Migrate from Microsoft Entra ID to authentik: what moves and what stays
A renewal, a licensing change or a data residency requirement is usually what pushes a team to move sign-in off Entra ID, and the first question is which sign-in flows are actually in scope. authentik can take over SSO, LDAP and RADIUS duties for non-Microsoft apps, network devices and Linux hosts, using its OAuth2/OIDC, SAML, LDAP and RADIUS provider types. Microsoft 365 sign-in and any policy that is enforced by Entra ID itself, such as Conditional Access tied to Microsoft clients, need separate handling and should not be assumed to move with the rest. Before any design work, list every application, VPN, switch, firewall, Linux host and SSH path that authenticates against Entra ID today, and mark each one as moving, staying or being re-authenticated through a different route.
Most of the work falls to the internal identity or platform team, who own the directory and the application inventory, with an implementation partner typically covering the authentik build, the protocol configuration and the cutover plan. The effort depends mostly on how many applications need re-registration, how many network devices and Linux hosts need LDAP or RADIUS reconfiguration, and how many users have registered MFA methods that will not carry over. Confirm with your own team which Entra ID features are in use, including Conditional Access, groups used for authorization and any SCIM provisioning, because each one needs an authentik equivalent or a documented gap. For a quote, ask for the scope list, the application count by protocol, the test and rollback plan, and whether the work includes ongoing support.
Running both systems side by side is where the decisions get hard. The authentik Entra ID integration is listed as an Enterprise-only feature, so confirm with authentik whether your edition covers it before you plan a period where both directories answer sign-in. The free edition is community supported only, which matters for a production cutover. Plan a risk review for password and MFA enrollment, for service accounts that depend on Entra ID tokens, and for the authentik database, which stores all configuration and data except uploaded files, so backup and restore are part of the design from day one. Decide early whether authentik sources users from Active Directory, Entra ID or its own store, because that choice determines where account lifecycle changes are made.
Which Entra ID capabilities map cleanly to authentik
This table compares Entra ID capabilities with the authentik provider types that cover them in the free edition. Read each row as clean (a direct provider exists), needs rework (possible, but apps, groups or policies must be rebuilt) or gap (confirm before committing). Conditional access and governance flows from Entra ID P1 and P2 need separate authentik policy design, and the Entra ID integration itself is Enterprise-only.
| Entra ID capability | authentik equivalent | Status | What to confirm or rebuild |
|---|---|---|---|
| OIDC app registrations | OAuth2/OIDC provider with application objects | Clean | Recreate client IDs, redirect URIs and scopes for each app; secrets cannot be copied from Entra ID |
| SAML enterprise apps | SAML provider and application objects | Clean | Re-issue signing certificates and update each service provider's metadata and ACS URLs |
| LDAP-style directory access for Linux and network devices | LDAP provider (free edition) | Needs rework | Map base DNs, bind accounts and group attributes; test each device's LDAP client against authentik's schema |
| RADIUS for VPNs, Wi-Fi and network gear | RADIUS provider (free edition) | Needs rework | Confirm the device supports the authentication methods you plan to use and rebuild network policies on the device side |
| Automated user and group provisioning | SCIM provider (free edition) | Needs rework | Check which target apps accept SCIM 2.0 and map attributes; Entra ID's provisioning rules do not transfer automatically |
| Reverse proxy access to internal web apps | Proxy provider (free edition) | Needs rework | Plan outpost placement and certificates; confirm each app works behind the proxy before cutover |
| Remote desktop and SSH access control | Remote access control (RAC) provider | Needs rework | Verify protocol support and session recording needs against your current gateway |
| Entra ID Microsoft app integration | Entra ID provider (Enterprise edition only) | Gap | Free edition does not include it; budget for Enterprise if you need to run both directories side by side |
| Conditional access and risk-based policies (P1 and P2) | authentik policies, flows and stages | Needs rework | Rebuild each rule as an explicit policy; risk signals from Entra ID do not carry over and need a separate source |
Which identities, apps and integrations need to move
A migration to authentik starts with an inventory of what Entra ID holds and what depends on it. The export path covers users only, so the other objects, including app registrations, groups and policies, have to be mapped and rebuilt by hand. The cards below separate what can be exported from what must be recreated and what needs a decision before cutover.
User list from the Entra admin center
Admins can download the user list as a CSV from the Entra admin center under Users, All users, Download users. The default file carries identifiers such as userPrincipalName and mail, and the preview download adds attributes such as department and on-premises identifiers. Check which columns your directory fills in, because blank attributes will become blank fields in authentik unless you map them. Treat the file as personal data and store it under your own access controls.
Password hashes are not exported
The Entra user export does not include password hashes, so authentik cannot import existing passwords from this path. Plan one of two routes for each user group: users re-enroll credentials at first sign-in, or authentication stays with the source directory through federation. Passwordless methods such as passkeys may also need a fresh enrollment. Confirm this per tenant before you set a cutover date.
Enterprise applications and app registrations
Each enterprise application and app registration must be recreated as an authentik provider and application, with its own redirect URIs, signing certificates and claim mappings. Entra ID does not export these objects in the user list, so build a register that records each app's protocol, owner and assigned users. Test each one against its vendor documentation rather than copying settings across. Some apps will need a SAML or OIDC metadata refresh on their side.
Groups, roles and policies
Security groups and their memberships drive application assignment and access in Entra ID, and Conditional Access policies sit on top of them. authentik uses its own groups, policies and flows, so each group needs a matching definition and each Conditional Access rule needs a documented equivalent or an explicit decision to drop it. Record which rules depend on device state or risk signals, because those inputs need separate design.
Client secrets and certificates
Service principals, client secrets and certificates used by scripts, integrations and service accounts will stop working when apps move. Inventory every secret and its expiry, then issue new credentials from authentik for each consumer. Plan the cutover window for any integration that cannot be changed in the same session. Store the new secrets in your secrets manager, not in configuration files.
Non-Microsoft clients: LDAP, RADIUS and Linux hosts
Network devices, VPN concentrators and Linux hosts often authenticate through LDAP or RADIUS and need outposts or bind accounts that authentik provides. These clients rarely appear in the Entra admin center, so survey the network team and hosts directly. Confirm each device's supported protocol and certificate requirements before changing its directory target. Keep a rollback path for each device until its first successful login.
Migration sequence from inventory to decommission
The sequence moves SSO, LDAP and RADIUS consumers from Entra ID to authentik in controlled stages, so each application and device is proven on authentik before its old sign-in path is removed. Each step produces a record that the next one depends on.
Inventory applications, devices and Linux hosts
Build a register of every application, network device and Linux host that signs in through Entra ID today, or through a directory that Entra ID feeds. For each entry, record the protocol (OIDC, SAML, LDAP, RADIUS or SSH), the owner, the groups or conditional access policies it depends on, and the fallback login if the identity service is down. Export the user list from the Entra admin center as a baseline, and confirm with each app owner which attributes the app reads. The step is done when every consumer has a row in the register and each owner has signed off on their entry.
Select and prepare a pilot set
Choose a small group of OIDC or SAML applications with low business risk and a willing owner, and include at least one LDAP or RADIUS consumer if the network team is ready to test it. Stand up authentik on your own infrastructure, using the Docker Compose or Kubernetes guidance from the authentik documentation for test or production scale as fits your environment. Confirm your PostgreSQL version and backup approach before creating any provider. The output is a pilot list with named owners and a documented authentik test environment.
Run the pilot and record sign-off
Create authentik providers and applications for the pilot apps, map the claims and groups the app expects, and test sign-in with real user accounts, including MFA and password reset. Compare the token claims and group membership against what Entra ID issues to each app. Record any differences and fix them in authentik or in the app. The pilot is complete when each app owner signs a pilot sign-off that lists the tests run, the open issues and the accepted differences.
Parallel run with Entra ID still active
Keep Entra ID as the primary sign-in for all applications while authentik serves the pilot apps alongside it, and sync users and groups into authentik from your source directory. Watch sign-in logs, provider errors and worker jobs on both sides for a period agreed with the business owners. If you plan to use the Enterprise edition's Microsoft Entra ID integration to run both side by side, confirm its licensing and feature scope in writing before this step. The output is a parallel-run log and a list of resolved discrepancies.
Stage cutover per application and consumer
Move one application or one LDAP or RADIUS consumer at a time from Entra ID to authentik, starting with the lowest-risk group and ending with systems that have the most users. Before each cutover, record the rollback step, such as re-pointing the app to its Entra ID configuration, and the person who can execute it. Verify sign-in after each change and keep the old configuration in place until the next stage is stable. The output for each cutover is a dated change record and a tested rollback plan.
Retire Entra ID consumers and decommission
Once every application, device and Linux host in the register runs on authentik, remove the Entra ID enterprise application registrations, conditional access policies and group assignments that no longer have consumers. Keep a final export of Entra ID configuration and users under your retention rules, and confirm which Microsoft 365 sign-in dependencies remain, since those are outside this migration. The step closes when the register shows no active Entra ID consumers and the decommission record is approved by the identity owner and the business sponsor.
How authentik takes over LDAP and RADIUS duties
authentik is built from three runtime parts: a server container that runs the core application with an embedded outpost, a worker container that handles background tasks, and PostgreSQL, which stores all configuration and data except uploaded files. The outpost is the piece that matters for this migration, because it is where the LDAP and RADIUS endpoints your network devices and Linux hosts talk to are served. Before you cut over, map each Entra ID-dependent device to the provider it will use (LDAP, RADIUS or proxy) and confirm which outpost will answer it, since the embedded outpost on the server container may not be the right place for every workload. Ask your DeployOpen or authentik contact to confirm how outposts should be placed for your network segments.
Because PostgreSQL is the only stateful store besides uploaded files, your backup and restore plan is largely a database plan. authentik 2025.10 removed Redis entirely and moved caching, tasks, sessions and WebSocket functions onto PostgreSQL. The release notes warned of roughly 50% more PostgreSQL connections after upgrading, so check your connection limits, connection pooling and database sizing before you move production LDAP and RADIUS traffic onto it. Confirm the exact connection behavior for your target version in the authentik 2025.10 release notes and in your own load test, not from this summary alone.
The Docker Compose guide positions Compose for test setups and small-scale production and calls for a host with at least 2 CPU cores and 2 GB of RAM. Treat that as a floor for a lab or pilot, not a sizing for a directory that authenticates every VPN session, switch login and Linux SSH session in the organization. Production sizing should be based on your user count, authentication rate and the number of LDAP and RADIUS clients, and the authentik Kubernetes installation guide is the natural next read if you need separate worker scaling and high availability. Ask for a written sizing and failover design as part of the scope so that cost and hardware are defined before procurement.
How the migration differs by starting point
When Entra ID is the only identity source, the users and groups already live in the cloud, so the migration is mostly about moving applications and their sign-in paths. Non-Microsoft apps, network devices and Linux hosts each need a provider in authentik, and the user store in authentik has to be populated before any app is switched. Start by exporting the user list and group memberships from the Entra admin center, then decide which attributes authentik will hold as the source of truth.
- Inventory the enterprise applications: List every SAML, OIDC and password-based app registered in Entra ID, with its owner and sign-in method.
- Plan the user store: Decide whether authentik will hold passwords and MFA, or whether it will federate to Entra ID during the transition.
- Pick the first cohort: Move a low-risk group of applications first, such as internal tools with few users, to test provider mappings.
- Rebuild policies by hand: Conditional Access rules and group-based assignments do not transfer automatically and must be recreated as authentik flows and policies.
- Plan the cutover per app: Keep the Entra ID registration active until each application has been verified against authentik.
Confirm with your Entra ID licensing team which features your tenant uses today, since the migration scope depends on it.
When Entra ID is federated or synced from on-premises Active Directory, the directory of record usually stays in AD, and Entra ID is a downstream copy. Moving sign-in to authentik does not remove AD, so the work is about where authentication happens and how accounts are provisioned. authentik can connect to AD over LDAP as a source, which keeps passwords and group membership in one place while authentication moves.
- Keep AD as the source: Connect authentik to the domain over LDAP so user and group data stays under the existing directory owner.
- Check password and MFA paths: Determine whether users still type domain passwords, and whether MFA currently comes from Entra ID or another product.
- Account for hybrid sign-in: Microsoft 365 and other Entra-connected services may still depend on the sync, so those dependencies must be listed before anything changes.
- Sequence by application group: Move web apps that accept OIDC or SAML first, then LDAP-bound services, and leave Microsoft-connected services until last.
- Test group mappings: Confirm that AD group names resolve to the same access in authentik before any user is redirected.
Ask your identity team which sync scope and password hash settings are in use, because they change what authentik can read.
Some organizations need Entra ID and authentik to coexist for a long period, for example while a few applications stay on Entra ID for regulatory or contractual reasons. The Entra ID integration that authentik offers in its Enterprise edition is the feature that supports this model, and it is listed on the pricing page as an Enterprise-only feature. Because it is not part of the free edition, the license decision should come before the design, not after.
- Confirm the edition need: Verify with authentik that the Entra ID integration, with its exact scope, is included in the Enterprise tier you are considering.
- Define the source of truth: Decide which system owns each user attribute and each group during coexistence to avoid conflicting updates.
- Limit the overlap window: Set a written end date for each application that still signs in through Entra ID.
- Budget for two admin consoles: Staff must know which system governs which app, and audit logs will come from both.
- Document the Enterprise license terms: The authentik EE License governs the enterprise directory, so legal review belongs in the plan.
Ask the vendor for the current feature list and support terms in writing, since the Enterprise scope may change between releases.
In isolated networks, Entra ID cannot be reached, so the migration starts from a different baseline. The estate may depend on LDAP, RADIUS and SSH logins to Linux hosts, with little or no cloud sign-in. authentik can run on infrastructure you control, and its architecture is a server, a worker and PostgreSQL, which makes offline installation and patching a planning item rather than a cloud dependency.
- Plan the software supply chain: Mirror container images, packages and updates into the isolated network before installation, and record how each update is verified.
- Map RADIUS and LDAP clients: Network devices and Linux hosts that bind to LDAP or send RADIUS requests need explicit provider configuration and tests.
- Confirm the database approach: authentik stores its configuration and data in PostgreSQL, so backup, restore and replication must be designed for the isolated site.
- Check Kerberos needs: If Linux hosts need Kerberos, decide whether authentik's Kerberos support or a separate directory such as FreeIPA covers the requirement.
- Use the supported release lines: Check the authentik security policy for the versions currently receiving security fixes, and confirm how the project announces security releases in advance.
Confirm with your security team how patches will be approved and delivered into the network, because that process sets the upgrade pace.
What drives cost and duration of the move
This table lists the components that shape the cost and timing of moving SSO, LDAP and RADIUS duties from Entra ID to authentik. Read the one-time rows as project work and the recurring rows as the operating load you keep after cutover. Edition choice and the number of integrations are the two items most likely to change the quote.
| Driver | Why it changes cost or effort | One-time or recurring | How to keep it down or what to ask for |
|---|---|---|---|
| Non-Microsoft applications and integrations | Each SAML, OIDC or proxy application needs a provider, an application entry, claim mapping and a test cycle before cutover. authentik documents provider types for OAuth2/OIDC, SAML, LDAP, proxy, RADIUS, SCIM and others. | One-time | Inventory every app in Entra ID, group them by protocol, and ask the quote to state the count and provider type for each. |
| LDAP and RADIUS consumers | Network devices, Linux hosts and VPN concentrators each hold their own bind settings, base DNs and group filters. Each consumer must be re-pointed and tested, and some devices may need firmware checks. | One-time, with ongoing support for changes | List each device model and firmware version, and ask whether the quote covers testing against a non-production bind. |
| Conditional Access rules to redesign | Entra ID Conditional Access rules, which depend on Entra ID P1 or P2, must be rebuilt as authentik flows, stages and policies. Some rules will have no direct equivalent and need a documented compensating control. | One-time | Export the current rule set, mark which rules have no authentik equivalent, and ask for a written mapping as a deliverable. |
| User credential re-enrollment | Entra ID does not give administrators password hashes through a standard export, so users typically re-register passwords and MFA factors. Help desk volume and identity verification procedures drive the effort. | One-time, with a help desk load during cutover | Agree the verification method and cutover window in writing, and ask who staffs the help desk and for how long. |
| Edition choice: Open Source, Enterprise or Enterprise Plus | The free edition has community support only. Enterprise adds Microsoft Entra ID integration, ticket-based support for subscriptions over $1k, and other features. Enterprise Plus adds dedicated SLAs, multi-instance support and FIPS compliance. The pricing page sets the per-user and annual figures. | Recurring subscription where Enterprise is chosen | Compare the features you need against the pricing page, and ask for the subscription terms, the support model and the escalation path in the quote. |
| Hosting, PostgreSQL and upgrades | authentik runs as a server container, a worker container and PostgreSQL, which stores all data except uploaded files. The 2025.10 release notes say Redis is no longer used, and PostgreSQL connection counts rose by roughly 50 percent after upgrading. Sizing and upgrade planning follow from this. | Recurring | Ask the quote to size PostgreSQL connections, backup frequency and a tested restore, and to plan each security release, which the project announces at least 24 hours in advance. |
| Parallel running with Entra ID | Running both side by side adds directory sync, duplicate policies and a second set of logs to watch. The Enterprise-only Entra ID integration is one route for this. | Recurring until decommission | Set an exit date for Entra ID-dependent apps, and ask the quote to name who owns the sync and the decommission step. |
| Support, monitoring and security testing | Someone must watch identity logs, patch the platform and retest integrations after each release. These tasks recur for as long as authentik is in production. | Recurring | Ask whether the quote includes a retainer for upgrades, monitoring and periodic testing, and what response times the chosen edition provides. |
What usually goes wrong and how to prevent it
Most failed moves from Entra ID to authentik come from data that did not transfer, clients that expected a different directory shape, and platforms that drifted out of support. The cards below cover the failure points we see most often in this kind of migration, each with a check to run before cutover.
Password hashes not exported
Entra ID's standard user list CSV does not carry password hashes, so users cannot sign in to authentik with their existing passwords after cutover. Plan a password reset path or a staged login-on-first-use flow before the first user is moved. Ask Microsoft and your own tenant administrators which hash data, if any, you can legitimately extract, and confirm that answer in writing before you schedule the cutover.
LDAP bind DNs and attributes
Linux hosts, switches and other LDAP clients bind with a distinguished name and expect specific attribute names, such as sAMAccountName or uid. authentik's LDAP provider exposes its own base DN and attribute mapping, so a host configured against the old directory can fail silently or deny logins. Inventory every LDAP client, record its bind DN, search base and required attributes, and test each one against a non-production authentik LDAP outpost.
RADIUS shared secrets mismatched
Network devices store a RADIUS shared secret and the address of the server that answers them. A secret typed differently on the device and in the authentik RADIUS provider causes authentication to fail with no obvious error on the device side. Record the secret and the outpost address for each device, rotate any secret that has been shared in chat or tickets, and test a login from each device type before moving users.
Conditional Access rules not rebuilt
Entra ID Conditional Access policies, such as MFA for administrators or blocks by location, do not move to authentik automatically. authentik's policies and flows cover many of these patterns, but any rule you do not map explicitly will simply stop applying on cutover day. Export your current Conditional Access policy list, map each one to an authentik flow or policy stage, and mark the ones with no equivalent so the risk is accepted by an owner.
PostgreSQL connection limits after upgrades
authentik runs on PostgreSQL for configuration, cache, tasks and sessions. The 2025.10 release notes warn that upgrading can raise PostgreSQL connection counts by roughly 50%, which can exhaust a database sized for the earlier release. Before each upgrade, check the current connection limit and pooling setup, raise the limit or add a pooler where needed, and watch connection counts for the first days after the change.
Releases outside the supported line
authentik publishes security fixes only for the 2026.5.x and 2026.8.x lines, and announces security releases at least 24 hours in advance. A deployment left on an older version after cutover stops receiving those fixes. Assign an owner to subscribe to release announcements, set a patch window that allows for that 24-hour notice, and confirm the running version against the security policy at each review.
Questions buyers ask before moving from Entra ID to authentik
How long does a move from Entra ID to authentik take?
The duration depends on the number of applications, how many use SAML versus OIDC, how many LDAP or RADIUS clients point at the directory, and how much custom claim mapping or policy logic has to be rebuilt. No supplied figure gives a timeline, so ask for one based on an inventory of your own environment. Start by counting applications, network devices and Linux hosts, then group them by protocol and by how much they depend on Entra-specific features such as Conditional Access. A fixed-scope engagement sets the timeline in writing before work starts, and that scope should reflect your inventory rather than a generic estimate.
Can our internal team migrate to authentik without outside help?
Yes, a team with experience in identity protocols can do it, but the effort is usually concentrated in a few areas: rebuilding application registrations, testing each protocol path, and cutting over users without locking anyone out. authentik documents its providers and flows publicly, so your engineers can start from the provider documentation. Consider whether the team has spare capacity for parallel running, rollback planning and post-cutover support. DeployOpen plans, implements, integrates and hardens self-hosted platforms in your own infrastructure, and most engagements are fixed-scope with the scope agreed in writing first.
What does our team need to provide before the migration starts?
Plan to provide the following before any build work starts:
- An inventory of applications, with their protocols, redirect URIs, owners and attribute needs
- A list of network devices, Linux hosts and RADIUS or LDAP clients that bind to the directory
- Access to the infrastructure where authentik will run, including container hosts, PostgreSQL and backup targets
- Decisions on group structure, MFA policy and which user attributes must survive the move
Confirm with authentik which current release and deployment method (Docker Compose or Kubernetes) fit your environment, since the Compose guide positions that method for test setups and small-scale production.
Can Microsoft 365 sign-in stay on Entra ID after the move?
Yes, this is a common pattern, and it is usually the lowest-risk path. Microsoft 365 and Entra-joined Windows devices depend on Entra ID, so moving only the non-Microsoft applications, network devices and Linux hosts to authentik leaves those dependencies in place. Confirm with Microsoft which sign-in paths your licenses and clients require before you change anything. Only move Microsoft 365 sign-in if you have tested it, because it involves federation, identifier matching and provisioning decisions that are separate from the rest of the migration.
Do we need the Enterprise Entra ID integration to run both systems?
Not for the core migration. The free edition supports OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy authentication, so you can run authentik next to Entra ID for non-Microsoft apps, network devices and Linux hosts without the paid integration. The authentik pricing page lists Microsoft Entra ID integration as an Enterprise feature, so you need it only if your design depends on that specific connection, for example to sync or federate identities between the two. Ask authentik to confirm the current edition terms and which features your design needs before you decide.
What are authentik's license terms for the core and enterprise code?
The core of authentik's repository is licensed under the MIT license, which the project records with the SPDX identifier MIT. Code in the authentik/enterprise/ directory falls under a separate enterprise license defined in that directory, and the pricing page refers to it as the authentik EE License. Your legal team should read both license files and confirm how they apply to your intended use, including self-hosting, modification and internal distribution. Ask authentik for written confirmation of any term that affects your deployment.
How much does authentik itself cost compared with Entra ID?
The free edition has no license fee, but the cost of ownership includes the servers, PostgreSQL, backups, monitoring, staff time, and any paid support or Enterprise subscription you choose. The authentik pricing page lists Enterprise at $5 per user per month billed annually plus $0.02 per external user per month, and Enterprise Plus starting at $20k annually. Those are authentik's list prices as published on that page, and you should confirm current figures before budgeting. Compare them with your own Entra ID licensing and the work of rebuilding applications, rather than with the license line alone.
How DeployOpen scopes and runs an authentik migration
DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted authentik inside your own infrastructure, whether that is your cloud accounts, your data centers or an isolated network. Work usually runs as a fixed-scope engagement. Before anything starts, the scope, deliverables and timelines are agreed in writing, so the first decision is which Entra ID duties move in the first phase. Typical candidates are OIDC and SAML sign-in for non-Microsoft applications, LDAP binds for Linux hosts and directory-backed services, and RADIUS for network devices. Microsoft 365 sign-in, Exchange and SharePoint are usually excluded from that first phase. Ask for the list of applications, protocols and user groups in scope, and for each one the owner who signs off on cutover.
The written scope should name the authentik components that will be built and who operates them. Expect the deployment to include the server and worker containers, the PostgreSQL database that holds configuration and data, the outposts that serve LDAP and RADIUS, and the directory source that authentik reads from. Ask DeployOpen to confirm how the Entra ID side is handled: whether Entra ID stays the source of identity while authentik federates to it, or whether authentik becomes the system of record for the migrated groups. If you are considering the Enterprise Entra ID integration to run both side by side, confirm its edition terms with authentik directly, since the pricing page lists it as an Enterprise feature. Hardening, backup and restore testing, and documentation should be named as separate deliverables so that each can be accepted on its own.
After go-live, the cost and risk shift from building to running. Ask for a written plan covering upgrades, since authentik publishes security-supported release lines and announces security releases in advance, and a restore test for the PostgreSQL backups. Retainers are available for ongoing support, scheduled upgrades and continuous testing, and they should be priced separately from the initial scope so you can decide whether to run the platform in-house after handover. The fixed-scope quote does not cover certification. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue any attestation, so confirm with your assessor which evidence they will need before the work is scoped.
