What does JumpCloud cost compared with self-hosted authentik?
Self-hosting authentik removes the per-user JumpCloud subscription, but it replaces that line item with servers, PostgreSQL, a one-time migration and ongoing operations. Whether that trade pays off depends on your user count, the authentik edition you choose and whether your team can run the platform without outside help. JumpCloud's list prices were not part of the information available for this page, so start by pulling your own figures from your order form and renewal notice: the per-user rate for each product you license, whether billing is monthly or annual, the package or a la carte mix, and any fees for users who are suspended but still counted. Those fields decide the baseline you compare against.
On the self-hosted side, separate the components so each one has an owner and a number. The authentik free edition is MIT licensed for most of the code and has no license fee, but its support is community only. The Enterprise edition is priced per user per month, billed annually, plus a small charge per external user, and the pricing page lists it as the route to Google Workspace and Microsoft Entra ID integrations, privileged access management and ticket-based support. Enterprise Plus is a separate, higher-priced tier with SLAs and FIPS compliance. Infrastructure is the second component: authentik's architecture runs a server container, a worker container and PostgreSQL, and the Docker Compose guide points to at least 2 CPU cores and 2 GB of RAM for small production setups. Ask your team or implementation partner to size the production topology, backups and high availability against your own requirements.
Ask for quotes that break out migration and operations separately from licenses. Migration effort depends on how many LDAP clients, RADIUS devices and SSO applications must be repointed, and on how many MFA enrollments must be rebuilt, since exports from JumpCloud may not carry credentials. Operations cover patching, upgrades, backups and on-call support, and these recur for as long as you run the platform. Compare the per-year total of your current JumpCloud spend with the per-year total of licenses, infrastructure and staff time, and run the calculation for your real user count and a plausible Enterprise tier. Confirm the figures with the vendor and your own finance team rather than relying on any general estimate.
Which cost components change when you move from JumpCloud to authentik
This table compares each cost component on the JumpCloud side with the self-hosted authentik side and marks whether it is one-time or recurring. Use it to build a like-for-like model from your own user counts and quotes, not from a generic total. The main takeaway is that authentik's open-source core has no license fee, so most of the difference sits in Enterprise licensing, infrastructure, and the people who run and migrate the system.
| Cost component | JumpCloud side | Self-hosted authentik side | One-time or recurring |
|---|---|---|---|
| Subscription or license | Per-user or package fee for the products you use, billed monthly or annually | Open-source core carries no license fee; Enterprise is priced per user per month billed annually, plus a per-external-user charge | Recurring |
| Billing scope | Confirm whether suspended users and inactive accounts are still billed | Confirm how Enterprise counts users and external users in your contract | Recurring |
| Infrastructure | None on your side for the cloud directory itself | Server host for the server and worker containers, sized to your user count and load | Recurring |
| PostgreSQL | None on your side | Database hosting, backups and storage, since PostgreSQL holds all configuration and data except uploaded files | Recurring |
| Implementation | Little or none for the existing directory | Design, deployment, configuration and hardening, quoted from a written scope | One-time |
| Migration | Export users and rebuild groups, then repoint LDAP, RADIUS and SSO integrations | Re-federate apps, re-enroll MFA, repoint devices and run the cutover window | One-time |
| Support and upgrades | Vendor support included in the subscription tier you buy | Community support on the free edition; ticket support and SLAs only with Enterprise tiers | Recurring |
| Internal skills and operations | Admin Portal administration by your IT team | Staff time for patching, backups, monitoring and upgrades, or a retainer for these tasks | Recurring |
What authentik's editions add to the bill
authentik comes in three editions, and only one of them carries a per-user price. The Open Source edition is free and its support is the community Discord server. Enterprise is listed at $5 per user per month billed annually, plus $0.02 per external user per month, according to the authentik pricing page. Enterprise Plus starts at $20k annually and adds dedicated support with SLAs, multi-instance deployment support and FIPS compliance for FedRAMP requirements. The core code is MIT licensed, so the Open Source edition is a real option for a self-run deployment, but the cost comparison with JumpCloud depends on which of the features below you need in production.
The Enterprise-only features that matter most for a JumpCloud replacement are the Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history, enhanced audit logging and ticket-based support for subscriptions over $1k. Before you price anything, list which of these your JumpCloud packages cover today. Check the SSO connectors you use for Google Workspace or Entra ID, whether any device or application depends on client certificates, whether you rely on password history rules, and what audit trail your compliance team expects. Pull this list from your current contract and admin console, not from memory, because bundles and add-ons change.
Each Enterprise feature you need moves a cost line from zero to a recurring subscription, so the decision is a per-feature check rather than a single edition choice. Ask the authentik sales team to confirm in writing which features are included at each tier, how the per-user and external-user counts are measured, and whether the subscription terms cover your user count and billing cycle. Keep the Open Source edition in the model as the baseline. Then add each Enterprise item only where a documented requirement needs it, and record that requirement so the reason for paying survives the next renewal.
What moves the cost up or down
Most of the self-hosted cost is set by a handful of inputs: who needs an account, which edition you license, how many systems must be repointed, and how much resilience you build. Use these drivers to shape the written scope and to check any quote you receive against your own numbers.
Total and active user count
Licensing for authentik Enterprise is quoted per user, and the pricing page also charges a separate per-user rate for external users. Count everyone who needs a login, then separate employees from contractors, partners and customers. Suspended and dormant accounts should be removed or disabled before you count, because a directory that keeps them can inflate the license basis. Ask the vendor how each user category is counted and whether suspended accounts are billed. Cost rises with headcount, while the server footprint changes far less.
Edition and support level
The open source core is free but offers community support only. Enterprise adds features such as Microsoft Entra ID and Google Workspace integrations, privileged access management and ticket-based support, and Enterprise Plus adds SLAs and FIPS compliance. Decide which of those features you actually need before you sign. A regulated buyer that needs a contractual response time pays for a higher tier, while a team with in-house operators may only need the free edition plus a retainer for specialist help.
Applications and LDAP or RADIUS clients
Each SSO application needs a provider and each LDAP bind or RADIUS device needs its endpoint repointed. Migration effort scales with this count more than with user numbers. Inventory every application, appliance, Wi-Fi controller and VPN concentrator that calls JumpCloud, then record the protocol, the bind account and the group filter used. Clients that cannot change their configuration quickly add parallel running time and testing.
Availability and replica needs
A single authentik server and worker on PostgreSQL is simpler to run, but a login outage affects every application at once. Standby nodes, a highly available PostgreSQL cluster and load balancing add hardware, licensing for any managed database and more operator time. Ask what recovery time your business requires for SSO and for network authentication, because RADIUS and LDAP clients often fail harder than browser logins when the directory is down.
Data volume and backup scope
Storage cost depends on user count, event and audit log retention, and how much of the database you back up and test. Restores matter as much as backups. Plan backup frequency for the PostgreSQL database and uploaded files, and include restore tests in the scope. Longer audit retention raises storage and backup cost, so set it against the evidence your assessors expect.
Existing PostgreSQL and Linux skills
Your team's current skills determine whether operations stay in-house or go to a partner. Staff who already run PostgreSQL, Linux, TLS certificates and container platforms carry most of the run cost without new hires. Teams without those skills should price training, a managed database or a retainer. Ask any provider to name who patches the operating system, upgrades PostgreSQL and handles release upgrades, and whether that work is in the fixed scope or the ongoing support.
How to build the comparison with your own numbers
This sequence turns the JumpCloud invoice and the authentik editions into a three-year model that uses your own user counts, server sizing and team hours, so the result reflects your environment rather than a generic estimate.
Export current JumpCloud invoice lines and terms
Finance and the account owner collect every invoice from the last twelve months, the order form or quote, and the billing terms that apply. Record each product or package on its own line, the per-user rate, whether billing is monthly or annual, and any minimum commitment or true-up clause. Ask JumpCloud in writing how suspended users are billed, whether they count toward the seat total, and whether they are charged at the full rate. The step is done when every recurring line on the invoices maps to a contract term and the written answer on suspended users is on file.
Count active, suspended and external users
The directory owner pulls user counts from the JumpCloud Admin Portal and separates active accounts, suspended accounts, service or bind accounts, and external users such as contractors or partners. Compare each count with the seat count JumpCloud bills for each month of the past year, so you can see how many suspended or inactive accounts are being charged. Keep the counts by month, because peaks in headcount drive the seat total under monthly billing. The step is done when you have one table of billable seats per month and a note of which accounts are not in use.
Price the authentik editions from supplied rates
Using the authentik pricing page, build two columns: the Open Source edition, which has no license fee and community support only, and the Enterprise edition, which is billed per user per month when billed annually, plus a separate rate for each external user. Add the Enterprise Plus line only if you need dedicated support with SLAs, multi-instance support or FIPS compliance, and request its current annual figure in writing because it is quoted as a starting amount. Check which Enterprise-only features your use case depends on, such as Google Workspace or Microsoft Entra ID integration, privileged access management or enhanced audit logging. The step is done when each authentik column has a recurring license line and a list of the features that set its tier.
Size servers and PostgreSQL for production
The platform or infrastructure team sizes the hosts for the chosen topology. The authentik architecture uses a server container, a worker container and PostgreSQL, and PostgreSQL stores all configuration and data except uploaded files, so it needs its own sizing, backups and high availability plan. The Docker Compose guide's stated minimum of 2 CPU cores and 2 GB of RAM applies to test and small-scale setups, so use your own load estimates to size production and confirm the figure with authentik before you buy hardware. Price the hosts, storage, load balancer, backup target and the DBA time for PostgreSQL, using your own cloud or data center rates. The step is done when the infrastructure line items add up to a monthly and annual cost for each environment, including staging.
Estimate migration and operations hours internally
Your engineering leads estimate the hours for the migration work, including the export and import of users, re-creating groups, repointing LDAP clients and RADIUS devices, re-federating SSO applications, re-enrolling MFA and testing the cutover. Add recurring operations hours for patching, upgrades, monitoring, on-call and support tickets, and any paid support contract you choose. Use your team's own rates and past project records, and state the assumptions behind each estimate in writing so reviewers can challenge them. If you consider an implementation partner, request a fixed-scope written quote and enter that figure in place of the internal estimate. The step is done when migration and operations hours sit in separate rows, each with a stated rate and an owner.
Model one-time and recurring costs over three years
Finance builds a three-year spreadsheet with one row per cost component and one column per year. Mark each item as one-time, such as migration and initial hardware, or recurring, such as license fees, seats, hosting and operations hours. Run the JumpCloud scenario with the seat count from the billing terms, then run the authentik scenarios for Open Source and Enterprise, each with the same user growth assumption. Include a sensitivity line showing how the result changes if suspended users are billed or if headcount rises. The step is done when the three scenarios produce a total for each year and a cumulative total, and every figure traces to a source document or a named assumption.
Review the model and confirm open items
The CISO or IT lead and procurement review the model together and check each assumption against the written answers from JumpCloud and authentik. Confirm the open items in writing, including suspended-user billing, Enterprise Plus pricing, supported version and security policy terms, and the feature set needed for your use case. Record any figure that remains an estimate so that the decision is made on known inputs. The step is done when the model is signed off, the open items have written answers, and the remaining risks are listed for the decision record.
What migration and ongoing operations cost in effort
The one-time cost of leaving JumpCloud is mostly staff and partner time spent on re-creating the identity model in authentik. Start with the export. Confirm in the JumpCloud Admin Portal which user, group and attribute fields your tenant can export, and check what is left out: password hashes and MFA enrollments are the items you should expect to rebuild rather than copy. Plan to re-create groups and their membership, then repoint each LDAP client and RADIUS device to an authentik outpost, since those endpoints hold bind accounts and shared secrets that must be changed on the device side. Each SSO application needs its provider and redirect settings re-created in authentik, and every user will re-enroll MFA. Because these steps touch devices that keep authenticating, the cutover sequence itself is a major effort driver. Ask any implementer for a written inventory of applications, LDAP clients and RADIUS devices before agreeing a fixed scope.
The recurring cost is operations, and it is mostly labor. authentik publishes its supported release lines in the security policy, and at the time of research those were the 2026.5.x and 2026.8.x lines. Someone must track those lines, schedule upgrades within them and test each one against your applications. The project announces security releases at least 24 hours in advance, so the monitoring process must be able to act on short notice, which is an on-call question for your team rather than a vendor promise. Backups of the PostgreSQL database are the other standing task, because authentik keeps configuration and data there apart from uploaded files. Confirm the restore procedure as well as the backup schedule.
Capacity is the third recurring item. authentik's 2025.10 release notes say it no longer uses Redis and moves caching, tasks and sessions into PostgreSQL, with roughly 50% more PostgreSQL connections after upgrading. Someone must watch connection counts and database load after every upgrade, and size the server and worker containers for your login volume. Ask any quote to state who owns each of these tasks after go-live: your platform team, a retained support agreement, or both. DeployOpen offers ongoing support and upgrades as retainers, and the scope of those retainers would be written out before work starts.
Questions buyers ask before comparing JumpCloud and authentik costs
How does authentik's cost compare with JumpCloud per user?
authentik's open-source edition has no license fee, so the recurring cost is the servers, PostgreSQL, operations time and any Enterprise subscription. JumpCloud charges per user, by package or per product, and DeployOpen does not hold JumpCloud's prices, so confirm your current per-user rate, billing term and included products in your order form. The authentik Enterprise edition is listed at $5 per user per month billed annually, plus $0.02 per external user per month. As an illustrative calculation only, 200 internal users at that list rate would be $1,000 per month, or $12,000 per year, before any server or staff costs. Ask both vendors for a written quote that separates license, support and add-on modules.
Does JumpCloud keep billing suspended users?
Whether suspended users are billed depends on your contract, so confirm it in writing before you renew. Ask JumpCloud whether suspended or deactivated accounts count toward the billable total, when the count is taken, and whether removals made mid-term reduce the next invoice. The answer changes the cost of a migration, because accounts you keep as inactive during cutover may still be billed. On the authentik side, Enterprise pricing is listed per user, so confirm how the subscription counts disabled or service accounts before you size it. Keep a list of which accounts are active, suspended and service-only, since that list drives both the quote and the cutover plan.
How long does a JumpCloud to authentik migration take?
No reliable duration can be given from the information available, so treat any single figure as unverified. The main drivers are the number of SSO applications to re-federate, the LDAP clients and RADIUS devices that must be repointed, how many users must re-enroll MFA, and how many cutover waves your change process allows. DeployOpen plans most engagements as fixed scope, with scope, deliverables and timelines agreed in writing before work starts, so the timeline follows from an inventory of your applications and devices. Ask any provider, including DeployOpen, to base the schedule on that inventory and to show which steps depend on your change windows.
What does a self-hosted authentik deployment need from our team?
Your team needs identity administration skills, someone to run PostgreSQL, someone to operate the container hosts, and an application owner for each integration. The authentik architecture uses a server container, a worker container and PostgreSQL, which stores all configuration and data except uploaded files. The Docker Compose guide positions Compose for test setups and small production, with at least 2 CPU cores and 2 GB of RAM as the stated minimum host, so plan larger hosts and high availability for production. Note that the 2025.10 release removed Redis and moved its functions to PostgreSQL, and the release notes warn of roughly 50% more PostgreSQL connections after upgrading. Give your database administrators that warning before you size connection limits.
Can our own team run authentik without outside help?
A team with identity and container operations experience can run authentik, but the free edition comes with community support only, through the project's Discord. Support and security commitments differ by tier: authentik's security policy lists 2026.5.x and 2026.8.x as the supported versions receiving security fixes, and the project announces security releases at least 24 hours in advance. Enterprise adds ticket-based support for subscriptions over $1k, and Enterprise Plus adds dedicated support with SLAs. Outside help is most useful for the initial design, the migration waves, hardening and backup testing, and for ongoing upgrades. DeployOpen offers these as fixed-scope projects or retainers, with pricing set from a written scope rather than a published list.
What does authentik Enterprise cost cover, and when is it worth paying for?
authentik Enterprise is a per-user subscription that adds features the free edition does not include. Its listed additions are Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history, enhanced audit logging and ticket-based support. Enterprise Plus, listed from $20k annually, adds dedicated support with SLAs, multi-instance deployment support and FIPS compliance for FedRAMP requirements. Pay for Enterprise when you need one of these features, such as audit logging for an assessment or a directory integration you cannot build yourself. The subscription does not replace the work of operating PostgreSQL, the servers or your own integrations, so add those costs to the comparison. Confirm the current terms on the authentik pricing page and with the vendor.
How DeployOpen scopes a fixed-price implementation
DeployOpen is a Chainscore Labs company that plans, implements, hardens, backs up and documents self-hosted open-source platforms inside your own infrastructure. For a JumpCloud cost comparison, we start by agreeing in writing what your current JumpCloud spend covers, which users and products are in play, and what authentik edition and hosting model you need.
How we scope
- We inventory active, suspended and inactive users, plus the JumpCloud products each one is billed under today.
- We list the protocols in use (SSO, LDAP, RADIUS, device management) so the written scope names exactly what authentik must replace.
- We agree in writing whether the authentik open source or Enterprise edition fits the features your team needs.
How we build
- We size the authentik server, worker and PostgreSQL components for your user count and hosting environment in your own cloud or data center.
- We configure SSO federation, LDAP and RADIUS outposts and MFA policies, then test each connected application against the written scope.
- We document the cost model, including server, database, licensing and staff effort, so your team can check it against a vendor quote.
How we hand over
- We deliver runbooks for installation, upgrades, PostgreSQL backups and restores, and outpost configuration.
- We walk your administrators through the admin console, user lifecycle tasks and the support path for each component.
- We provide the cutover plan and the list of tested applications so you can decide when JumpCloud billing can end.
How we support
- Engagements are fixed-scope, and scope, deliverables and timelines are agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer that covers the authentik platform after handover.
- We do not publish a price list. A quote follows from the written scope, so ask us for the scope document before comparing it with a renewal.
