What does AD FS cost compared with self-hosted Keycloak?
If a Windows Server refresh or a renewal is forcing the question, the short answer is that AD FS cost is driven by Windows Server licensing and the size of your server estate, while Keycloak carries no license fee under the Apache 2.0 license and instead adds recurring infrastructure, database and operations costs. The AD FS side starts with the Windows Server 2025 list prices: the Microsoft pricing page lists a suggested price of 1,176 US dollars for Standard and 6,771 US dollars for Datacenter for 16 core licenses, and notes that prices vary by region. Every AD FS and Web Application Proxy server needs cores licensed, with a minimum of 16 cores per server and 8 per processor, and each user or device that accesses the server needs a Windows Server Client Access License. Microsoft also offers pay-as-you-go licensing through Azure Arc, so compare that model before buying perpetual licenses.
Windows Server 2022 mainstream support ends on October 14, 2026 and extended support on October 15, 2031, and Windows Server 2025 mainstream support ends on November 14, 2029, so a refresh timed to these dates changes which licenses you buy and how long they serve. Treat the list prices as a starting point only. Your own Microsoft reseller or licensing quote, based on your core counts, Client Access License counts and any Software Assurance or volume terms, determines the real AD FS licensing total. Ask for that quote for every farm and proxy server, and add the SQL Server licensing your larger farms need, which is a separate line item.
Keycloak's license cost is zero, but the operating cost is not. Plan for Linux server capacity for the nodes in your cluster, a supported production database such as PostgreSQL 14 to 18 with synchronous replication for high availability, load balancing, certificates, monitoring, and patching. You may also choose a commercial subscription such as the Red Hat build of Keycloak, whose price and support terms you must obtain directly from the vendor. Ask your implementation partner for a written scope that lists each component, who operates it, and which costs recur each year, so you can compare it fairly with the AD FS quote.
Which cost components sit on each side
This table lines up each cost component of running AD FS on Windows Server against the equivalent component of running Keycloak on Linux with a database. Read the timing column first to separate one-time spend from recurring spend, then confirm the licensing rows with Microsoft or a licensing adviser before you rely on any figure. The main takeaway is that the Windows licensing rows are fixed by farm design, while the Keycloak side shifts most cost into people, database operations and support choices.
| Cost component | Commercial side (AD FS) | Self-hosted side (Keycloak) | One-time or recurring |
|---|---|---|---|
| Windows Server core licensing | Per-core licenses, minimum 16 cores per server and 8 per processor, for each AD FS and Web Application Proxy server | Not applicable for Keycloak itself; Linux hosts carry their own OS subscription or no fee, depending on distribution | Recurring if under subscription; one-time purchase otherwise |
| Client access licenses | Windows Server CAL for every user or device that accesses the server, per the Windows Server pricing page | None for Keycloak; user count does not change the software cost | Recurring with headcount growth |
| AD FS and Web Application Proxy servers | Hardware or VMs for the farm and proxy tier, plus the Windows Server edition chosen for each | Keycloak nodes and a load balancer, sized to login volume and high availability design | One-time build, then recurring hosting |
| SQL Server for larger farms | May apply where the farm design uses SQL Server for configuration; applicability depends on farm design, so confirm with Microsoft or a licensing adviser | Supported production database such as PostgreSQL, which carries no license fee in the supported list | Recurring if licensed; confirm applicability first |
| Certificates | Token-signing and service communication certificates managed on the farm | TLS and SAML signing keys managed in Keycloak and on the load balancer | Recurring renewal |
| Patching and maintenance | Windows updates across farm and proxy servers, with lifecycle planning tied to Microsoft support dates | Keycloak upgrades on a four-per-year minor cadence plus OS and database patching | Recurring |
| Keycloak software | Not applicable | Apache 2.0 licensed, no software license fee | One-time to deploy; no license renewal |
| Production database | Not applicable for AD FS configuration in small farms | Supported database with synchronous replication for high availability designs | One-time setup, then recurring operations |
| Infrastructure | Windows hosts, storage, backup and monitoring for the farm | Linux hosts, container or Kubernetes platform, storage, backup and monitoring | Recurring |
| Support subscription | Microsoft support agreement, where the organization holds one | Optional vendor or distributor subscription; community support is free | Recurring if chosen |
| Migration | Inventory, relying party re-testing and any parallel running period | Client re-creation, claim mapping, cutover and decommissioning of AD FS | One-time |
| Operations and internal skills | Existing Windows administration staff and runbooks | Staff trained on Keycloak, Linux, database and cluster operations, or an outside operator | Recurring |
How the AD FS cost is built from Windows Server licenses
The Windows Server licensing line in an AD FS budget is driven by cores, not by the number of servers alone. Windows Server 2025 is licensed per core, with a minimum of 16 cores per server and at least 8 cores per processor, so a small federation server still pays for 16 core licenses. Both the Standard and Datacenter editions also need a Windows Server Client Access License for every user or device that accesses the server. That means the license bill for an AD FS farm and its Web Application Proxy servers can grow with the user population as well as the hardware. Ask your Microsoft partner or reseller to confirm how Client Access Licenses apply to your users, devices and any external access paths.
Microsoft's Windows Server 2025 pricing page lists a suggested price of 1,176 US dollars for Standard and 6,771 US dollars for Datacenter, each for 16 core licenses, and notes that prices vary by region. For pay-as-you-go use, it offers Azure Arc licensing at 33.58 US dollars per core per month. Those list figures are a starting point only. Your enterprise agreement, Software Assurance terms, academic or government pricing and any volume discounts can change the amount you actually pay, so confirm the rate in your own licensing agreement before comparing it with any other option.
The following example is illustrative only and uses assumed counts, not your environment. Suppose a farm has two AD FS servers and two Web Application Proxy servers, each with 16 cores licensed as the minimum. That is 64 core licenses before counting any Client Access Licenses, and the count rises with every additional server or larger processor. Edition rights matter here too: confirm whether your workloads and virtualization rights justify Standard or Datacenter for each server role, and whether a separate SQL Server license applies for larger farms. Those decisions are recurring inputs to the cost comparison with Keycloak.
What moves the cost up or down on each side
The AD FS side is priced mostly by cores, client access licenses and servers, while the Keycloak side is priced mostly by the people, database and nodes you run. Each card below names one driver, which side it moves, and whether its effect is one-time or recurring.
User and device counts
Windows Server Standard and Datacenter both require a Windows Server Client Access License for every user or device that accesses the server, so AD FS costs rise with the number of people and machines that touch the farm. This is a recurring decision at purchase and at each true-up, and it applies to the AD FS side only. Keycloak has no per-user license fee from the open-source project. Check how many users reach AD FS through proxied and internal paths, not only domain-joined staff, before comparing totals.
Core and server count
Windows Server 2025 is licensed per core, with a minimum of 16 cores per server and 8 per processor, so a farm with several AD FS and Web Application Proxy servers pays for each one at its minimum. This is a one-time purchase per core license plus renewals under your agreement, and it sits on the AD FS side. Ask your reseller for the exact per-core price in your region, because Microsoft notes that list prices vary by region. On the Keycloak side, the equivalent is node count and the hardware or virtual machines that host them.
Relying parties and proxy servers
Each AD FS relying party trust and each published application through Web Application Proxy adds configuration, testing and certificate work, and proxy servers add their own OS licenses and patch cycles. On the Keycloak side, each client is configuration in the realm rather than a separate server, so the main cost is the migration effort to re-create clients and mappers. Count relying parties with real traffic, retire the unused ones, and estimate the rebuild effort per client before you compare the two options.
Availability design
Keycloak's supported high availability designs need a synchronously replicated database, so a highly available Keycloak deployment runs multiple nodes plus at least one database replica. That database cost, along with the extra nodes, recurs every month in cloud or hardware terms. AD FS farms also need redundant servers and a SQL Server configuration for larger farms, and that licensing should be priced into the same comparison. Decide the availability target first, then price both sides against the same target rather than against a single-server baseline.
Windows Server lifecycle dates
Windows Server 2022 mainstream support ended on October 14, 2026, and extended support ends on October 15, 2031, so any AD FS farm on that release will face an OS upgrade within the planning horizon. Each upgrade is a one-time project that includes new hardware or images, testing of every relying party and proxy, and new certificates where needed. The Keycloak side has its own upgrade cadence, which the project describes as four minor releases a year. Put the OS upgrade cost on the AD FS side of the model with its date, not as a vague future expense.
Internal skills on Linux and Kubernetes
AD FS is run by teams that know Windows Server, Group Policy and the AD FS management tools. A Keycloak platform needs skills in Linux, a supported database such as PostgreSQL, and, if you choose the Operator, Kubernetes and Operator Lifecycle Manager. Those skills are a recurring payroll or contractor cost, and a gap in them is often the largest line in the model. Ask whether your team can operate a database backup and restore cycle, and whether a support subscription or implementation partner covers the gap during the first year.
Keycloak running costs on virtual machines or Kubernetes
On virtual machines, your team builds and maintains the Keycloak nodes, the load balancer in front of them and the database behind them. Keycloak is open source under the Apache License 2.0, so there is no license fee for the server itself. The recurring costs are the compute and storage for the nodes and database, the operating system patching and the people who run the platform. Keycloak's supported production databases include MariaDB, Microsoft SQL Server, MySQL, Oracle Database, PostgreSQL (14 to 18), EnterpriseDB Advanced, Amazon Aurora PostgreSQL and Azure SQL. The dev-file database is for development only, so budget for one of these from the start.
- Node count and high availability: Both supported high availability designs need a synchronously replicated database, so the database tier usually costs more than the Keycloak nodes themselves.
- Database licensing: PostgreSQL, MariaDB and MySQL community editions carry no license fee, while Oracle, Microsoft SQL Server and some managed database services are paid products, so the database choice can dominate the budget.
- Skills: Your team needs Linux administration, database replication and reverse proxy configuration. Keycloak documents production settings, including hostname and TLS configuration, in its production guide.
- Upgrades: Keycloak migrates its database schema automatically at startup by default. Large deployments can apply the SQL manually, which the upgrading guide suggests, and that step adds planned maintenance time.
- Recurring work: Patching hosts, rotating certificates, monitoring with the metrics endpoint and testing each release on a staging copy recur every quarter.
Confirm the database edition, replication topology and support hours with your database vendor or cloud provider before you request a quote.
On Kubernetes, the Keycloak Operator manages the Keycloak deployment and its realm and client resources as custom resources. The Operator is installed through Operator Lifecycle Manager, which Keycloak recommends, or with kubectl, or with an experimental Helm chart. The Operator manages the Keycloak, KeycloakRealmImport, KeycloakOIDCClient and KeycloakSAMLClient resources, so realm and client configuration can live in version control. The cluster, its node pools, storage and the external database remain your costs, and they recur monthly whether the cluster runs one workload or many.
- Cluster and database: The same supported production databases apply, and the database must be synchronously replicated for either high availability design. Managed database services often reduce operator effort but add a recurring service fee.
- Skills: Your team needs Kubernetes operations, custom resource management and GitOps practice in addition to Keycloak and database skills. Existing platform teams may absorb this cost, while small teams may need outside help.
- Upgrade control: The Operator documentation strongly recommends manual approval mode for operator updates, so an upgrade does not start without a change window and a reviewed release note.
- Shared platform cost: If the cluster already runs other workloads, the marginal cost of Keycloak is lower, but the cluster's own monitoring, backup and patching costs still apply.
- Experimental tooling: The Helm chart is experimental, so production teams should plan on the Operator path unless they accept that risk.
Ask your platform team how much spare capacity the existing cluster has and who owns Operator upgrades before you compare this model with virtual machines.
How to build the comparison with your own numbers
This sequence turns your AD FS estate into a five-year cost model that compares licensing, infrastructure and operations on both sides, using quotes and inventory data you can defend to finance and audit.
Inventory the AD FS farm and proxy servers
The identity or infrastructure team lists every AD FS farm node, every Web Application Proxy server, the physical or virtual core count of each host, and the Windows Server edition and version they run. Record the operating system's lifecycle dates from Microsoft's lifecycle pages, since the support end dates drive when you must spend money regardless of the replacement decision. Also record the SQL Server instance behind the configuration database if the farm uses one. The step is done when a single table shows every server, its role, its cores, its edition and its support end date, and someone other than the author has checked it against the running environment.
Count client access licenses and users
Work with your licensing or procurement team to count the Windows Server client access licenses that cover users and devices reaching the AD FS servers, and confirm whether your organization already holds them through an enterprise agreement or another volume program. Microsoft requires a client access license for each user or device that accesses the server, so the count is a input you must verify rather than estimate. Note which licenses are already paid for and which would be bought only for this purpose. The step is done when the license count is documented with its source, such as an agreement or a license report, and the procurement contact has confirmed it.
List every relying party and its protocol
The application owner and the identity team list each relying party trust and claims provider trust in AD FS, the protocol each one uses (WS-Federation, SAML 2.0 or OpenID Connect), its claim rules, and whether it still receives traffic. Use the usage data from AD FS logs or a readiness report to separate active applications from dormant ones. Keycloak supports SAML 2.0 and OpenID Connect and does not serve every WS-Federation application, so mark those explicitly, because they affect the migration effort and whether a second product is needed. The step is done when each application has an owner, a protocol, a usage status and a note on whether it can move to Keycloak as is.
Request written quotes for the Keycloak stack
Ask a DeployOpen solutions architect or another implementation partner, and separately your own infrastructure team, to price the Keycloak build from your inventory: the Linux virtual machines or containers, the supported production database (PostgreSQL, SQL Server, MariaDB, MySQL, Oracle or a cloud equivalent), load balancing, the high availability design you need, backup storage, monitoring and any Red Hat build of Keycloak or other support subscription. Ask each vendor to separate one-time costs from annual costs. DeployOpen does not publish prices, so the quote follows from a written scope. The step is done when each line item has a written quote or a documented internal estimate, with the assumptions listed beside it.
Estimate migration and parallel-running effort
Using the relying party list, estimate the work to re-create each trust as a Keycloak client, translate claim rules into protocol mappers, test each application, and run AD FS and Keycloak side by side until cutover is complete. Include the time for user testing, change windows, rollback plans and decommissioning. Separate the effort for simple SAML and OIDC applications from the effort for applications that need a different answer, such as WS-Federation or Kerberos-dependent services. The output is an effort estimate per application group, with the internal or partner rate used and the parallel-run period written out. The step is done when the effort figures trace back to specific applications, not to a single lump sum.
Add operations time on both sides
Model the recurring work for AD FS and for Keycloak separately. For AD FS, include Windows patching of the farm and proxy servers, certificate renewal for token signing and service communications, and the upgrade path for each server generation. For Keycloak, include Linux and database patching, the Keycloak release upgrade cycle (the project plans four minor releases a year), certificate management, backup and restore testing, and monitoring. Also decide who performs the work, in-house or under a retainer, and price that decision. The step is done when both sides show an annual hours or cost figure, with the staffing assumption written next to it.
Compare five-year totals with costs separated
Build a five-year model with two columns, AD FS and Keycloak, and separate one-time costs (migration, infrastructure setup, hardware, initial licenses, testing) from recurring costs (licensing renewals, support subscriptions, infrastructure, operations time, certificates). Show the assumptions beside each total, and record which numbers came from quotes and which came from internal estimates. Then rerun the model with the assumptions you are least sure of, such as user count or migration effort, to see which ones change the result. The step is done when the totals, the one-time and recurring splits, and the list of changed assumptions are reviewed by finance and the identity owner together.
What migration adds to the Keycloak side of the model
The Keycloak side of the model carries a one-time migration cost that the licence and support lines do not show. Its size depends on three things: how many AD FS relying party trusts you run, how complex their claim rules are, and whether any of them use WS-Federation, which Keycloak does not serve. Each SAML or OpenID Connect client has to be re-created as a Keycloak client, and each claim rule has to be translated into a protocol mapper and tested. Applications that depend on WS-Federation need a separate decision (replace, retire or serve through another product), and that decision often drives the schedule more than the Keycloak work itself. Ask your integrator to classify every relying party before pricing.
Your existing Active Directory is a cost offset. Keycloak can use LDAP and Active Directory user federation, so user accounts, groups and password policy can stay where they are while Keycloak takes over the protocol layer. How much you can reuse depends on how your directory is structured and which attributes your claim rules read. Confirm with your directory team which attributes the claim rules depend on before assuming federation covers them. Plan for parallel running: both AD FS and Keycloak must authenticate users for each application during cutover, and testing across browsers, mobile clients and service accounts adds effort that recurs with each wave.
Treat the realm export and import tool as a configuration copy, not a backup strategy. The Keycloak server guide documents kc.sh export and kc.sh import for realms as JSON, warns about limitations as a backup and restore mechanism, and notes that all nodes must be stopped while the process runs. Your backup plan should cover the production database, the server configuration and secrets, and a tested restore runbook, with the realm export kept as a supplementary artifact. Effort estimates for all of this must come from a written scope that lists relying parties, clusters and environments. For the step-by-step work, see the sibling pages on migrating from AD FS to Keycloak and on inventorying AD FS relying party trusts.
Questions buyers ask about AD FS and Keycloak costs
Does Keycloak have a license fee?
No. Keycloak is licensed under the Apache License 2.0, so the software itself carries no license fee. The costs that remain are the infrastructure to run it (Linux servers, a supported database, load balancing and backups), the people who install, harden and operate it, and an optional commercial support subscription. Red Hat build of Keycloak is Red Hat's supported distribution based on the open source project, and it is the paid option most organizations consider when they want vendor-backed support and a defined lifecycle. Ask any vendor exactly which features and support terms their subscription adds, because the open source build and the supported distribution can differ in packaging and support scope.
How much of AD FS cost is Windows Server licensing?
Windows Server licensing is one component, and it is not the whole picture. Windows Server 2025 is licensed per core with a minimum of 16 cores per server and 8 per processor, and both Standard and Datacenter editions need a Client Access License for every user or device that accesses the server. Microsoft's pricing page lists a suggested price of 1,176 US dollars for Standard and 6,771 US dollars for Datacenter for 16 core licenses, and says prices vary by region. An AD FS farm also needs Web Application Proxy servers, so count every server in the farm and the proxy tier. Retiring AD FS removes the core licenses and CALs tied to those servers, along with any SQL Server licenses used by a larger farm. Domain controllers stay in place for most organizations because Keycloak can federate with them.
How long does an AD FS to Keycloak migration take?
The timeline depends mostly on the number of relying party trusts, how many use WS-Federation rather than SAML or OpenID Connect, how claim rules must be translated to mappers, and how many change windows the business allows. The duration cannot be estimated responsibly from the supplied facts, so ask for a timeline in the written scope. A practical first step is an inventory of every trust, its protocol, certificates and real usage, because unused trusts can be retired without migration effort. Ask the provider to break the timeline into discovery, build, pilot, relying party cutover and decommissioning, and to show which parts depend on your change approvals.
Can our team run the migration without outside help?
Yes, if the team has the skills. The work needs people who can operate Linux, configure a relational database and manage TLS certificates, along with staff who understand SAML, OpenID Connect and Kerberos, and who can read AD FS claim rules and map them to Keycloak protocol mappers. Keycloak's Operator and its documented high availability designs add Kubernetes or clustering skills if you choose those deployment paths. Many teams combine internal ownership with outside help for the parts they have not done before, such as the cluster design or the claim translation for complex trusts. A fixed-scope engagement with written deliverables is one way to close those gaps, and DeployOpen can plan, implement, harden and document such work inside your environment.
Is a paid support subscription required to run Keycloak?
No. The Apache License 2.0 lets you run Keycloak without a subscription. A support subscription is optional and is a decision about risk and staffing, not a licensing requirement. Consider it if you need a vendor to respond to production incidents, if you must show a supported version to an auditor or regulator, or if your team lacks the depth to handle upgrades and security fixes alone. Keycloak releases four minor versions a year under its current plan, and breaking changes in minor releases are opt-in, so the upgrade effort is recurring either way. Whether you buy support or not, budget for upgrades, testing and patching as ongoing work.
What does the migration need from internal staff during and after cutover?
During cutover, staff need to confirm which applications move in each wave, approve change windows, test sign-in for each relying party, and be ready to roll back a trust if a claim or certificate is wrong. Application owners must verify attributes and group-based access in Keycloak. After cutover, the operations team owns monitoring, backups, database maintenance, certificate renewal, Keycloak upgrades and access reviews. Keycloak's realm export and import is documented as having limitations as a backup mechanism and requires all nodes to be stopped while it runs, so plan backups with the database and cluster design in mind. Ask the provider which of these tasks they will hand over with documentation and runbooks.
What should a written quote for this migration include?
A written quote should follow from a written scope and list each deliverable separately. Ask for the count and protocol of relying parties in scope, the handling of WS-Federation applications, the target architecture (single cluster, multi-cluster or Kubernetes), the database and hosting components, backup and restore testing, documentation and runbooks, knowledge transfer, and post-cutover support terms. Ask which items are one-time and which recurring, such as support subscriptions, upgrades, monitoring and testing retainers. Confirm who pays for infrastructure, Windows Server licenses during the parallel run, and any Red Hat or other subscription. DeployOpen does not publish a price list, so the quote follows from the agreed scope.
How DeployOpen scopes a fixed-price Keycloak implementation
DeployOpen approaches AD FS cost vs self-hosted Keycloak as a written, fixed-scope engagement that runs inside your own cloud accounts, data centers or air-gapped network. We agree the scope, deliverables and timeline in writing before work starts, then give you a quote that follows from that scope.
How we scope
- Inventory AD FS farm size, Web Application Proxy servers and Windows Server licensing before pricing any option
- Record which relying parties use SAML, OpenID Connect or WS-Federation, and which need Kerberos or LDAP
- Agree in writing which Keycloak database, cluster layout and Active Directory federation settings are in scope
How we build
- Deploy Keycloak on Linux with a supported production database and a synchronously replicated setup
- Re-create SAML and OpenID Connect clients and translate AD FS claim rules into Keycloak mappers
- Test each relying party end to end, including MFA paths and certificate rotation, before cutover
How we hand over
- Document the cost components, runbooks, backup and restore steps, and the realm export limits your team must follow
- Hand over configuration, operator update approval settings and monitoring setup with written evidence of testing
- Train your operations staff on routine tasks such as upgrades, certificate renewal and node restarts
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer if your team wants it
- Plan Keycloak upgrades around its four minor releases per year and its opt-in breaking change policy
- Prepare control evidence for your compliance assessments, while independent auditors issue any reports
