Entra ID or authentik: which fits your Microsoft Entra ID alternative decision
Entra ID fits best where Microsoft 365 and Azure sign-in are already the center of the estate and where Conditional Access, risk-based policies and identity governance are already licensed and used. If your renewal is driven mainly by a licensing change, the first question is which Entra ID P1, P2 or governance features your staff actually rely on, and whether those are bundled in plans you already pay for. authentik fits best when the pressure is to run SSO on your own servers and to serve non-Microsoft apps, network devices and Linux hosts through OIDC, SAML, LDAP, RADIUS and remote access providers. Its free edition covers those protocols, but the Entra ID and Google Workspace integrations, along with mTLS, privileged access management and ticket-based support, sit in the Enterprise tier described on the authentik pricing page.
The decision turns on three checks. First, inventory the Entra ID features in use: Conditional Access rules, Identity Protection risk policies, access reviews and entitlement management, and list which of them have an authentik equivalent (typically policies and flows) and which do not. Second, decide whether you need authentik's Entra ID integration to run both systems side by side, for example during a staged cutover where Microsoft 365 stays on Entra ID. That integration is an Enterprise feature, so it belongs in the quote. Third, name who will operate the platform. authentik runs as a server container, a worker container and PostgreSQL, and its architecture documentation should be read by whoever owns upgrades, backups and patching. If that team is small, ask a partner for a fixed-scope operating model before committing to a self-hosted identity provider.
Which platform fits which scenario
This table compares Microsoft Entra ID and authentik across common identity scenarios and names the better fit for each. Read it by finding your main use case; where Microsoft 365 or Azure sign-in is central, Entra ID remains the better fit even if authentik covers the application side.
| Scenario | Better fit | Reason |
|---|---|---|
| SSO for SaaS and internal web apps | authentik | OIDC, OAuth 2.0 and SAML providers are in the free edition, so apps outside Microsoft 365 can sign in without an Entra ID license per user. |
| RADIUS for VPN or Wi-Fi | authentik | The free edition includes a RADIUS provider, so VPN concentrators and wireless controllers can authenticate against authentik directly. |
| LDAP for Linux hosts and network gear | authentik | The free edition includes an LDAP provider for hosts and switches that bind to a directory; confirm the exact attributes each device needs. |
| Conditional Access for admins | Entra ID | Conditional Access needs Entra ID P1 and risk policies need P2; authentik has no direct equivalent, so policies must be rebuilt as authentik flows and policies. |
| Microsoft 365 sign-in | Entra ID | Exchange, Teams and SharePoint sign-in depend on Entra ID, and authentik cannot replace that tenant for Microsoft clients. |
| Azure resource and subscription access | Entra ID | Azure role assignments and managed identities are built on Entra ID, so the Azure control plane stays there. |
| Running both during a transition | Both, with authentik Enterprise for Entra ID integration | Entra ID stays the source for Microsoft workloads while authentik serves non-Microsoft apps; the Entra ID integration is an Enterprise feature, so confirm licensing first. |
How authentik covers the protocols that non-Microsoft apps need
Most non-Microsoft applications, network devices and Linux hosts need one of a few protocols, and authentik maps each to a provider type. The cards below cover what each provider does, which parts of the free edition apply, and what to confirm in your own environment before you move sign-in off Entra ID.
OIDC and OAuth 2.0 applications
The OAuth2/OIDC provider is the usual route for modern web and mobile applications that support OpenID Connect. Each application gets a provider and an application entry in authentik, with the client ID, redirect URIs and scopes set per application. Entra ID app registrations have to be rebuilt as authentik providers, and the redirect URIs must match exactly. Confirm that each application's library accepts the claims authentik issues, and map the email, groups and name attributes to the claim names the app expects. The free edition supports this provider with community support only.
SAML 2.0 applications
The SAML provider covers enterprise applications that still expect SAML assertions, such as many SaaS and older line-of-business tools. You must exchange metadata with each service provider, confirm the entity ID and assertion consumer URL, and set the NameID format the app requires. Entra ID enterprise apps often use custom claim mappings, so compare each one against the authentik attribute mappings before cutover. Test signed assertions and the logout behavior, since SAML single logout is a common gap during migration.
LDAP for directory-bound apps
The LDAP provider exposes authentik users and groups to applications and appliances that bind to a directory and cannot use SSO. Typical examples are older wikis, NAS devices and VPN concentrators that query a directory for group membership. Confirm the base DN layout, the bind account and the group attributes each client expects, because many clients hard-code attribute names from Active Directory. Plan for the password and group data that the LDAP view exposes, and test every client's search filters before you point it at authentik.
RADIUS for network devices
The RADIUS provider lets switches, firewalls, wireless controllers and VPN gateways authenticate users against authentik. Entra ID does not act as a RADIUS server for these devices, so many teams run NPS or a separate appliance today, which makes this a replacement decision rather than a simple switch. Confirm the shared secret handling, the authentication methods each device supports (PAP, MS-CHAPv2 or EAP), and how group-based authorization returns attributes to the device. Test failover, since a single RADIUS endpoint becomes a dependency for network access.
Proxy provider for apps without SSO
The proxy provider places authentik in front of web applications that have no native SSO support, so authentik handles sign-in and passes identity headers to the app. It suits internal admin consoles and legacy intranet sites. Confirm that the app can trust forwarded identity headers only from the proxy, because a direct connection that bypasses it would skip authentication. Check how the app handles session timeouts and whether WebSocket or file upload traffic passes through the outpost correctly. Proxy authentication is part of the free edition.
Remote access control for Linux and desktop sessions
The remote access control (RAC) provider brokers connections to hosts through protocols such as SSH, RDP and VNC, so users sign in through authentik before reaching a session. This is the provider to examine when Linux hosts or Windows servers currently rely on Entra ID for sign-in or for privileged access. Confirm which protocols and client tools your administrators use, how session recording is handled, and which accounts stay local for break-glass access. Check the edition boundary for each feature before you commit, since authentik's pricing page lists privileged access management as an Enterprise feature.
Capability comparison from supplied facts
This table compares Microsoft Entra ID with the authentik free edition and Enterprise on the capabilities that decide whether authentik can take over sign-in for non-Microsoft apps, network devices and Linux hosts. Where the supplied facts do not confirm a capability, the cell tells you what to verify with the vendor. Use it as a checklist of requirements to confirm before you plan a migration.
| Capability | Microsoft Entra ID | authentik (free edition and Enterprise) |
|---|---|---|
| Protocols (OIDC, SAML) | OIDC and SAML for enterprise and app registrations. Confirm the exact flows your tenant license includes. | OIDC, OAuth 2.0 and SAML providers in the free edition. |
| LDAP, RADIUS and SCIM | No RADIUS service. LDAP needs Entra Domain Services. Confirm SCIM connectors for each app. | LDAP, RADIUS and SCIM providers in the free edition. Remote access control is also listed as a provider type. |
| Conditional Access and risk-based policies | Conditional Access requires Entra ID P1. Risk-based policies are tied to P2. Confirm which conditions your license covers. | Policies and flows control access. Confirm with authentik which Entra conditions and risk signals have a direct equivalent. |
| Governance and privileged access | Governance is a separate add-on. Privileged Identity Management is part of P2. Confirm both with Microsoft. | Privileged access management is an Enterprise feature. Lifecycle governance is not covered by the supplied facts; confirm with authentik. |
| Licensing | Per-user licenses, with P1 and P2 priced separately. Get current prices from Microsoft or your reseller. | Open Source core is free. Enterprise lists $5 per user per month billed annually plus $0.02 per external user per month (authentik pricing page). |
| Source availability | Proprietary cloud service operated by Microsoft. | Core code is MIT licensed on GitHub. The enterprise directory is under the separate authentik EE License. |
| Hosting options | Microsoft cloud only. Tenant location is fixed at creation. Confirm data location terms with Microsoft. | Self-hosted with Docker Compose or Kubernetes on PostgreSQL in your own infrastructure. Redis is no longer used from the 2025.10 release. |
| Support | Microsoft support plans. Confirm the plan and response terms in your agreement. | Community Discord in the free edition. Ticket-based support in Enterprise, with SLAs and FIPS compliance in Enterprise Plus. |
Where identity data lives and who controls it
Entra ID and authentik differ mainly in where the identity store sits and who runs it. This section compares the four points that decide your data position: where each platform keeps data, who operates it, and what evidence you must collect yourself.
Entra ID data in Microsoft's cloud
Entra ID keeps directory objects, sign-in logs, and MFA and authentication data in Microsoft-operated cloud services. You do not choose the physical hosting of the directory, and you rely on Microsoft's documentation for where data is stored and processed. Confirm with Microsoft which data-location commitments apply to your tenant, which log categories you can export, and how long they are retained in your licensing tier. Also confirm where sign-in logs for non-Microsoft apps are processed.
authentik data in PostgreSQL
In an authentik deployment, PostgreSQL stores all configuration and data except uploaded files, including users, applications, providers, flows and policies. That makes the database the main asset to protect, back up and restore. Ask your team who owns the database, where it runs, how it is encrypted at rest, and where backups are kept. Because the server and worker containers hold no authoritative state of their own, the database location largely determines your data residency.
Who operates each platform
Microsoft operates Entra ID as a service, and your administrators control tenant configuration, not the underlying infrastructure. With authentik, your team or a contracted partner operates the containers, database, upgrades and TLS certificates, so patching and incident response sit with you. The free edition offers community support only, while Enterprise adds ticket-based support. Write down who receives security advisories, how fast security releases are applied, and who is on call for an identity outage.
Compliance evidence you gather
Whichever platform you choose, your organization must produce evidence that access controls operate: access review records, configuration exports, change logs, backup test results and MFA enrollment reports. For Entra ID, much of this comes from Microsoft-provided logs and reports. For authentik, you must generate and retain it yourselves. DeployOpen can prepare controls and evidence for a compliance assessment, but independent auditors issue any audit report, attestation or certification. Agree with your auditor early which evidence they will accept.
Where Conditional Access and governance do not map one to one
Conditional Access in Microsoft Entra ID needs a P1 license, and risk-based policies need P2, so the first question is which of your access decisions depend on those tiers. authentik does not copy Entra ID's Conditional Access engine. It expresses access decisions through flows, stages and policies that are bound to applications, users and groups. Common rules such as requiring MFA for administrators, restricting sign-in to certain groups, or requiring a second factor for a sensitive application can usually be built this way, but only for applications that authentik actually fronts. A rule written in Entra ID does nothing to an application that still authenticates against another provider, so inventory every target application and confirm its sign-in path before you count a policy as migrated.
The mapping works under specific conditions. Each app must be routed through authentik as an OIDC, SAML, LDAP, proxy or RADIUS provider. The authentication flow needs an MFA stage with the factors your users enrolled, and the policy bindings must target groups that match your directory, not individual users, so that joiner and leaver changes flow through without manual edits. Test each binding with a non-admin test account and with an account that has no enrolled factor, and record the result. Then check what Entra ID evaluates that authentik may not: sign-in risk and user risk signals, device compliance and named location conditions. Confirm with the authentik documentation and your own test results whether each of these can be expressed in your target version, and plan a compensating control, such as shorter session lifetimes or step-up on sensitive actions, for any signal you cannot reproduce.
Governance is a separate question. Microsoft Entra ID Governance, an add-on to P1 or P2, covers lifecycle workflows, access reviews and entitlement management. authentik's group and policy model can restrict who holds access, but it does not, from the supplied material, provide a built-in certification campaign or joiner, mover and leaver workflow equivalent to these features. Treat access reviews as a gap to close with a separate tool or a documented manual process, and decide who signs off on each review and how often. The sibling page on Entra ID Governance covers that replacement in detail. Before cutover, ask the vendor to show a complete review cycle in a test environment, because an access policy that is enforced but never recertified will not satisfy an auditor.
What drives the cost of each side
On the Entra ID side, the license is the most visible cost, but it is priced per user and tiered. Conditional Access and the other P1 controls, the risk-based P2 features and the Entra ID Governance add-on each carry their own per-user charge, so the first step is to inventory which tier each user already holds. Some Microsoft 365 plans include Entra ID P1 or P2 entitlements, which can reduce the incremental spend for users already licensed for those suites. Confirm with your Microsoft account team or reseller which entitlements apply to every user in scope, and whether the agreement is an Enterprise Agreement or a CSP arrangement, because those change the price you pay. Your own effort to rebuild app registrations, groups, claims mapping and policies is a cost that no Microsoft invoice shows.
On the authentik side, the free Open Source edition has no license fee, so the recurring costs are infrastructure, database operations and staff time. The authentik pricing page lists Enterprise at $5 per user per month billed annually, plus $0.02 per external user per month, and Enterprise Plus starting at $20k annually. The Enterprise features most relevant to a migration are the Microsoft Entra ID integration, privileged access management and ticket-based support. The Docker Compose guide calls for at least 2 CPU cores and 2 GB of RAM for test setups and small-scale production, and production sizing will be larger. Ask who patches PostgreSQL, tests upgrades and restores backups, because authentik keeps all configuration in PostgreSQL. The 2025.10 release notes warned of roughly 50% more PostgreSQL connections after upgrading, so size connection limits before the upgrade. Security fixes cover only the supported 2026.5.x and 2026.8.x lines, so an upgrade calendar is a recurring cost.
One-time costs include discovery, designing flows and policies, moving applications, testing and cutover. Recurring costs include licenses, hosting, database and backup operations, upgrade testing and support. When requesting a written quote from authentik or a partner, ask for the edition and the exact per-user counting rule, including how external users are measured, which support tier is included, and whether Enterprise Plus SLAs or FIPS compliance are part of the scope. From DeployOpen, the quote follows a written, fixed scope covering applications, policies, data migration, hardening, backups, upgrades and documentation. Ask each party to state which items are one-time, which are annual and which depend on user counts, so the two options can be compared on the same basis.
How a move from Entra ID to authentik typically proceeds
The sequence moves application sign-in, LDAP and RADIUS duties from Entra ID to authentik one application class at a time, so each cutover is tested, reversible and recorded before the next one starts.
Inventory applications, protocols and Entra ID objects
Start by listing every application, network device and Linux host that signs in through Entra ID, along with the protocol each one uses (OIDC, SAML, LDAP, RADIUS or a remote access path), its owner and its redirect or endpoint settings. Record the Entra ID objects behind each sign-in: enterprise applications, app registrations, groups, Conditional Access policies and any on-premises sync. The app owners and the admins who manage the tenant should review the list. The step is done when every item has a named owner and a protocol, and when the team has agreed which applications are in scope for the move and which stay on Entra ID.
Deploy authentik in a test environment
The network or platform team installs authentik in a non-production environment, using the Docker Compose guide for a small test setup or the Kubernetes installation for a cluster. Confirm the host meets the documented minimum of 2 CPU cores and 2 GB of RAM for Compose, then confirm that the PostgreSQL database, the server and worker containers, and the DNS and TLS names for the test endpoints are in place. The step is done when administrators can sign in to the test instance, the health checks pass and a test user can complete a basic login.
Configure providers for each application class
Build authentik providers and applications that match the inventory. OIDC and OAuth2 cover modern web apps, SAML covers older enterprise apps, LDAP and RADIUS cover network devices and Linux hosts, and the proxy provider covers apps without native federation. Map the claims, groups and attribute names that each application expects so they match what Entra ID sent before. The application owners should test each configuration in the test environment. The step is done when each application class has a working configuration and a written test script that the owners have signed off.
Pilot with a small group of users
Choose a small group of users and a few low-risk applications, then point those applications at authentik for real sign-ins. Watch authentication logs, failed logins, group membership and session behavior during the pilot. Confirm which Entra ID Conditional Access and MFA rules still apply to these users and which have no direct authentik equivalent, and record the gaps for the security team. The step is done when the pilot users complete their normal work without help desk tickets and the owners accept the results in writing.
Run both platforms side by side where needed
Some applications, especially those tied to Microsoft 365 or other Entra ID dependencies, must keep signing in through Entra ID for a period. Keep those applications on Entra ID and document each exception with its reason and owner. Confirm which user sources feed both platforms and who is responsible for keeping group membership consistent. The step is done when the team has a register of applications on each platform and a clear rule for which platform is authoritative for each user attribute.
Cut over application by application
Move one application at a time from its Entra ID binding to its authentik provider, starting with the lowest-risk items. Update the application's redirect URIs, endpoints, certificates or RADIUS and LDAP client settings, run the agreed test script and keep a documented rollback path that restores the previous Entra ID binding. Avoid switching several applications in one change window. The step is done when each application has passed its test script in production, the owner has confirmed access and the change record is complete.
Retire old bindings and document the result
After each application has been stable for the agreed period, remove its unused Entra ID enterprise application, app registration, secrets and certificates, and remove any group or policy that no longer applies. Update the configuration inventory, runbooks and access reviews so they reflect authentik as the source for these applications. The step is done when the old bindings are removed, the inventory shows one authoritative platform per application, and the remaining Entra ID dependencies are listed with their reasons.
Questions buyers ask before choosing authentik over Entra ID
Can authentik replace Entra ID for all sign-in?
No, not as a single switch. authentik can take over SSO for non-Microsoft applications through its OIDC, SAML, LDAP, RADIUS and proxy providers, which covers many web apps, network devices and Linux hosts. Microsoft 365 and Entra-joined Windows devices depend on Entra ID itself, and the free edition does not connect to Entra ID as a source. Map every sign-in path first, including which apps need Microsoft-issued tokens, and confirm each one against the authentik providers documentation before you plan the cutover.
What is the Enterprise Entra ID integration for?
It is for running both identity systems side by side during a transition, not for replacing Entra ID. The authentik pricing page lists Microsoft Entra ID integration as an Enterprise feature, alongside Google Workspace integration, mTLS client certificate authentication and privileged access management. Ask the vendor exactly which synchronization and login flows the Entra ID integration covers, and whether it supports the Conditional Access signals you rely on today. Pricing is listed per user per month, plus a per-external-user charge, so count users and external accounts before you request a quote.
How much effort and time does a pilot need, and what drives it?
The effort depends on how many applications, protocols and user sources you move, not on the software install itself. Each application needs its provider, redirect URIs, claims and group mappings rebuilt and tested, and each network device or Linux host needs its LDAP or RADIUS binding verified. The authentik Docker Compose guide positions Compose for test setups and small-scale production and calls for at least 2 CPU cores and 2 GB of RAM as a starting point. Duration is not published in the sources, so ask for a written scope with the application count and test plan before setting a date.
Can our in-house team run the migration without outside help?
Yes, many teams can, provided they have people who already understand OIDC, SAML, LDAP and PostgreSQL operations. The skills that matter most are directory design, certificate and key handling, backup and restore of the database, and upgrade testing. Check the team's experience with the authentik architecture, which runs a server container, a worker container and PostgreSQL, and confirm who will carry the on-call and patching work. If those skills are thin, a fixed-scope engagement with DeployOpen can cover planning, implementation, hardening and documentation, with ongoing support available as a retainer.
What does the work need from our team?
It needs named owners for identity data, application owners who can test their own sign-in, a network and security contact for firewall and certificate changes, and someone who approves each cutover step. Your identity team should also agree on the supported authentik release line before going live, since the security policy lists specific supported versions that receive fixes and the project announces security releases at least 24 hours in advance. Confirm the upgrade path and who monitors the release notes, because each release can change configuration or resource needs.
What happens to our Conditional Access rules?
They do not move automatically, and authentik does not provide an identical copy of Entra ID Conditional Access. Each rule has to be reviewed and rebuilt as an authentik policy, stage or flow where the signal is available, such as group membership, application binding or MFA enforcement. Some risk-based behavior tied to Entra ID P1 or P2 signals may have no direct equivalent, so list every active rule, record what it protects, and decide whether it is replaced, accepted as a gap or kept on Entra ID. Confirm each mapping in a test tenant before retiring the original policy.
Does authentik need a license fee to start a pilot?
The free edition is available under the MIT license for the open-source core, so a pilot can start without a subscription. The free edition provides community support only, through Discord, and does not include the Enterprise features. The authentik pricing page lists an Enterprise tier with ticket-based support for subscriptions over $1k, and an Enterprise Plus tier starting at $20k annually. Ask whether you need Enterprise features for your use case before the pilot, and ask what internal support hours are needed if you stay on the free edition.
How DeployOpen helps evaluate, implement or migrate authentik
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, including authentik. For Microsoft Entra ID vs authentik, we start by mapping which sign-in paths actually move off Entra ID and which stay on Microsoft 365, then build and hand over only the parts agreed in writing.
How we scope
- Inventory every non-Microsoft app, network device and Linux host that signs in through Entra ID today.
- Record which Entra ID P1 or P2 Conditional Access rules need an authentik flow or policy equivalent.
- Agree deliverables and timelines in writing before work starts, since most engagements are fixed-scope.
How we build
- Deploy authentik in your own cloud account, data center or air-gapped network, with PostgreSQL as the data store.
- Configure OIDC, SAML, LDAP and RADIUS providers for each application and device in the agreed scope.
- Test sign-in paths, failover behavior and the Enterprise-only Entra ID integration if you decide to run both side by side.
How we hand over
- Document each provider, application mapping, policy and recovery procedure so your team can operate the instance.
- Set up backup and restore runbooks, including the PostgreSQL backups that hold all authentik configuration and data.
- Prepare evidence of configuration and access controls for your compliance assessors, who alone issue any audit opinion.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after handover.
- Plan authentik version upgrades against the supported release lines published in the project security policy.
- Confirm the edition you need with authentik before go-live, since support levels differ across the free and paid editions.
