Where Microsoft Identity Manager cost comes from and where midPoint shifts it
midPoint carries no license fee, so the comparison turns on what Microsoft Identity Manager (MIM) 2016 pulls in around it. MIM runs on Windows Server, a SQL Server database and, for the Portal and request workflows, a SharePoint dependency, and each of those carries its own license, support and patching cycle. If your organization also licenses Microsoft Entra ID P1 or P2 for the support route or related governance features, that cost sits alongside the MIM stack. Start by pulling the licensing position from your own Microsoft agreement and listing every server, database and SharePoint instance that exists only to serve MIM, because that list is the cost you can actually remove. Self-hosting moves the cost into people and infrastructure. The largest one-time item is migration: inventorying management agents, rules extensions and Portal workflows, rebuilding attribute flows as midPoint resources and object templates, and running both systems in parallel. Recurring costs include Linux and PostgreSQL operations, a sticky load balancer and shared database for multi-node deployments, and staff who understand Java, ConnId connectors and midPoint's object model. An optional Evolveum support subscription adds a recurring fee for bug resolution and an SLA, and the page lists no prices, so ask Evolveum for a quote tied to your deployment size.
Self-hosting tends to cost less where the MIM stack is oversized for what it does. Fewer per-platform licenses and fewer Windows and SQL instances mean the recurring license line can shrink, and a PostgreSQL and Linux footprint is often cheaper to patch and back up. Connectors are open source, so connector maintenance is an engineering cost rather than a vendor charge, although custom connectors for legacy targets still need code owners. The outcome depends on your own Microsoft agreement, the number of connected systems and identities, and how many people already run Java or PostgreSQL in production. Ask your Microsoft account team which MIM, SQL Server, Windows Server and Entra ID licenses you hold and which renew before January 2029. Then estimate internal staff time for each phase, and request a written scope from any implementation partner so that migration, hardening and support appear as separate line items you can compare.
Microsoft Identity Manager cost components against midPoint, one by one
This table sets each cost component of running MIM 2016 beside the matching component of a self-hosted midPoint deployment, marking whether it is one-time or recurring. Licensing terms for Windows Server, SQL Server, SharePoint and Entra ID must be taken from your own Microsoft agreement, not assumed, so treat the commercial column as a checklist of what to confirm. The main takeaway is that midPoint removes license fees from the stack, while the effort shifts toward implementation, connector upkeep and internal skills.
| Cost component | Commercial side (MIM 2016) | Self-hosted side (midPoint) | One-time or recurring |
|---|---|---|---|
| License or subscription | MIM 2016 licensing and any Client Access Licenses for users, confirmed in your Microsoft agreement | No license fee; midPoint is dual-licensed under EUPL-1.2 and Apache 2.0 | MIM: confirm recurring terms. midPoint: none for the software |
| Evolveum support (optional) | Not applicable; Microsoft support is tied to the product lifecycle | Optional Product Support or Platform Subscription, with 8x5 next-business-day or 24x7 SLA options; no prices published | Recurring, if chosen. Ask Evolveum for the quote |
| Server operating system | Windows Server licenses for MIM Sync, Service and Portal hosts, confirmed in your agreement | Linux in a virtual machine or Docker images; OS licensing depends on your distribution | Recurring for Windows; one-time setup for Linux images |
| Database platform | SQL Server licenses and edition for the MIM databases, confirmed in your agreement | PostgreSQL as native repository, ideally on a separate database server; typically no license fee | Recurring for SQL Server; PostgreSQL has no license fee |
| SharePoint and Portal | SharePoint farm for the MIM Portal, with its own servers, licenses and administration | No portal dependency; midPoint ships its own web user interface | Recurring for SharePoint; one-time build effort for midPoint UI customization |
| Entra ID route | Entra ID P1 or P2 licensing if you take the extra support route or use related features, confirmed with Microsoft | Not needed for midPoint itself; Entra ID is a connected target through the Microsoft Entra ID (Graph API) connector | Recurring, if licensed for MIM-related features |
| Connector and rules-extension maintenance | Management agents, custom rules extensions and MIM-specific code maintained by staff or partners | ConnId connectors (Java) for LDAP, Active Directory, SCIM2, Entra ID and others; custom connectors need Java skills | Recurring; scales with the number of connected systems |
| Implementation and migration | Existing MIM design, workflows and documentation carried over, often with a dependency on past consultant knowledge | New object templates, resources and roles; parallel running against Active Directory before switching off MIM sync | One-time; effort depends on the number of management agents and workflows |
| Infrastructure and hosting | Virtual or physical servers for MIM components, plus backup and monitoring | Virtual machines or containers for midPoint nodes, a sticky load balancer for multi-node, and a shared database | Recurring for compute, storage and backup |
| Internal skills and support | Staff familiar with MIM Synchronization Service, Portal and SharePoint administration | Staff or a partner with Java, PostgreSQL, Linux and ConnId skills; upgrades track midPoint releases | Recurring; ask whether skills are in-house or contracted |
Why the Windows, SQL and SharePoint stack carries recurring weight
The recurring weight of Microsoft Identity Manager comes from the number of Microsoft platforms it depends on. MIM 2016 runs the Synchronization Service, the Portal and its SharePoint dependency, and each layer rests on a Windows Server host and a SQL Server database. Each of those products has its own license terms, its own patch releases and its own backup and restore procedure. Before you compare totals, list every server role, SQL instance and SharePoint component in the current MIM environment and confirm which licenses cover each one, including any Software Assurance or subscription terms your agreement carries.
Each layer also adds an upgrade and security patch cycle that the operations team has to schedule and test. A cumulative update to Windows Server can affect the MIM service account, a SQL Server update can change database behavior the sync rules depend on, and a SharePoint fix can break the Portal workflows. These cycles overlap, so a single maintenance window often has to coordinate three vendors' release calendars. Ask your team to count the patch events per year across the whole chain, because that count is the operational cost that rarely appears on a license invoice.
A midPoint deployment moves that cost into components you can name and version yourself. midPoint is a Java application, so the team chooses the Java runtime, and Evolveum's system requirements recommend Java 25 for version 4.11 and later (Java 21 supported) and Java 21 for 4.10 and older (Java 17 supported). Its repository is PostgreSQL, which Evolveum recommends running on a separate database server where possible. Hosting can be a Linux virtual machine or Docker images. Each of these has a documented version and an upgrade path, so the recurring work becomes a planned, versioned set of updates that your team controls and tests against its own environment.
What moves the comparison: identities, connected systems and availability
The comparison between Microsoft Identity Manager and self-hosted midPoint is driven less by the license line items than by how much the deployment has to carry. Scale, the number of connected systems, workflow depth, availability targets, staffing and existing Entra ID licensing each push the totals up or down on both sides. Check these six drivers against your own estate before you compare figures.
Identity count and connected systems
Identity volume and the number of target systems set the size of the database, the sync load and the connector work on both sides. midPoint is documented as scaling to very large identity counts, but your own volume determines the server sizing and the PostgreSQL tier you need. Ask your team for a count of users, groups, service accounts and connected systems, split by source and target, and note which systems need a new connector. Each connected system adds configuration and testing effort that recurs whenever the target changes.
Management agents and rules extensions
On the MIM side, each management agent and each custom rules extension is code that must be kept working through upgrades and patches, so the count of these components is a direct maintenance driver. On the midPoint side, the equivalent work is the mapping of resources, object templates and ConnId connector configuration. Count the agents, rules extensions and scripts you run today, and flag any that depend on components already out of support. The more custom logic you carry, the more migration effort you should budget for.
Portal workflows and approvals in use
Approval chains, self-service requests and certification campaigns are often where the Microsoft Identity Manager Portal and its SharePoint dependency carry the most custom work. midPoint covers access requests, approvals and certification as built-in features, which can reduce custom development but still needs configuration and testing. Document each approval workflow, its owners and its escalation paths. Workflows that are only used by a few teams may be cheaper to simplify than to rebuild.
Availability and high-availability needs
A single midPoint node is simpler to run, while a multi-node deployment needs a sticky HTTP load balancer, a shared central database, cache invalidation between nodes and Quartz for distributed task scheduling. Each of these adds infrastructure and monitoring work that recurs. Define the recovery time and recovery point your business requires before you size either platform, because redundant servers, database replicas and failover testing are the costs that rise fastest with availability targets. Confirm the exact sizing with Evolveum's system requirements.
In-house skills and staffing
Running Microsoft Identity Manager well requires Windows Server, SQL Server and SharePoint administration alongside MIM-specific knowledge. Running midPoint requires Java, PostgreSQL and Linux operations, plus ConnId connector knowledge. Compare the skills you already hold with the skills you would need to hire, train or contract. Whether you buy Evolveum subscriptions or an implementation partner's support changes how much of that gap your own staff must cover. Ask any partner for a written split of responsibilities.
Entra ID licensing tier already held
If your organization already holds Entra ID P1 or P2, some of the extended support route for MIM may be partly covered by licenses you pay for anyway, while a self-hosted midPoint deployment would not use those licenses for provisioning. Confirm which Entra ID tier you hold, which features it enables and whether any MIM dependency relies on it. Treat the Entra ID cost as a shared line item, not as a saving, unless your licensing terms show otherwise.
What midPoint costs by support route
Self-supported midPoint carries no license fee, because the code is published under the EUPL-1.2 and Apache 2.0 licenses and Evolveum does not run an enterprise edition. The cost sits in people and time. Your own engineers, or an implementation partner you hire, install, configure, patch and operate the platform. Most of the spend is one-time build work followed by recurring operations, and it is paid to the staff or firm doing the work, not to Evolveum.
- Who is paid: your platform, identity and security staff, or a partner, for installation, connector work, object templates, testing and cutover.
- One-time work: building the resources and ConnId connectors you need, then migration testing against each connected system.
- Recurring work: Java and PostgreSQL patching, midPoint upgrades, backups, monitoring and on-call cover for your own defects.
- Support decision inputs: midPoint 4.8 (Curie) is a long-term support release supported until October 17, 2028, and 4.10 (Braille) is a feature release supported until November 26, 2027. An LTS line reduces upgrade frequency but does not remove the need for your own security fix process.
- Skills risk: the cost depends on keeping staff with midPoint and Java experience, or on a partner who can cover that gap.
Ask any partner for a written scope that names the release line you will run, the upgrade commitments and who handles emergency defects, because without a vendor contract the response to a bug falls to your team.
Evolveum's Product Support subscriptions cover resolving product bugs, with an 8x5 next-business-day or 24x7 SLA. The support subscriptions page lists no prices, so the cost is set by a written quote that names the tier you need. The subscription recurs for each contract term, and it sits on top of whatever your team or partner spends on build and operations, which it does not replace.
- Who is paid: Evolveum, for bug resolution under the SLA you select, in addition to your internal or partner effort.
- SLA tier: choose 8x5 next-business-day or 24x7. Ask for the difference between the two in writing, since your incident exposure determines which tier fits.
- Scope of coverage: the subscription addresses defects in midPoint itself. Confirm how custom connectors, rules and integrations you build are treated.
- What recurs: the renewal each term, plus internal effort to reproduce issues, gather logs and test vendor fixes.
- Lifecycle alignment: map the midPoint 4.8 long-term support end date of October 17, 2028 against your audit and renewal calendar so the contract covers the versions you actually run.
Review the support subscriptions page before requesting a quote, then ask Evolveum for a written proposal that names the SLA tier, the midPoint versions covered, the renewal term and how custom code is handled.
Platform Subscriptions add feature development and roadmap influence on top of product support. This route suits organizations whose provisioning or governance needs are not fully met by the core product and who want new capabilities built on a schedule they can plan around. The cost is higher and recurs, and any feature work scoped under the subscription needs its own definition in the quote.
- Who is paid: Evolveum, for feature development and roadmap input. Confirm which features are included and which are charged separately.
- What you gain: development capacity and a voice in roadmap priorities, which matters most when your connectors or governance workflows need features the core product lacks.
- Recurring and one-time costs: the subscription itself recurs, while specific features may be one-time items within it.
- Release timing: midPoint 4.11 (Čapek) is a feature release planned for October 21, 2026. Ask which release line will carry your requested features and how that aligns with your upgrade plan.
- Exit terms: clarify what happens to delivered features and support if the subscription lapses. The code stays open source either way, but ongoing development support would end.
Request a written quote that lists the features or roadmap items covered, how priority is set between customers, the support tier included and the terms for ending the subscription.
How to build the cost comparison with your own numbers
This sequence turns the cost components into one comparison that uses your own license terms, identity counts, integration inventory and staff rates, so both stacks are costed over the same period.
Inventory current MIM servers and licenses
Your Microsoft infrastructure or licensing owner lists every MIM 2016 Synchronization Service and Portal server, the SQL Server instances that host the MIM databases, any SharePoint farm used by the Portal, and the Windows Server hosts under them. For each, record the edition, core or client access license count, software assurance status and the agreement under which it is held. Get every license figure from your Microsoft agreement or a written reseller quote, not from memory or public list prices. The step is done when every server and license line can be traced to a contract or invoice.
List management agents, rules extensions and Portal workflows
A MIM engineer exports the management agent configuration, the sync rules and any custom rules extensions, and documents each Portal workflow, approval and request form. Mark which items are standard connectors, which are custom code and which depend on SharePoint or other components that you plan to retire. Custom code is the main driver of maintenance and migration effort, so note who wrote it, when it last changed and whether the source is still available. The step is done when every management agent and workflow has an owner and a classification.
Count identities and connected systems
The identity or IAM team counts the active identities in each source, the number of target systems per management agent, and the number of accounts provisioned per system. Separate employees, contractors, service accounts and leavers still in retention, because each category may drive different connector and license volume. Record the sync cycle frequency and approximate change volume per day. The output is a single table of identities, connected systems and accounts that both the MIM and midPoint columns of your comparison will use.
Price hosting and staff time for both stacks
For the current stack, add the infrastructure cost of the MIM servers, SQL and SharePoint hosting, backups and disaster recovery, and the staff hours spent on patching and maintenance. For midPoint, price Linux virtual machines or containers, a PostgreSQL database server ideally separate from the application, load balancing for multi-node deployments, and the same backup and monitoring coverage. Ask your hosting provider and your internal team for written rates. The output is a monthly run cost for each stack, split into infrastructure and people.
Add migration, parallel running and decommissioning effort
Estimate the one-time work: rebuilding each management agent as a midPoint resource with its object templates and ConnId connectors, rewriting custom rules extensions, reproducing Portal workflows, running both systems in parallel against the same directories, and retiring MIM sync runs per connected system. Ask for a fixed-scope written estimate from any implementation partner and compare it with internal effort. Include time for decommissioning, data retention and removal of Windows Server, SQL Server and SharePoint components. The output is a one-time cost sheet with a separate line for parallel running.
Add a support route and midPoint upgrade calendar
Decide whether you will run midPoint without a vendor subscription, rely on a partner or buy an Evolveum Product Support or Platform Subscription. Evolveum's support page describes 8x5 next-business-day and 24x7 SLA options and lists no prices, so request a quote for each option you consider. Then build an upgrade calendar from the midPoint release page: midPoint 4.8 (Curie) is long-term support until 17 October 2028, midPoint 4.10 (Braille) is supported until 26 November 2027, and midPoint 4.9 support ends 18 October 2026. Plan the recurring upgrade and test effort against these dates. The output is a recurring cost line for support and a yearly upgrade effort estimate.
Compare one-time and recurring totals over one period
Place both stacks on the same timeline, for example the same number of years, and separate one-time costs (migration, parallel running, decommissioning, initial setup) from recurring costs (licenses, support, infrastructure, staff, upgrades). Keep your currency and price-year assumptions identical on both sides, and show the sensitivity of the result to identity count and custom code volume. The check is complete when a finance lead and a platform owner have each reviewed the sheet and agreed the inputs and sources, so the comparison can be reused at the next renewal.
Where Entra ID P1 or P2 fits in the business case
Entra ID P1 or P2 belongs in this comparison only if your organization decides to use it, and that decision is set in your Microsoft agreement, outside this page. Some teams weigh it as an extra route alongside Microsoft Identity Manager 2016, either for the support timeline or for governance features in the Entra family. Neither is something you can assume is included in what you already run. Before you add any Entra cost to the midPoint model, confirm in writing which SKU is licensed, which governance capabilities that SKU entitles you to, and whether those entitlements reach the connected systems you need to provision. Treat Entra ID as a separate line item with its own owner.
An Entra ID license you already hold changes the arithmetic. If P1 or P2 is already paid for under your agreement, its cost is largely fixed for this decision, so the comparison should show only what changes: additional licenses for users or features you would newly need, and any governance feature you plan to use that depends on a tier you do not hold. Spend bought only to support the migration belongs in the Entra column. Ask your Microsoft account team or licensing advisor to map each planned capability to a specific entitlement, and ask how renewal terms could change that mapping over your planning horizon. Keep the midPoint side independent of this mapping so that a licensing change does not silently rewrite the whole case.
Staying on premises changes the comparison again. If provisioning must run in an air-gapped network or stay under EU control, a cloud-based governance route depends on connectivity and data flows that your security and legal teams may not accept, and an Entra license may cover fewer of the systems you need. midPoint can run on Linux in a virtual machine or from Docker images, with PostgreSQL as its native repository database, so its footprint can stay inside your own network. Confirm which data flows each option creates and whether the Entra entitlements apply to the on-premises targets in scope. For the feature comparison, read the sibling page on replacing Microsoft Identity Manager without moving to Entra ID Governance, and for dates, read the page on Microsoft Identity Manager end of support in 2029. This page does not price Entra ID; take those figures from your Microsoft agreement.
Questions buyers ask about MIM and midPoint cost, effort and skills
Does midPoint have license fees?
No. midPoint is open source, dual-licensed under EUPL-1.2 and Apache 2.0, and Evolveum states that it has no enterprise edition, so every line of code is published under open source licenses. Evolveum funds development through subscriptions, training and professional services, with midPoint developers working on it full-time. Your costs are therefore the infrastructure to run it, the people who build and operate it, and any support contract you choose to buy.
What does an Evolveum subscription actually buy?
Evolveum offers two kinds of subscription. Product Support covers resolving product bugs, with either an 8x5 next-business-day or a 24x7 service level. Platform Subscriptions add feature development and influence over the roadmap. The support page does not list prices, so ask Evolveum for a quote based on your deployment size, hours of cover and whether you need roadmap input. Subscriptions are optional, and a team with strong in-house midPoint skills may run without one.
How long does a migration from MIM to midPoint take?
The duration depends on drivers you can inventory, not on a fixed rule. The main ones are the number of management agents and connected systems, the number of MIM rules extensions and custom Portal workflows that need a midPoint equivalent, the complexity of metaverse attribute flows, and how long you need to run both systems in parallel against Active Directory. Ask any partner to base its timeline on a written inventory of these items and on a fixed scope agreed before work starts.
Can our internal team migrate MIM to midPoint without a partner?
It is possible if your team has the skills and capacity to run the project alongside daily operations. Teams that already maintain MIM rules extensions and connectors usually understand the data model, but midPoint uses its own object model, resources and object templates, so expect a learning curve. An external partner is most useful for planning, parallel running and hardening. DeployOpen plans, implements, integrates, hardens and documents self-hosted platforms in the client's own infrastructure under written scope, and your team can take on any share of that work.
What skills does a self-hosted midPoint deployment require?
midPoint is written in Java and recommends Java 25 for version 4.11 and later, with Java 21 supported. It uses PostgreSQL as its native repository database, ideally on a separate database server. Operating it requires Linux administration, either in a virtual machine or from Docker images, and knowledge of a sticky HTTP load balancer for multi-node setups. Connectors are built on the ConnId framework, so someone must understand LDAP, Active Directory, Microsoft Entra ID through Graph API, or other target protocols that your sources use.
What recurring cost remains after midPoint goes live?
The recurring costs are the servers or virtual machines, the PostgreSQL database and its backups, staff time for operations and upgrades, connector maintenance as target systems change, and any Evolveum subscription you choose to keep. MIM's recurring costs also include Windows Server, SQL Server, SharePoint and the Entra ID licenses on the extended support route, so compare line by line. Ask any partner to separate one-time migration work from ongoing support and to price each recurring item on its own line.
What should we ask an implementation partner for in a quote?
Ask for a written scope that lists the MIM management agents, rules extensions and Portal workflows in use, the target midPoint resources and object templates, and the environments covered, such as test, parallel run and production. Request separate line items for one-time migration, hardening, backup and documentation, and for recurring operations, upgrades and testing retainers. Confirm the deliverables, acceptance criteria and timeline, and ask which items depend on your own inventory or on Evolveum subscription terms.
How DeployOpen scopes a fixed-scope midPoint cost review and implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For a move off Microsoft Identity Manager, we start with a written scope that lists each cost component, the connected systems and the decisions the client must make before any build work begins.
How we scope
- Inventory current MIM cost components: Windows Server, SQL Server, SharePoint and any Entra ID licensing tied to the extended support route
- List management agents, rules extensions and Portal workflows that the midPoint design must replace
- Agree deliverables, timelines and acceptance criteria in writing before work starts, since engagements are fixed-scope
- Confirm the Evolveum subscription level, if any, that the client wants priced into the comparison
How we build
- Map metaverse attribute flows to midPoint resources and object templates for each connected system
- Build ConnId connector configurations and document any community or experimental connectors before relying on them
- Run midPoint in parallel with MIM against Active Directory and compare provisioning results before any cutover
- Harden the Linux, PostgreSQL and load balancer stack to the client's own security baseline
How we hand over
- Deliver architecture, runbooks, backup and restore procedures, and an itemized total cost of ownership model
- Provide a per-system cutover plan showing when each MIM sync run is switched off
- Document how each midPoint role and certification campaign maps to the retired MIM controls
- Transfer operational knowledge to the client's own administrators with recorded handover sessions
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover
- Agree in the written scope which midPoint release line the client will track and who applies upgrades
- Confirm with Evolveum whether a Product Support or Platform Subscription fits the client's risk profile
- Request a quote based on the written scope, since DeployOpen does not publish a price list
