per user per month at the entry tier.
Per-MAU tiered (CIAM)
Used by Auth0, Stytch, AWS Cognito, Frontegg, Clerk (Pro). A user is billable in any 30-day window during which they authenticate. Free tiers range from 7,500 to 50,000 MAU. Per-MAU rates above free range from $0.015 (AWS Cognito) to $0.10 (Stytch B2C).
Per-connection (B2B SSO)
WorkOS prices SAML and Directory Sync per connection ($125/mo at low volume). One enterprise customer with a SAML integration counts as one connection regardless of user count behind it. This model is favourable for products with high user-per-customer ratios and unfavourable for products with many small customers.
Flat-rate
Descope Pro at $249/mo flat, FusionAuth Cloud Starter at $125/mo, Auth0 B2B Essentials at $150/mo floor. Flat-rate models simplify budgeting but break down at scale; most have per-MAU overages above included caps.
Open source / self-host
Keycloak (Apache 2.0), Authentik Community, FusionAuth Community. Licence is $0. Real cost is operational: hosting infrastructure, database administration, upgrade engineering, incident response. Reasonable budget is $200 to $400 per month in cloud infrastructure plus 0.1 to 0.3 of an engineer's time.
Last verified June 2026.