Entra ID P1 and P2 cost vs Keycloak

Does self-hosted Keycloak cost less than Entra ID P1 and P2?

Keycloak carries no license fee under Apache 2.0, while Entra ID P1, P2 and Entra Suite are per-user licenses, so the answer depends on your user count, which Entra features you actually use and what your team must build and run. If a renewal, a Microsoft 365 licensing change or a data location requirement has forced this review, start by separating two questions: what you pay Microsoft for sign-in, and what you pay people and infrastructure to run an open-source identity provider in your own environment. Entra prices vary by agreement, region and bundle, so take the figures from your Microsoft agreement or the current Microsoft price list rather than from third-party summaries. Some Entra P1 capabilities may already be included in the Microsoft 365 plan you hold, so confirm that entitlement before you count it as a saving.

Self-hosting tends to cost more in people and operations than in software. Someone must own the Keycloak servers, a supported production database (PostgreSQL 14 to 18 is one of the listed options), and a high availability design that the project documents as requiring a synchronously replicated database. Upgrades carry real effort: Keycloak ships four minor releases a year, and the Operator documentation strongly recommends manual approval mode for updates. Backup also needs planning, because the realm export and import commands are documented as having limitations as a backup mechanism and require all nodes to stop during the process. Migrating each application to Keycloak, re-creating client settings and testing sign-in flows is often the largest one-time cost, and it is easy to underestimate in a quote.

Self-hosting tends to cost less where per-user licensing scales with headcount or with the number of external users. Entra ID P1 and P2 charge for each licensed user, so the saving grows with the user base, and identity sprawl across contractors and partners can add licenses quickly. Ask any integrator for a fixed-scope quote that separates one-time migration, recurring platform operations, support and hosting, then compare that total against your current per-user spend over the same period. Keep Entra's own licensing in the model if Microsoft 365 sign-in or Conditional Access features remain on Entra, since those costs do not disappear.

Which cost components move on each side

This table lists each cost component of Microsoft Entra ID P1, P2 and Entra Suite against the matching component of a self-hosted Keycloak deployment, and marks whether it is one-time or recurring. Read it as a checklist for a quote: the commercial licenses are mostly recurring per user, while the self-hosted side shifts cost into infrastructure, database, operations and migration work that you or a partner must price.

Cost component	Commercial side (Entra ID)	Self-hosted side (Keycloak)	One-time or recurring
Identity software license	Entra ID P1, P2 and Entra Suite are per-user licenses. Some capabilities are already included in certain Microsoft 365 plans, so confirm your entitlements with Microsoft	Keycloak is free under the Apache 2.0 license. Red Hat build of Keycloak is a supported subscription option, and its price must be requested from Red Hat	Recurring for Entra. Keycloak software is zero license cost, but a Red Hat subscription would be recurring
Identity data export	Admins download the user list as CSV from the Entra admin center, but app registrations, groups and policies must be rebuilt	Realm export and import with kc.sh works as a migration aid, but it has backup limits and needs all nodes stopped during the run	One-time migration task
Servers and hosting	None; Microsoft operates the service	Virtual machines or Kubernetes capacity in your own cloud account or data center, sized for your login volume	Recurring
Database	None; Microsoft operates the directory	A supported production database such as PostgreSQL 14 to 18, with backup, patching and storage	Recurring, plus one-time setup
High availability and load balancing	Included in the service	Multiple nodes, a load balancer and a synchronously replicated database, following Keycloak's documented high availability designs	Recurring infrastructure, plus one-time design
Upgrades and patching	Handled by Microsoft	Planned Keycloak upgrades, schema migration and operator update approvals, done by your team or a retainer partner	Recurring effort
Application migration	Existing SAML and OIDC enterprise apps are already registered in Entra	Re-registering each application as a client, re-testing sign-in, and replacing Conditional Access rules with Keycloak flows	One-time, scales with the number of apps
Internal skills and support	Microsoft support plans and internal Entra administration	Internal staff for Keycloak administration, or a support subscription, plus community or partner support as scoped	Recurring, with a one-time skills ramp-up

What moves the comparison most

The cost gap between Microsoft Entra ID P1 and P2 and a self-hosted Keycloak is driven by a handful of variables rather than the headline price. Each card below ties one of those variables to a line in the cost table, so you can test the comparison against your own tenant before asking for quotes.

Total and active user count

Entra ID licensing is charged per user, so the number of licensed identities in scope is the first multiplier. Separate employees, guests, service accounts and shared mailboxes, because only some of them need an Entra license for the features you use. On the Keycloak side, the user count mainly affects database sizing and session load, not a per-seat fee. Ask your Microsoft partner or account team which of your identities actually consume paid licenses today.

Entra features actually in use

Conditional Access and risk-based policies sit in P1 and P2, and governance and the Entra Suite add-ons are priced separately. List the features your administrators have turned on, not the ones in the plan sheet. Features you do not use do not belong in the cost model. For each feature in use, note whether a Keycloak capability or a privacyIDEA policy covers it, and where it has no equivalent.

Applications that must be re-pointed

Every SAML and OIDC enterprise application registered in Entra ID has to be rebuilt as a Keycloak client, with its redirect URIs, claims mapping and group-based access. The labor is usually larger than the license line. Count applications by protocol and by owner, and identify which ones can be retired. Apps that stay on Entra for Microsoft 365 sign-in should be excluded from this count.

Microsoft 365 licenses already bundled

Some Entra ID features may already be included in the Microsoft 365 plans your organization holds, so the license you would remove may not be a separate line item. Confirm which plan each user holds and which Entra capabilities that plan includes. If Microsoft 365 keeps Entra ID as its identity source, the saving from replacing application SSO is smaller than the list price suggests.

Availability and recovery targets

A self-hosted Keycloak that matches a cloud service's availability needs more than one node. Keycloak's high availability designs assume a synchronously replicated database, so the database cluster, load balancing across nodes and tested restores are recurring costs you carry. Set a target for uptime and recovery time, then price the second site, the database failover and the operator time to keep them working. Also note that realm export and import is not a complete backup mechanism and requires all nodes to be stopped while it runs.

Skills already on the team

Operating Keycloak means owning upgrades, database schema migrations, clustering, certificates and the Operator if you run Kubernetes. Teams that already run these services absorb the work at lower cost, while teams that do not will pay for training or outside support. Estimate how many staff can own identity infrastructure after go-live, and whether that work replaces existing duties or adds to them. Budget for the upgrade cadence, which the Keycloak project sets at four minor releases a year.

How the Entra ID license side is counted

Start by treating the Entra ID license count as a per-user decision with three possible tiers: Entra ID P1, Entra ID P2 and the Entra Suite. Each is licensed per user, and the number that matters is the set of users who actually depend on a feature that only a higher tier unlocks, not the total headcount. Conditional Access policies are the usual driver for P1, while risk-based policies such as identity protection and some governance features are the usual driver for P2. Before comparing anything with Keycloak, pull a list of which users are assigned to which licenses in the Entra admin center and identify which Conditional Access and identity protection policies are enabled for them. That inventory tells you how many licenses the Keycloak comparison actually replaces, which can be far fewer than the full directory.

Next, check what is already paid for. Several Microsoft 365 and Microsoft 365 business plans include Entra ID P1 entitlements, and some enterprise plans include P2 entitlements, so an organization may hold P1 or P2 capability without a separate line item on its invoice. Whether a given plan includes which tier, and whether the Entra Suite is bundled or sold as an add-on, changes over time and depends on the agreement you hold. Confirm bundle entitlements, add-on pricing and any discount terms with your Microsoft account team or in your licensing agreement, and ask for the entitlement list per user group in writing. Also ask whether licenses are assigned to users who have left the organization or to service accounts, since those can inflate the count without adding value.

The output of this check should be a short table for the decision: user groups, the Entra features each group uses, the tier that feature requires, and whether the tier is already included in a plan you pay for. Keep Microsoft 365 sign-in and any features Keycloak cannot replace separate from application SSO, because removing Entra ID from application sign-in does not remove the Microsoft 365 licensing that remains. Write down which features you would lose if the P1 or P2 licenses for a group were not renewed, and plan the replacement work against that list. Any quote you request from Microsoft or a reseller should reference this inventory so the comparison uses your numbers, not list estimates.

How to build the comparison with your own numbers

This sequence turns the page's cost components into a three-year model built from your own user counts, licence entitlements, application inventory and written infrastructure quotes. The result is a comparison you can defend in a renewal or budget discussion.

Count authenticating users and service principals
Start by exporting the current user list from the Entra admin center, using Users, All users, then Download users, as described in Microsoft's bulk download guidance. Separate licensed employees, guests, shared mailboxes and disabled accounts, and count service principals and enterprise applications that authenticate through Entra ID as a separate line. Your output is a single table of counts by category, with the export date recorded so the figures can be reproduced later.
Map Entra features in use to license tiers
List every Entra feature your tenant actually uses, such as Conditional Access, risk-based policies, group-based application assignment, access reviews, self-service password reset or Privileged Identity Management. For each feature, confirm the tier that includes it by checking Microsoft's current licensing documentation and your Microsoft 365 or Enterprise Mobility and Security entitlements, since some P1 or P2 capabilities arrive bundled in Microsoft 365 plans. Ask your Microsoft partner or account team for written confirmation of which licences your tenant already holds, because bundled entitlements change the baseline cost.
Inventory applications and protocols to move
Build a register of every application that signs users in through Entra ID, and record its protocol (OIDC, SAML 2.0 or LDAP), its owner, whether it is a Microsoft service, and whether moving it is in scope. Note which applications depend on Entra-specific claims, group object IDs or Conditional Access outcomes, since these take longer to re-point. The register is complete when every application has a protocol, an owner and an in-scope or out-of-scope decision that the business has signed off.
Price the Keycloak side with written quotes
Price Keycloak as infrastructure and labor lines. Infrastructure covers compute, storage, load balancing and backup in your own cloud account or data center, and you should request written quotes from those vendors for the sizing your inventory implies. Labor covers installation, realm design, application integration, testing, hardening and documentation, which DeployOpen or another implementation partner quotes from your written scope. Keycloak itself is licensed under Apache 2.0, so no software licence line applies, but ask any vendor that bundles Keycloak to state its support terms in writing. Your output is one quote per line, each marked with its source and date.
Add the database and high availability design
Choose a supported production database from Keycloak's database guide, and price its licence or managed service, backup, and storage separately from the Keycloak servers. Then decide the high availability design, choosing among the single-cluster model, multi-cluster deployment or the deprecated v1 model, and note that the supported designs need a synchronously replicated database. Each extra site, replica and database standby adds recurring cost, so price the design you will run in production, not the minimum for a test. Confirm the recovery approach with your backup vendor, because Keycloak's realm export and import is documented with limitations as a backup mechanism and requires all nodes to be stopped while it runs.
Run a three-year model with separate cost lines
Build a three-year model in a spreadsheet with two sections: one-time lines (migration labor, application re-pointing, testing, initial hardware or cloud setup) and recurring lines (licences, cloud or hosting, database, support, upgrades and monitoring). Keep the Entra side in the same structure, using your own per-user list prices from the Microsoft pricing page and your tenant's actual entitlements, and show Microsoft 365 bundled amounts as a separate line so they are not double-counted. Mark every number that is not backed by a written quote or a published vendor price as an assumption, and review those assumptions with finance before the comparison is used. The finished model is complete when each cell traces to a quote, a published price or a named assumption.

Who pays for each Keycloak deployment option

Community Keycloak is licensed under the Apache License 2.0, so the software itself carries no license fee. The organization pays for everything around it: the servers or cloud instances, a PostgreSQL or other supported database, load balancing for a clustered setup, monitoring, backups, upgrades and the staff who run them. Keycloak is a CNCF incubating project, and the project's own documentation, forums and issue tracker are the support channels.

Infrastructure: Nodes for at least two Keycloak instances in a highly available design, the database with synchronous replication, and the network components in front of them. These recur every month.
Staff time: Engineers who learn the admin console, the realm model, protocol mappers and the database schema migration behavior. This is largely a recurring cost.
Upgrades: Minor releases arrive four times a year under the project's plan, and breaking changes in minor releases are opt-in. Someone must test each release against your apps before rollout.
Operator and automation: If you run on Kubernetes, the Keycloak Operator reduces manual work, but it still needs a maintainer who understands manual approval mode for updates.
Cost drivers: Team size, the number of realms and clients, the availability target, and how many people carry on-call duty.

Ask your team to estimate the monthly hours for operations and upgrades, then compare that with the Entra ID licenses you would retire.

Costs teams forget on each side

Entra ID license lines are easy to compare on a price sheet, but several costs sit outside it on both sides. The cards below pair the costs that tend to appear late on the Entra side with the operating work a self-hosted Keycloak deployment carries, so the cost table reflects the full picture.

Add-on licences added after go-live

Conditional Access and identity governance features are not all in the base tier. Teams often buy P1 for sign-in policy, then find that risk-based rules need P2 and that lifecycle workflows or access reviews sit in a separate add-on. Ask the vendor or your Microsoft partner to map each control you need to a specific SKU, and treat every add-on as a recurring line. (Illustrative: a team that plans for P1 only may still need a later P2 or governance purchase.)

Tenant and licence administration

Someone must assign licences, reconcile seats against active users, and review which accounts still hold paid SKUs. This is recurring staff time that rarely appears in a per-user price. Check who owns licence assignment today, how often it is reviewed, and whether group-based licensing is in use. The total depends on tenant size and how often joiners and leavers change.

Re-licensing on user changes

Per-user pricing means that contractors, seasonal staff, acquisitions and role changes all move the bill. Each new hire or mover who needs a higher tier can trigger a licence change, and each leaver should release a seat. Ask how your agreement handles mid-term additions and reductions, and whether unused seats can be reclaimed. Model the recurring cost against your real headcount movement, not an average.

On-call and patching staff time

A self-hosted Keycloak cluster needs people on call for sign-in outages, certificate renewals, and the operating system and Java runtime patches underneath it. This labor recurs every month and is often assigned to a team that already has other duties. Confirm who is paid for this work, whether it is in-house or under a retainer, and what response times the business expects.

Testing each minor release

Keycloak plans four minor releases a year, and the project says breaking changes in a minor release are opt-in. Even so, each upgrade needs a staging test of your custom themes, authenticators, SPI extensions and client flows before production. Budget this as recurring engineering time, and check the upgrade notes for every version you skip. The Keycloak Operator docs recommend manual approval mode for updates so that upgrades happen on your schedule.

Database backup and restore testing

Keycloak's realm export and import is documented with limitations as a backup mechanism, and all nodes must be stopped while it runs. A reliable plan therefore depends on database backups, point-in-time recovery and rehearsed restores, which are one-time design work plus recurring storage and test time. Ask your database team whether PostgreSQL backups and restores are already tested, and who signs off on the recovery time you can accept.

What upgrades and data export add to the budget

Upgrades are a recurring line item that Entra ID does not give you. Keycloak has planned four minor releases a year since version 26.0, and the project says breaking changes in a minor release will be opt-in. That makes the release cadence predictable, but someone still has to read each release, test the realm configuration, custom authenticators and client settings against it, and schedule the change. Budget that testing as a standing monthly or quarterly task, and confirm the current release policy in the Keycloak blog post on backwards compatibility before you commit to a support model. If you run the Keycloak Operator, the documentation strongly recommends manual approval mode for operator updates, which keeps an unintended automatic upgrade from landing in production. Choosing that mode means your team, not the cluster, owns the upgrade calendar. Database schema changes add a second step. Keycloak migrates its schema automatically at startup by default. The upgrading guide suggests manual migration for large deployments, where administrators review and apply the SQL themselves during a planned window. Decide which mode you will use before the first upgrade, because it changes who runs the change, how long the window takes and what a rollback looks like. Ask whoever designs your environment to write the upgrade runbook for both paths and to rehearse it on a copy of production data.

Data export and backup is the item most often underestimated. Keycloak exports and imports realms as JSON files with the kc.sh export and kc.sh import commands. The documentation warns that this mechanism has limitations as a backup and restore method, and that all nodes must be stopped while the export runs. That means a realm export is a configuration snapshot that needs downtime, so it cannot be your only protection. Budget for database-level backups and point-in-time recovery of the chosen PostgreSQL or other supported database, plus restore tests that prove a cluster can be rebuilt from them. Plan a recurring test of the restore path, including the secrets and keys that the database alone does not hold. Confirm with your platform team who owns that test, how often it runs and how long a restore takes in your environment, because those answers, not the software license, determine the true recovery cost.

Questions buyers ask about cost, effort and skills

How much does Keycloak cost compared with Entra ID P1 and P2?

Keycloak has no license fee because it is licensed under Apache 2.0, so the comparison comes down to what you pay for everything around the software. Those costs include servers or cluster capacity, a supported PostgreSQL or other production database, backup storage, monitoring, staff time for operations and upgrades, and optional paid support such as a Red Hat build of Keycloak subscription. Entra ID P1 and P2 are priced per user and some of those licenses may already be included in your Microsoft 365 plan, so check which Entra features your tenant already has. Build the comparison from written quotes and your own labor rates rather than from list prices. Ask each vendor for what is one-time and what recurs, and what changes with user count and high availability requirements.

How long does an Entra ID to Keycloak migration take?

Duration depends mostly on the number of applications, the protocols they use (OpenID Connect, OAuth 2.0 or SAML 2.0), and how many custom flows, claim mappings or conditional rules must be rebuilt. Applications that only need standard sign-in are usually quicker to move than those with custom token logic or legacy integrations. Identity sources also matter: federating existing Active Directory over LDAP is a different job from migrating directly from cloud-only users. There is no fixed duration that applies to every estate, so ask for a timeline built from an inventory of your applications and a written, fixed scope before work starts. A pilot with a few low-risk applications helps you measure the real effort for your environment.

Can our team run Keycloak without outside help?

A team can run Keycloak alone if it already operates Kubernetes or virtual machines, administers a production database, and understands OpenID Connect, SAML and directory concepts. Keycloak also needs a clear upgrade process, since the project plans four minor releases a year and the Keycloak Operator documentation recommends manual approval for operator updates. The gaps that usually appear are database high availability and tested backup and restore, because the export and import commands in Keycloak are not a complete backup method and all nodes must be stopped during them. Other common gaps are monitoring, certificate management, and application owners who can rebuild claims and sign-in flows. Assess these skills honestly before deciding who operates the platform.

What support options exist for self-hosted Keycloak?

There are two main routes. The first is the open-source project with community support, which is free of license fees but depends on your own staff to diagnose and fix issues. The second is a Red Hat build of Keycloak subscription, which is Red Hat's supported distribution based on the open-source project and replaces Red Hat Single Sign-On. Separately, you can buy a retainer for ongoing support, upgrades and continuous testing from an implementation partner such as DeployOpen, which is available alongside the platform rather than as a replacement for vendor support. Ask each option for its response terms, supported versions and what happens during an upgrade. Confirm the details directly with the vendor before you rely on them.

Can we remove Microsoft 365 sign-in if we move to Keycloak?

Not necessarily. Keycloak can handle sign-in for applications you connect to it, but Microsoft 365 sign-in is tied to Microsoft's identity platform and licensing, so it may still depend on Entra ID. Before planning, confirm with Microsoft licensing terms and your current sign-in design, including whether your Microsoft 365 plan already includes the Entra ID features you use. Map which users, devices and services sign in through Microsoft and which through other applications. Only then decide what changes and what stays. Keeping Microsoft 365 on Entra ID while moving application single sign-on is a common design, but it should be checked against your licenses and the sign-in path your users follow.

What does a fixed-scope engagement need from our side to start?

A fixed-scope engagement starts when the scope, deliverables and timeline are agreed in writing. To get a useful quote, prepare an inventory of applications with their protocols, owners and data sensitivity, a description of current directories and identity sources, and the sign-in policies and multi-factor requirements in use. You also need named contacts for application owners, network and hosting decisions, and a place to run the platform, such as your cloud accounts, data center or air-gapped network. Agree on backup, high availability and upgrade expectations early, because these shape the infrastructure. Your readiness determines how precise the quote can be.

Which Entra ID costs disappear after a Keycloak move?

Only the per-user license fees for the Entra features you fully replace can be removed, and only after you confirm which ones are no longer needed. Entra ID P1 and P2 include conditional access and risk features, and Keycloak does not provide identical equivalents to every policy, so some controls will need to be rebuilt or accepted as gaps. Licenses that Microsoft 365 plans bundle are often tied to the Microsoft 365 subscription rather than to application sign-in alone. Ask Microsoft to confirm which licenses you can drop and which remain required for Microsoft 365 services, and model both the saved license spend and the new recurring costs for infrastructure, support and staff time.

How DeployOpen scopes a fixed-price Keycloak implementation

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For a move from Microsoft Entra ID to Keycloak, we start with a written scope that separates the licenses you can retire from the identity work you still need, so the cost comparison reflects your actual estate.

How we scope

Inventory which applications, SAML and OIDC enterprise apps, and LDAP consumers currently sign in through Entra ID.
Record which Entra ID P1, P2 or Entra Suite features your tenant uses, such as Conditional Access and risk policies.
Agree the written scope, deliverables and timeline with you before any work starts, since engagements are fixed-scope.

How we build

Deploy Keycloak in your cloud account, data center or air-gapped network, with the database and high availability design you choose.
Federate Keycloak with your existing Active Directory over LDAP and re-point each application to the new identity provider.
Test sign-in, MFA, token lifetimes and failover against the scope, and document each result for your review.

How we hand over

Provide architecture, runbooks, backup and restore procedures, and upgrade steps covering the realm export limitations.
Document the rebuilt client configurations, groups and policies so your team can maintain them without us.
Walk your operations and security staff through the deliverables and confirm what remains on Microsoft 365 sign-in.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer, priced from the written scope.
Apply Keycloak minor releases and operator updates under change control, using manual approval for operator upgrades.
Prepare systems, controls and evidence for your compliance assessments, while independent auditors issue any reports.

Microsoft Entra ID P1 and P2 cost vs self-hosted Keycloak