Honest 7-way comparison of Enterprise IAM Vendors — Pricing, TCO, and Per-Seat Economics (Okta · Auth0 · OneLogin · Ping · Microsoft Entra · JumpCloud · Saviynt) platforms. No vendor sponsorship. Calling Matrix by buyer persona below — operator's siren-based read on which one to pick when you're forced to pick.
Honest read on positioning, ideal customer, and where each one is the wrong call. No vendor sponsorship, no affiliate links — operator-grade signal.
Enterprise per-seat tiered pricing — the default IAM line item on the CFO's spreadsheet. Tiered SKUs (SSO · Adaptive MFA · Lifecycle Management · Identity Governance) stacked on top of each other. List pricing is published but real deals are negotiated; expect $6-15/user/mo for SSO+MFA, climbing fast as you add Lifecycle and Governance.
Separate per-MAU pricing model — built for customer identity, not workforce. Free tier covers small dev projects, then ramps by Monthly Active Users + feature tier (B2C Essentials → Professional → Enterprise). Workforce SSO exists but Okta Workforce Identity is the sibling product — Auth0 is the CIAM rail.
Per-seat enterprise pricing with simplified tiers — the leaner alternative to Okta. Advertised list pricing typically lower than Okta at equivalent SKU. Tiers: Starter / Advanced / Professional, with SSO + MFA + Directory included earlier in the stack.
Custom pricing typical — quote-driven enterprise sales motion, no public per-seat list. Modular product stack (PingOne · PingFederate · PingAccess · PingID · PingDirectory) sold à la carte or bundled. Strong in regulated verticals (financial services, healthcare, government).
Bundled with M365 (P1/P2) — effectively 'free' if you already have E3/E5 licenses. Entra ID Free comes with every Azure/M365 tenant. P1 (~$6/user/mo standalone, included in M365 E3) unlocks SSO to non-MS apps + conditional access. P2 (~$9/user/mo standalone, included in E5) adds Identity Protection + PIM. The 'free' framing is real for shops already on E3/E5; standalone it's competitive with Okta.
Per-user pricing with cross-platform device + identity included — the SMB-to-mid-market sweet spot. Single per-user fee bundles SSO + MFA + Directory + MDM (Mac/Windows/Linux device management) + RADIUS. Often replaces 3-4 vendors at 10-20 person shops. Tiered packages around $9-19/user/mo all-in.
Enterprise sales · IGA-tier pricing · the highest-end of this list. Identity Governance & Administration platform — access certifications, segregation of duties, privileged access governance, SOX/SOC 2/HIPAA workflows. Six-figure annual contracts are normal; sold to CISOs and identity governance teams, not IT admins.
Most comparison sites refuse to forced-rank because their revenue depends on staying neutral. SideGuy ranks because it doesn't take vendor money. Here's the call by buyer persona.
Your problem: You're a 20-person startup. You can't afford Okta's enterprise tier. You need SSO + provisioning + MFA without a $50K/yr line item before product-market fit.
Your problem: You're 100-500 employees. You can spend on identity but per-seat math is real. You need an IDP that scales to 500+ apps without per-app fees that explode the bill.
Your problem: You're 500-5,000 employees with 200+ SaaS apps. You need governance (IGA), conditional access, lifecycle automation. The math gets to $150K-500K/yr but ROI is real (license recovery + breach risk reduction).
Your problem: You're 5,000+ employees, multi-BU, regulated industry. You need IGA + PAM + customer IAM in one stack. Cost is secondary to consolidation, audit-defensibility, and 24/7 enterprise support SLA.
These rankings are SideGuy's lived-data + observed-buyer-pattern read as of 2026-05-11. They're directional, not gospel. The right answer for YOUR specific situation may diverge — text PJ for a 10-min operator-honest read on your actual buying context.
Vendor pricing + features + market positioning shift quarterly. SideGuy may earn referral commissions from some of these vendors, but rankings are independent — affiliate relationships never change rank order. Sister doctrines: /open/ live operator dashboard · install packs · operator network.
Partially. Entra ID Free ships with every Azure/M365 tenant and covers basic user/group management + SSO to a handful of pre-integrated Microsoft apps. To get SSO to non-Microsoft SaaS apps, conditional access policies, and group-based licensing you need Entra ID P1 (~$6/user/mo standalone, bundled in M365 E3 and Business Premium). For Identity Protection + Privileged Identity Management you need P2 (~$9/user/mo standalone, bundled in E5). So 'free' is real if you already have E3/E5 — the marginal cost for IAM is near zero. If you only have M365 Business Basic/Standard, Entra is not actually free for the IAM use case.
Per-seat license is usually 40-60% of true IAM TCO. Add: implementation (6-figure SI engagement for Okta/Ping/Saviynt at enterprise scale, or 1-3 months internal time for JumpCloud/Entra), app integration build-out (every SAML/SCIM connection takes hours, sometimes days for legacy apps), ongoing admin time (1 FTE per ~2,000 users is typical), lifecycle workflow design (joiner/mover/leaver automation), MFA hardware tokens for high-assurance users (~$25-75/key), audit/compliance reporting effort, and renewal-cycle re-negotiation. Triple your per-seat list price as a planning multiplier for year-1 TCO.
Three vendors cluster at the low end: JumpCloud (per-user bundles starting around $9-13/user/mo with SSO + MFA + device management included), Microsoft Entra ID (free tier exists; P1 bundled in M365 E3/Business Premium = effectively zero marginal cost if you have those licenses), and OneLogin (Starter tier published as the price-sensitive Okta alternative). For a 20-50 person shop with no existing M365 commitment, JumpCloud usually wins on all-in cost. For shops already on M365 E3/E5, Entra wins because the marginal IAM cost is near zero.
Historically yes — Okta charged per-app for some legacy SKUs and a few competitors followed. As of 2026, most vendors moved to per-seat unlimited apps within a tier. But 'unlimited' has caveats: some integrations are gated to higher tiers (e.g. SCIM provisioning for certain apps requires Lifecycle Management SKU, not basic SSO), and custom SAML connections sometimes count separately from the catalog. Always verify before signing: ask for a written line on (1) is the app catalog truly unlimited at this tier, (2) does SCIM provisioning cost extra per app, (3) are custom SAML/OIDC integrations counted, (4) what happens to the price if you double your app count mid-contract.
10-minute operator-honest read on your actual buying context. No deck, no demo call, no signup. If we're not the right fit, we'll say so.
📱 Text PJ · 858-461-8054I'm almost positive I can help. If I can't, you don't pay.
No signup. No seminar. No bullshit.
Text PJ
858-461-8054