Where self-hosted midPoint costs less than Omada, and where it costs more
midPoint has no license fee, so the cost difference lies in what you pay recurring for each option. With Omada, the recurring line is the vendor subscription. With self-hosted midPoint, you pay for infrastructure, the team that runs it and, if you choose, an Evolveum subscription. Evolveum's support subscriptions come in two forms: Product Support, which covers resolving product bugs under an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions, which add feature development and roadmap influence. The Evolveum support page lists no prices, so ask Evolveum for a written quote for the tier you need. Omada's prices are not given here either. Request a written quote that separates the subscription, implementation services and any Azure consumption.
Omada Identity Cloud is delivered as SaaS on Microsoft Azure, so the provider hosts the platform and most operations sit with them. Identity Cloud Private runs in your own Azure tenant, which moves the Azure consumption and day-to-day operations onto your bill and your staff. Ask Omada to state which Azure resources, regions and service tiers its quote assumes, how Azure costs are billed and who operates patching, upgrades and backups. For midPoint, the infrastructure lines are the virtual machines or containers, the PostgreSQL database server (midPoint recommends a separate database server), load balancing for multi-node deployments and backups. Your platform or identity team's time is the largest variable, and it recurs for as long as you run the system.
Two timing facts matter for budgeting. midPoint 4.8 (Curie) is a long-term support release supported until October 17, 2028, which gives you a fixed support window for a stable branch. midPoint 4.10 (Braille) is a feature release supported until November 26, 2027, so plan upgrade effort on that cadence. Treat the one-time migration and parallel-running work as separate from recurring run costs, and ask any implementation partner, including DeployOpen, for a fixed-scope written proposal before work starts. Compare both options over the same period, with the same identity count, the same environments (production, test and disaster recovery) and the same connector list, so the comparison reflects real differences rather than scope differences.
Cost components on each side and when they are paid
This table maps each cost component of an Omada deployment and a self-hosted midPoint deployment to the party paid for it and to whether the cost is one-time or recurring. Use it to build a like-for-like quote request, since most of the difference sits in services, operations and internal skills rather than in license lines. Omada costs are largely recurring subscription or private-tenant charges, while midPoint's license is zero and its costs are mainly one-time build work and ongoing staffing.
| Cost component | Omada (SaaS or Identity Cloud Private) | Self-hosted midPoint |
|---|---|---|
| Subscription or license | Recurring fee to Omada for the platform, quoted per agreement | No license fee; midPoint is open source under EUPL-1.2 and Apache 2.0 |
| Vendor support | Included in the subscription terms, confirm response levels in the contract | Optional Evolveum Product Support subscription with 8x5 or 24x7 SLA options; unpriced in the source, so request a quote |
| Azure or hosting | SaaS: largely inside Omada fee. Private: recurring Azure consumption charged to your tenant | Recurring compute, storage, backup and network in your cloud or data center, plus PostgreSQL database servers |
| Implementation | One-time program fee to Omada or its partners, scoped in the contract | One-time build by an internal team or an implementation partner, paid by you |
| Migration | One-time work to export identities, roles and assignments and run parallel operation | One-time work to map data from the Omada model and rebuild workflows, paid by you or the partner |
| Connector build | Connectors typically supplied by Omada; confirm which are included and which are extra | ConnId connectors are Java code; some are supported, others community or experimental, so budget build and test effort |
| Upgrades and patching | Recurring, usually covered by the subscription; confirm release cadence and testing duties | Recurring staff effort per release, for example tracking 4.10 end of support in November 2027 and 4.8 LTS until October 2028 |
| Internal skills | Smaller team for administration, mostly configuration and access policy | Recurring need for Java, midPoint, database and identity engineering skills, often the largest line |
| Backup and disaster recovery | Largely provided by Omada for SaaS; confirm recovery objectives and tenant location in writing | Recurring cost to design, run and test backups and failover for the midPoint nodes and database |
What moves the cost line up or down
Omada and self-hosted midPoint do not price the same things. The drivers below decide which side of the comparison carries the larger share of spend as the deployment grows. Model each one with your own counts before comparing totals.
Identity count and scale
Omada prices against the identities it governs, so growth in workforce, contractor and service accounts flows directly into the subscription. midPoint has no license fee, but Evolveum states it scales to deployments of up to 100 million identities, so the cost shifts to database sizing, node count and task scheduling. Ask Omada for the pricing unit and what counts as an identity, and size your own database and node tier for peak identity volume.
Number and type of connectors
Each target system needs a connector, and connector work is usually the largest recurring effort. midPoint documents LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID, SCIM2 and SCIMv1, with further connectors ranging from supported to experimental. Count your applications by protocol, then confirm which of them need a community or custom ConnId connector, since those carry build and maintenance cost on your side. Ask Omada which connectors are included and what new ones cost.
Editions, modules and support tier
Omada's cost depends on which governance modules and deployment variant you buy, and on the implementation program behind them. midPoint has no enterprise edition, so the license line is zero, and the optional spend is a Product Support or Platform Subscription from Evolveum, which varies by SLA and by whether you want roadmap influence. Price both options side by side, and note that support tiers are not priced on Evolveum's public page.
Availability and 24x7 requirements
Hours of coverage change the operations line more than almost any other input. Evolveum offers Product Support with an 8x5 next-business-day or 24x7 SLA, while a self-run midPoint needs on-call staff for provisioning failures that block joiners or leavers. Decide whether a deprovisioning delay is acceptable overnight, then compare the cost of an on-call rota with the premium for 24x7 support or the managed Omada service.
Data residency and hosting location
Omada Identity Cloud runs on Microsoft Azure, while Identity Cloud Private runs in your own Azure tenant, which adds Azure consumption and a tenant to operate. Self-hosted midPoint runs on virtual machines or Docker in any location you control, so cost follows your infrastructure choice. Confirm where identity data must sit, whether a private tenant or on-premises hardware is required, and what egress and backup storage add in each case.
In-house Java and PostgreSQL skills
midPoint is written in Java and recommends PostgreSQL as its native repository, ideally on a separate database server. Teams that already run Java services and PostgreSQL absorb this with existing staff, while others must hire or contract for it, which is often the largest recurring line in the open-source model. Map who on your team can patch the JVM, tune the database, and maintain the Quartz-based task scheduler across nodes, and price any gap as a recurring skills cost.
What you actually pay for when you run midPoint
The midPoint software carries no license fee. Its repository is licensed under the European Union Public License (EUPL-1.2) with Apache 2.0 as a secondary license, and Evolveum states there is no enterprise edition. What you pay for is the stack around it. midPoint is written in Java, and the version you choose sets the runtime. For 4.11 and later, Evolveum recommends Java 25 with Java 21 supported; for 4.10 and older, it recommends Java 21 with Java 17 supported. Confirm the exact support matrix on the system requirements page before you fix an operating system image or a patching window, because the JDK choice drives your build and test effort.
The database and hosting lines come next. midPoint uses PostgreSQL as its native repository, ideally on a separate database server, so you budget a second server, its backups, replication and patching alongside the application nodes. midPoint runs on Linux in a virtual machine or from Docker images. For multi-node deployments you also need a sticky HTTP load balancer, a shared central database, cache invalidation between nodes over HTTPS, and Quartz for distributed task scheduling. Each of these is a line item in your infrastructure estimate, and each needs an owner who can operate it. Ask your team whether they already run PostgreSQL high availability and a load balancer, since that answer moves the cost more than any license line.
The largest recurring cost is people. Someone must own Java upgrades, connector maintenance for each target system, and the midPoint release cadence, and the 4.9 support end date of October 18, 2026 shows how quickly a version can age out. Evolveum sells Product Support subscriptions with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development, but its page lists no prices, so request a written quote for the tier you need. Decide early whether you will staff this in-house, buy support, or contract an implementation partner, and compare those costs against the Omada subscription and its implementation program.
How to build the comparison with your own numbers
This sequence turns the Omada and midPoint cost components into a three-year total you can defend, built from your own contract, bills, identity counts and staffing rather than from generic estimates.
Collect the current Omada contract and Azure bills
Gather the signed Omada subscription agreement, any order forms and amendments, and the Azure invoices for the tenant and resources that host the platform. Ask your procurement and cloud finance teams to confirm which line items are recurring, which are usage based and which renew on a fixed date. Separate what Omada charges from what Azure charges, because they are billed by different parties. You know this step is done when every recurring cost has a source document and an owner.
Inventory connectors, applications and identity counts
List every source system such as HR, directories and applications, every target system that receives provisioning, and the number of identities and accounts in each. Note which connectors Omada uses today, whether each one is vendor supplied or custom, and how often each is changed. Use the documented midPoint connector list as a starting point for comparison, and confirm the support status of any connector you depend on in the connector documentation. You know this step is done when the inventory is signed off by the application owners.
Cost the midPoint infrastructure in your environment
Price the servers or virtual machines, the PostgreSQL database on its own server, load balancing for multi-node deployments, backup storage, monitoring and non-production environments in your own cloud account or data center. Check the midPoint system requirements for the Java and PostgreSQL versions you plan to run, and confirm which release you will deploy, since Java 25 applies to 4.11 and later and Java 21 to 4.10 and older. Your cloud or infrastructure team should produce the figures from their own rate cards. You know this step is done when each infrastructure line has a unit price, a quantity and an owner.
Estimate staffing for the team that runs midPoint
Describe the roles needed to operate midPoint after go-live, such as platform engineers, identity engineers who write mappings and connectors, and a security or compliance reviewer for access reviews. Decide which roles are internal, which are contracted, and how much of each role is needed, based on your own change volume and the number of connectors. Compare that with the support responsibilities Omada carries under its subscription and with any implementation partner fees you would still pay. You know this step is done when each role has a named owner and a cost basis.
Add migration and parallel-run effort
Scope the one-time work: exporting identities, roles and assignments, rebuilding connectors and the HR source integration, porting access request and review processes, testing, and running both systems in parallel before cutting over provisioning. Ask any implementation partner for a written, fixed-scope quote that lists deliverables and assumptions, and treat internal effort as an explicit line with hours and a named team. Record the parallel-run period you need and the Omada and Azure costs that continue during it. You know this step is done when every one-time cost is listed separately from recurring costs.
Decide on the Evolveum support tier
midPoint has no license fee, so the recurring vendor cost is optional. Evolveum offers Product Support subscriptions, with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence, and its page lists no prices. Request a written quote for each tier you are considering, and decide whether you need bug resolution only, or also a voice in the roadmap. Note the midPoint support dates from the release page, including that 4.8 is supported until 17 October 2028 and 4.10 until 26 November 2027, and confirm the dates against the current release documentation before you commit to a version. You know this step is done when a tier and a quoted annual figure are recorded, or when the decision to run without a subscription is documented.
Run three-year totals for both sides
Build one spreadsheet with the same three-year horizon for Omada and for midPoint. On the Omada side, include subscription, Azure hosting, implementation program and any continuing services. On the midPoint side, include infrastructure, staffing, migration, parallel running and the optional subscription. Separate one-time costs from recurring costs, and run a sensitivity check on the identity count and the number of connectors, since both drive cost up. You know this step is done when both totals are reconciled to their source documents and reviewed by finance and the identity owner.
Which figures this page cannot give you
This page gives no Omada price, no Evolveum support price and no implementation effort, because none of these figures were supplied for this comparison. Evolveum publishes its Product Support and Platform Subscription tiers, with 8x5 next-business-day or 24x7 SLA options, but its support page lists no prices, so the subscription cost has to come from a written quote. Treat any amount you see in a third-party article as unverified until a vendor or partner confirms it against your own user count, connector list and environment. What this page does offer is the structure of the bill, so you know which numbers to ask for and who answers each one.
Request the following in writing from Omada: the subscription tier and the metric it is priced on (identities, applications or another unit), whether Identity Cloud Private is priced separately, and the implementation scope and fees for your connectors, HR source and access request and review workflows. Ask Omada to state which costs recur and which are one-time. For Identity Cloud Private, ask for an Azure cost estimate built on your own tenant design, covering compute, database, networking and backup, and ask who carries those charges. From Evolveum, request a Product Support or Platform Subscription quote for the midPoint version you intend to run, including the support window you need. From your own finance team, get the fully loaded salary cost of the people who will run midPoint, including on-call time and the share of their week they will spend on it.
Questions buyers ask before comparing Omada and midPoint costs
Does midPoint really have no license fee and no enterprise edition?
Yes, midPoint carries no license fee, and Evolveum states that it has no enterprise edition: every line of midPoint code is published under open source licenses, and the project describes itself as open source, not open core. The repository is licensed under the EUPL-1.2 with Apache 2.0 as a secondary license. What you still pay for is the work around the software: infrastructure, the team that runs it, implementation and any support contract you choose. Ask Omada to itemize its subscription, implementation program and any Azure hosting charges so you can compare those lines directly with the components listed here.
Is an Evolveum subscription required to run midPoint in production?
No, a subscription is optional. Evolveum sells Product Support subscriptions for resolving product bugs, with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. Evolveum funds development through subscriptions, training and professional services, and its support subscriptions page lists no prices, so request a quote for the level you need. Teams that already have Java and PostgreSQL skills in-house may run without a support contract, but they then carry the full burden of incident response and upgrades themselves.
How long does a migration from Omada to midPoint take?
Duration depends on the drivers below, and no fixed figure applies to every estate. The main factors are the number of source systems and the connectors each needs, the quality of your HR source data, how many roles and access request and review processes must be ported, and whether you run both systems in parallel before cutting over provisioning. Each driver can be sized from your own inventory. Ask any implementation partner, including DeployOpen, to break its written scope into phases with deliverables and dates before work starts, since most engagements are fixed-scope and agreed in writing.
What skills does a team need to run midPoint?
The team needs Java for connector work and troubleshooting, PostgreSQL administration for the native repository database, and working knowledge of ConnId, the connector framework midPoint uses. Each connector is Java code behind a uniform interface that speaks the target system's protocol, so engineers who write or modify connectors must understand both Java and the target protocol. Evolveum recommends Java 25 for version 4.11 and later (Java 21 supported) and Java 21 for 4.10 and older. Identity administrators also need to understand midPoint's role model. Confirm these skills against your own staffing before estimating headcount.
Can our team run the midPoint migration without outside help?
It is possible for some organizations, and the answer depends on existing skills and capacity. Your team would need to cover architecture, the Java and PostgreSQL platform, connector development, the role and access request design, parallel running and the provisioning cutover. Evolveum's public materials describe midPoint as deployable on Linux in a virtual machine or from Docker images, and multi-node deployments need a sticky HTTP load balancer and a shared central database. Assess the gap honestly with a short internal inventory of skills, then decide which pieces to keep in-house and which to buy as a specific service.
What does a fixed-scope DeployOpen engagement cover?
A DeployOpen engagement is typically fixed-scope, meaning scope, deliverables and timelines are agreed in writing before work starts. DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. It also prepares systems, controls and evidence for compliance assessments, although it does not issue audit reports or certifications. Ongoing support, upgrades and continuous testing are available as retainers. DeployOpen does not publish a price list, so a quote follows from the written scope you agree.
Which costs recur after go-live, and which are one-time?
Implementation, connector build-out, data migration and parallel running are one-time costs, though they can include ongoing work during the rollout. Recurring costs include infrastructure, database and backup operations, Java runtime maintenance, midPoint upgrades, any Evolveum support subscription and the staff who run the platform. For Omada, the subscription and any Azure hosting or private variant charges recur. Ask each vendor, and any partner, to split quotes into one-time and annual lines so you can build a five-year comparison from like-for-like items.
How long will midPoint releases stay supported?
Support windows are published per release, so plan upgrades around them. midPoint 4.8 (Curie) is a long-term support release supported until 17 October 2028, and midPoint 4.10 (Braille) is a feature release supported until 26 November 2027. midPoint 4.9 support ends 18 October 2026, and midPoint 4.11 (Čapek) is planned as a feature release for 21 October 2026, according to the midPoint releases page. Choosing a long-term support line lowers how often you must upgrade, which reduces recurring operations effort. Confirm the current dates on the release page before you commit to a version.
What the cost difference buys and gives up
A lower license line is only a fair comparison when the features behind it match what your team uses today. Before you put midPoint's zero license fee next to an Omada quote, list the governance functions your current Omada deployment actually exercises: lifecycle events from your HR source, access request and approval flows, certification campaigns, risk scoring, and the connectors that reach your target systems. Then check each one against midPoint's documented coverage. midPoint covers provisioning and deprovisioning, role-based access control, auditing, self-service access requests, simulations and role mining, but the depth of each workflow, and the presence of specific review and risk features, needs to be verified against your own requirements. The Omada vs midPoint comparison is the place to run that line-by-line check before costing anything.
Connector coverage is the second item to verify, because it changes the labor line more than the license line. midPoint connects through the ConnId framework, and its documented connectors include LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID and SCIM2. Any system outside that list, or any connector whose status is community or experimental rather than supported, is code your team or a partner must build, test and maintain. Ask for the connector status of every target system in your inventory. Also clarify the scope of identity management: midPoint is an identity management system, not an access management or SSO server, and does not implement the server side of OAuth2, OpenID Connect or SAML. If your Omada use depends on SSO or federation, that capability has to come from a separate product, and its cost belongs in the comparison.
How DeployOpen scopes a fixed-price midPoint implementation
DeployOpen is a Chainscore Labs company that plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For a move from Omada to midPoint, we turn your current Omada costs and requirements into a written scope before any work starts, so the comparison in this guide becomes a costed plan you can check.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We inventory the Omada subscription or Azure components you pay for today, including connectors, workflows and review processes.
- The written scope lists which target systems, HR sources and access request processes move to midPoint and which stay in place.
How we build
- We deploy midPoint in your own cloud accounts, data center or air-gapped network, on Linux virtual machines or Docker images.
- We build or customize ConnId connectors for each target system and test provisioning and deprovisioning against non-production data.
- We set up PostgreSQL, multi-node operation and backups so the running cost of the platform is visible and documented.
How we hand over
- You receive documentation of the architecture, connectors, role model, configuration and operating procedures.
- We prepare the controls and evidence your team needs for compliance assessments, while independent auditors perform any audit.
- Your staff are trained on operating midPoint so the team that runs it can own the cost after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- We plan midPoint upgrades against the published release schedule and test each one before it reaches production.
- Ask for a quote built from the written scope, and confirm with Evolveum which support subscription level, if any, you need.
