Cisco Duo cost vs self-hosted privacyIDEA: where the money actually moves
privacyIDEA has no license fee for its AGPLv3 core, so a Duo renewal or per-user price change does not translate into a like-for-like line item on the open-source side. The comparison turns on servers and high availability, SMS volume, hardware tokens, implementation work and help desk effort, plus an optional NetKnights Enterprise Edition subscription if you want one. Check Duo's per-user editions against Cisco's current published pricing before you build the model, since this page does not quote Duo prices and those figures change. Ask Cisco for the edition that matches your features, not only the headline per-user rate. Self-hosting usually moves cost from a recurring vendor fee to recurring internal and infrastructure effort. Your servers, database, load balancing and backups become your line items, and someone on your team owns patching and upgrades. The balance depends on user count, how many factors you issue, and whether your existing platform team already runs comparable services. SMS is the cost most likely to grow with headcount and travel, because each message is billed by your SMS provider, so ask for the per-message rates in the countries where your users sit and estimate volume from your own authentication logs. Hardware tokens and enrollment are where self-managed MFA costs tend to surprise buyers. privacyIDEA can import seed files in several formats, which may reduce purchase and re-issue work for existing tokens, but someone must run the import and keep the seed files protected. Model the help desk separately: lost devices, re-enrollment after a phone change and lockouts recur for as long as the service runs. Confirm with your own environment how many tickets per month you expect and who answers them, and ask your implementation partner to write that effort into a fixed-scope quote.
Which cost components sit on each side
This table sets each Duo cost component against its self-hosted privacyIDEA equivalent and marks whether it is one-time or recurring. Read it as a checklist for a quote: confirm each commercial line with Cisco and each self-hosted line with your own infrastructure and staff. The main takeaway is that privacyIDEA removes the per-user license fee but moves hosting, high availability, upgrades and help desk work onto your team or a partner.
| Cost component | Commercial side (Cisco Duo) | Self-hosted side (privacyIDEA) | One-time or recurring |
|---|---|---|---|
| Subscription or license | Per-user edition fees paid to Cisco under the chosen Duo edition, plus any add-on features in that edition | No license fee for the AGPLv3 software; cost is limited to hosting and staff | Duo: recurring. privacyIDEA: none for the software |
| Infrastructure (servers and HA) | Little or none for the cloud service; Duo Authentication Proxy runs on your servers and needs outbound access | Application servers, a database, load balancing and a second site for high availability, sized to user count and login volume | Recurring (hardware refresh or cloud compute) |
| SMS and messaging | SMS and voice usage billed by Cisco according to your contract and destination countries | SMS and email delivery through your own gateway or carrier, billed per message by that provider | Recurring, usage-based on both sides |
| Hardware tokens | Hardware tokens purchased from Cisco where offered under your contract | Hardware tokens bought from the vendor of your choice; existing seed files can be imported in OATH CSV, Yubikey CSV, SafeNet XML or PSKC formats | One-time unit cost, plus replacement stock over time |
| Implementation and migration | Vendor or partner onboarding, proxy deployment and user enrollment, depending on your agreement | Installation (pip or Ubuntu, CentOS or RHEL-family packages), resolver setup, token import, testing and cutover, delivered by staff or an implementation partner | One-time, fixed scope recommended |
| Enterprise Edition subscription (optional) | Not applicable; Duo's paid editions are the commercial equivalent | Optional support and enterprise features from NetKnights, the company behind the privacyIDEA Enterprise Edition; ask for the current price and scope in writing | Recurring, if chosen |
| Support, upgrades and patching | Included in the Duo subscription according to your edition and support terms | Community support, or a paid subscription; your team or a partner applies upgrades such as the v3.14 release line and tests them | Recurring labor |
| Internal skills and help desk | Duo admin portal and enrollment flows that Cisco maintains; help desk handles lockouts and new devices | Staff who run Linux, LDAP and RADIUS and handle self-managed enrollment, lost-device resets and token re-issue | Recurring, the largest variable on the self-hosted side |
What moves the comparison most
Six inputs decide whether a self-hosted privacyIDEA deployment costs less than Duo over the same period. Each one shifts cost between licenses, servers, staff time and help desk work, so size them before comparing totals.
User count and growth
Your licensed user count sets the Duo bill, but on privacyIDEA it mainly sets server capacity, database sizing and the number of tokens to manage. Growth matters because a per-user price scales with headcount, while a self-hosted cost scales in steps as you add nodes. Ask Duo for the edition price per user at your current and projected headcount, and model both curves over the contract term.
SMS and push usage by factor mix
SMS is the factor that carries a recurring per-message cost on any platform, and it is often the largest variable line in a self-hosted model. Push works through the privacyIDEA Authenticator app, so its cost sits in app distribution and support rather than messaging. Pull a month of Duo authentication logs and count factors per user to see how much traffic would still need an SMS carrier.
Hardware token population and seed import
Hardware tokens are a one-time cost on the Duo side and a recurring cost if you replace them, so the population you already own matters more than the price of new keys. privacyIDEA can import seed files in several formats, but each batch needs a check that seeds decrypt and map to the right users. Count your tokens, confirm which vendor formats your inventory uses, and budget the import and verification effort.
Availability requirements that drive HA sizing
The cost of high availability is the largest self-hosted item after staff time: two or more application nodes, a highly available database and a load balancer, each with monitoring and patching. Duo's cloud availability is part of the subscription, so the comparison depends on the uptime your login flows require. Define the outage you can accept for VPN, Windows logon and admin access, then size the cluster to that target.
Number of integrations
Each protected system adds configuration and testing: RADIUS for VPNs and network devices, the PAM module for Linux, the Windows credential provider, Keycloak and any web application calling the REST API. Duo's proxy and integrations are bundled into the subscription, while each integration on privacyIDEA is work you own. List every system that currently calls Duo, mark its protocol, and estimate the change and test effort for each.
Internal skill level for Python services
privacyIDEA is a Python-based service, installed with pip or on supported Linux distributions, so someone on your team must patch the application, the Python runtime and the web tier. Where that skill exists, the work is routine maintenance. Where it does not, you will pay for training, a partner retainer or a Enterprise Edition subscription from NetKnights, which adds vendor support to the total. Assess who will own the service before you set the budget.
How to build the comparison with your own numbers
This sequence turns Duo's written quote and your own usage history into a like-for-like three-year model against self-hosted privacyIDEA. Each step produces a figure you can defend in a budget review.
Export the user, phone and token inventory
The Duo administrator exports the current user list, enrolled phones, hardware tokens and integrations, using the method described on the Duo export page. Record the total number of enrolled users, how many use Duo Mobile push, how many use SMS or phone call, and how many hold hardware tokens. Done means you have a dated inventory file that a second person can reproduce from the Duo console or Admin API.
Count SMS and hardware token use
From the authentication logs and the inventory, count how many logins in a typical month used SMS, voice call or hardware tokens. SMS and voice charges usually follow message volume and destination country, so ask Cisco how these are billed under your contract. Hardware token lines should show the device count, the replacement rate and who buys the replacements. Done means you have monthly factor volumes for each channel.
List every integration Duo protects
Work with network, server and application owners to list each system that asks for a Duo second factor. Include VPN concentrators, RADIUS and LDAP clients, Windows logon and RDP, Linux SSH, and web SSO applications. Mark which ones are reached through the Duo Authentication Proxy, because that proxy runs on servers you must size and maintain. Done means each integration has an owner, a protocol and a hosting location.
Price Duo editions from the written Cisco quote
Ask your Cisco or reseller contact for a written quote that matches the user count, edition, add-ons and term from step one. Compare it with Duo's published per-user editions only to confirm the edition names and inclusions, not to set your price. Record the annual subscription, any support fees and any charges for SMS or hardware tokens. Done means you have one signed or dated quote figure per year of the model.
Cost servers and high availability for your environment
Your infrastructure or platform team prices the virtual or physical servers, load balancing, database, backups and monitoring needed to run privacyIDEA with redundancy in your own data center or cloud account. Include the cost of the second site or node if you need failover, and the staff time for patching and upgrades. Confirm the supported operating systems and installation paths in the privacyIDEA installation documentation before you size the hosts. Done means you have an itemized infrastructure estimate with owners for each line.
Add a privacyIDEA Enterprise subscription only if quoted
Only add an NetKnights Enterprise Edition line if you have received a written quote from NetKnights or a partner for the features and support you need. The open-source project is free to download under AGPLv3, so the subscription is an optional cost, not a requirement. Keep this line empty in the base model and show the quoted figure as a separate scenario. Done means the model distinguishes the open-source base case from any quoted subscription.
Estimate help desk tickets from your own history
Pull the last 12 months of service desk tickets tagged with MFA, token, enrollment or lockout, and count how many were raised during past Duo rollouts or device changes. Use those counts as a baseline for each enrollment wave, and multiply by your internal handling cost per ticket. Note that self-managed enrollment moves this work from Cisco to your own service desk. Done means you have a ticket-per-wave figure based on your data rather than an assumed number.
Model three years with one-time and recurring lines separated
Build a spreadsheet with one-time lines for implementation services, hardware tokens purchased once, migration work and training. Put recurring lines for Duo subscription or privacyIDEA support, infrastructure, SMS or voice volume, hardware token replacements and staff time for operations. Show the Duo scenario and the self-hosted scenario side by side across three years, with the assumptions named. Done means a reviewer can change one input, such as user count, and see the totals move.
Self-hosted cost lines teams underestimate
Where users and applications can reach the network without restriction, the main comparison is between Duo's per-user editions and the cost of running privacyIDEA on your own servers. The recurring costs sit mostly in infrastructure, database administration, patching and the people who run the service. Duo's per-user pricing covers the cloud service and the proxy you deploy, but your team still operates the integrations on its side.
- Servers and operating system: Plan for at least one application server and a database, plus the time to patch both on your normal cycle.
- SMS and phone delivery: If you keep SMS as a factor, each message is billed by your SMS provider, so the volume of logins drives this line.
- Implementation effort: Connecting LDAP or Active Directory, RADIUS clients, the Windows credential provider and Linux PAM is one-time work that a partner or your own staff must budget for.
- Help desk work: Enrollment, lost devices and token resets are recurring and often larger than the software line.
- Monitoring and backups: Alerting on the MFA service and tested restores are ongoing duties that Duo's cloud handles for you.
Ask any implementation partner to list each of these lines separately in the written scope, with who performs each task and how often it recurs.
Networks that cannot reach Duo's cloud change the comparison, because the Duo Authentication Proxy needs outbound access to Duo's service and cannot serve isolated networks. In these sites the realistic choice is an on-premises MFA service, and the cost question becomes what it takes to keep that service supported inside the boundary, including how tokens are issued and how updates arrive.
- Hardware tokens and smartcards: Physical OTP tokens, FIDO2 keys and PIV cards are typically a larger one-time purchase than software factors, and their lifecycle needs its own budget.
- Seed imports: Moving existing hardware token seeds requires the import formats privacyIDEA supports, and the work to verify them is a one-time task.
- Update and patch channel: Packages and dependencies must be staged inside the network, which adds staff time for each release.
- Key and secret management: Keeping encryption keys and service credentials under local control is an ongoing operational duty.
- Support scope: Confirm whether your support arrangement covers offline installation and updates.
Confirm with privacyIDEA and NetKnights which installation and update paths they support for your network before estimating the internal effort.
High availability means running at least two nodes behind a load balancer and designing the database as a shared, resilient component rather than a single server. Multi-site deployments add replication, latency and failover testing. Each of these carries engineering cost that a single-node pilot does not reveal, and that cost recurs with every change to the environment.
- Second node and load balancing: A second application node, a load balancer and health checks are needed so one failure does not stop logins.
- Shared database design: The database must be highly available and backed up, which often means a separate database platform with its own licensing or support contract.
- Replication across sites: Keeping token and user state consistent between sites adds design, testing and monitoring work.
- Failover testing: Regular, documented failover drills are an internal labor cost that must be scheduled and repeated.
- Limits and sizing: The number of users and logins one node can handle depends on configuration, so ask for the supported limits in writing.
Before committing to a design, ask privacyIDEA and NetKnights to confirm the supported clustering topology and the sizing limits for your user count.
What a migration to privacyIDEA costs in effort
Most of the migration effort is one-time work, and it falls on your identity, network and help desk teams rather than on a license line. The first task is inventory: export users and enrolled devices from Duo, then decide which people resolve from Active Directory or LDAP through privacyIDEA's user ID resolvers and which need local accounts. Hardware tokens are the most detailed part. privacyIDEA imports seed files in SafeNet XML, OATH CSV, Yubikey CSV and PSKC formats, and can import GPG-encrypted seed files with its own key, so someone must confirm which format each token batch came from and test a sample token before the full load. Confirm the export formats your Duo tenant can produce with your vendor and plan the seed handling under your key management policy.
Enrollment is the work that recurs in practice, because users must register again. Standard TOTP and HOTP users can usually keep the authenticator app they already use, so their effort is limited to adding the token in privacyIDEA. Push notifications need the privacyIDEA Authenticator app, so every Duo Mobile user must install it and enroll, and the help desk should plan for a surge of identity checks, lost phones and reset requests in the first weeks. Estimate that load from your own user count and enrollment window, not from a generic figure. Running Duo and privacyIDEA in parallel for a defined period, with a rollback path for each application, is the main control against lockout. Your internal staff or your implementation partner will also own the cost of testing each integration, such as RADIUS for VPNs and the Windows or Linux modules.
Ask any implementation partner for a fixed-scope written quote that lists the number of users and tokens in scope, each token format, the resolvers to configure, each integration to test, the parallel-run period and the help desk support you expect. Ask who owns the enrollment campaign and the post-cutover support window, and whether those costs are one-time or ongoing. Confirm privacyIDEA version support and release timing against the privacyIDEA GitHub releases page before the plan is final, since your upgrade cadence will drive later maintenance effort.
Questions buyers ask before comparing Duo with privacyIDEA
Is privacyIDEA free to use?
Yes, the open-source privacyIDEA project is licensed under AGPLv3, and its README describes it as a self-hosted MFA platform that keeps user data inside your infrastructure. The license cost is zero, but the total cost includes the servers you run it on, high availability design, SMS or email delivery charges if you use those factors, hardware tokens, and the staff time to install, operate, patch and back it up. Ask any vendor or partner to separate these components in a quote so you can compare them with Duo's per-user editions line by line. Confirm current licensing terms in the project repository before you rely on them in a procurement file.
Does the NetKnights Enterprise Edition cost extra and when is it needed?
The privacyIDEA Enterprise Edition is offered by NetKnights as a subscription, and it is optional. The project states that it is available from NetKnights, so the question is whether your requirements call for vendor support, enterprise features or a contractual service level that the community edition does not give you. Ask NetKnights for the current price and the feature and support list for the edition you need, and compare that with the internal staff time you would otherwise spend on troubleshooting. If your security team requires a named vendor for escalations, the subscription is usually part of that decision rather than a technical requirement.
How much internal effort does self-managed enrollment take?
Effort depends mainly on how many users must enroll, which factors they use, and how many of them lose or replace a device. Standard TOTP and HOTP users can keep apps such as Google Authenticator, while push notifications need the privacyIDEA Authenticator app, so a mixed factor policy means more user communication and more help desk tickets. Hardware tokens add a seed import step and a distribution and recovery process. Budget help desk time for enrollment waves, lost device resets, and identity verification before a reset, and ask your implementation partner to write these procedures into the scope so they are agreed before work starts.
How long does a migration take and does it need outside help?
The timeline depends on the number of users and applications, the number of identity stores to connect, how many hardware tokens must be imported, and how much enrollment coordination is needed. Duo's Admin API and the privacyIDEA import formats determine how much of the inventory can be automated. Most engagements that involve a partner are fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts. Ask for a written plan that covers a parallel run period, the cutover order for VPN, Windows and web flows, and the rollback steps.
Can our team do this without a partner?
Yes, a capable team can install and operate privacyIDEA using its installation documentation for pip and for Ubuntu and CentOS or RHEL-family systems. The questions to answer honestly are whether you have people who can run an MFA service with high availability, handle RADIUS and PAM integrations, manage token imports, and run an enrollment campaign alongside daily operations. Partial help is a common choice, for example a fixed-scope review of your design, a hardened build or a cutover runbook, while your team keeps day-to-day operation.
What does a quote from DeployOpen depend on?
A DeployOpen quote follows from the written scope, because DeployOpen does not publish a price list. The scope usually covers the number of users and factors, the identity stores and applications to connect, the VPN, Windows and Linux integrations, hardware token import, high availability design, backup and restore, documentation and handover, and any ongoing support or testing retainer. Ask for each item to be listed as a deliverable with an owner, and ask which parts are one-time work and which recur as a retainer.
How DeployOpen scopes a fixed-price privacyIDEA implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For a Duo replacement, that means agreeing in writing which users, factors and integrations move to privacyIDEA before any work starts, and testing the result before cutover.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope lists which Duo applications, RADIUS clients, Windows and Linux logons, and user directories are in or out.
- We confirm your server, high availability and token inventory needs, and which factors each user group must keep.
How we build
- We install and configure privacyIDEA in your cloud accounts, data centers or air-gapped network, with your chosen database and servers.
- We connect user ID resolvers to your existing LDAP or Active Directory and test each factor against real enrollment flows.
- We integrate RADIUS, PAM, Windows credential provider and Keycloak connections named in the scope, then test failure behavior.
How we hand over
- You receive configuration, runbooks, enrollment instructions and help desk procedures written for your environment.
- We document backup and restore steps, hardware token import records and the evidence your internal and external assessors may ask for.
- Testing results and open items are delivered with the system, so your team knows exactly what was verified and what remains.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped separately from the implementation.
- Retainers can cover privacyIDEA version upgrades, such as moving between releases, after we test them in a staging environment.
- Ask any quote to separate one-time implementation fees from recurring retainer and infrastructure costs you will carry.
