Is One Identity Manager cost vs self-hosted midPoint a license question or an operations question?
If a renewal, a licensing change or a residency requirement has pushed you to review One Identity Manager spending, the first thing to accept is that midPoint carries no license fees. midPoint is developed by Evolveum under the EUPL and Apache 2.0 licenses, so the cost difference sits in infrastructure, implementation, migration, support and internal skills. Your review should split the current bill into those components and price each one for both options, rather than comparing a subscription line against zero.
Self-hosting tends to cost more in three places. The first is migration: mapping lifecycle, attestation and entitlement processes to midPoint policies, and rebuilding target connectors on ConnId, is one-time effort that One Identity Manager customers will not have paid recently. The second is skills, since midPoint runs on Java and PostgreSQL and your team needs people who can operate and customize it. The third is the optional Evolveum subscription. Evolveum sells Product Support and Platform Subscriptions, and its support page lists no prices, so request a quote for the SLA tier you need before you model it. Ask whether those skills already exist in-house, because that answer usually decides the outcome.
Self-hosting tends to cost less where the Windows and SQL Server footprint is large. Identity Manager needs Windows and SQL Server infrastructure behind it, while midPoint runs on Linux, in a virtual machine or from Docker images, with PostgreSQL as its native repository, ideally on a separate database server. Confirm the Java and PostgreSQL versions your chosen midPoint release requires, since the system requirements differ between 4.10 and 4.11 and later. Run the comparison against your actual environment: the saving is real only if your existing Windows and database licenses and hardware can actually be retired after cutover.
Which cost components change when you move from One Identity Manager to midPoint?
This table compares each cost component of running One Identity Manager with the equivalent component under a self-hosted midPoint deployment, and marks whether it is paid once or recurs. Read it as a checklist for building your own comparison, since the commercial figures depend on your contract and your environment. The main takeaway is that midPoint removes the license line but keeps the implementation, migration, and staffing costs that any identity governance platform requires.
| Cost component | Commercial side (One Identity) | Self-hosted side (midPoint) | One-time or recurring |
|---|---|---|---|
| Software subscription or license | Annual subscription or license fees for Identity Manager modules, as set in your One Identity order form | No license fee; midPoint is open source under EUPL-1.2 with Apache 2.0 as a secondary license | Subscription recurring; midPoint has none |
| Windows Server and SQL Server or equivalent database licensing | Windows and SQL Server licensing typically required by the Identity Manager stack; confirm the exact editions with One Identity | Linux virtual machine or Docker host; PostgreSQL as the native repository database, ideally on a separate server | Recurring for Windows and SQL Server; PostgreSQL itself carries no license fee |
| Application and database infrastructure | Application servers, database servers, and supporting hosts sized to the vendor's requirements | Java application nodes behind a sticky HTTP load balancer, shared central database, and Quartz task scheduling for multi-node setups | Recurring (hosting, storage, backup); one-time for initial sizing |
| Implementation and customization | Typically delivered by One Identity, a partner, or your team under a services agreement | Configuration of midPoint objects, policies and roles, usually delivered by Evolveum, a partner, or your team | One-time, with ongoing change requests after go-live |
| Migration and connector rebuilding | Existing Identity Manager connectors and workflows are the source of truth for rebuild effort | Target system connectors rebuilt on ConnId, which provides LDAP, Active Directory, Entra ID, SCIM2 and others | One-time; effort depends on the number and type of connected systems |
| Vendor or partner support | Support included in or added to the One Identity subscription; confirm the SLA and response terms in your contract | Optional Evolveum Product Support with 8x5 next-business-day or 24x7 SLA, or Platform Subscriptions; the source page lists no prices | Recurring if purchased; optional, and the price must be requested from Evolveum or a partner |
| Upgrades and testing | Vendor-driven upgrades and your own regression testing, scheduled around the vendor release cycle | Your own upgrades across midPoint feature and LTS releases, such as 4.8 (LTS) and 4.10, plus testing of connectors and Java runtime changes | Recurring; plan for each release, with 4.8 supported until 17 October 2028 |
| Internal skills and staffing | Administrators with Windows, SQL Server, and One Identity Manager skills | Administrators with Java, PostgreSQL, Linux, and midPoint configuration skills, plus connector maintenance | Recurring; staffing mix changes, so confirm skills gaps before cutover |
What moves the cost comparison most for your organization?
The gap between One Identity Manager and self-hosted midPoint depends less on the license line than on a few sizing decisions. Each card below names one driver, the direction it pushes the comparison, and what to confirm in your own environment before you ask for a quote.
Number of identities
midPoint has no license fee that scales with identity count, so the main effect of volume is on infrastructure and operations: database sizing, node count and reconciliation run times. One Identity subscriptions are typically priced against identity volume, so ask your vendor exactly what metric the current contract uses and how it changes at renewal. Evolveum states midPoint scales to deployments of up to 100 million identities, but your own load test should confirm the figure for your data.
Number of target systems
Each target system needs a connector, and the way those connectors are built and maintained drives effort. midPoint uses ConnId, where connectors are Java code behind a uniform interface. Count your targets by type, then check which ones have a supported connector in the Evolveum catalog and which would need custom or community work. Every custom connector adds build, test and upkeep effort that a subscription may not cover.
SAP and Active Directory coverage
Coverage for SAP and Active Directory is often the decisive technical question, and it can move the cost in either direction. Active Directory is a documented connector in midPoint, but SAP scope needs confirmation against the specific modules and transactions you provision. Ask One Identity which SAP and Active Directory features your current deployment uses, then map each one to a midPoint connector or a custom build before you compare totals.
Customization depth
Heavily customized workflows, attestation rules and approval chains raise the cost of any platform, but they weigh differently on each side. Your current customizations may be partly vendor-supported and partly in-house scripts, and both need rebuilding on midPoint. Inventory every custom workflow, script and report, and estimate the rebuild effort in your own team or through a written scope. Fewer customizations usually lowers migration cost and ongoing maintenance.
Availability and support tier
Evolveum sells Product Support subscriptions with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development. Choosing a tier is a recurring cost decision, and your uptime requirement should set it. Compare the support tier you need with the One Identity support level you pay for today, and confirm what each one covers for security fixes and incidents. Note that the support pages list no prices, so request a written quote.
Existing Java and PostgreSQL skills
midPoint runs on Java with PostgreSQL as its native repository database, so teams that already operate Java services and PostgreSQL carry less new skill cost. Teams whose operations are built around Windows and SQL Server may need training or hiring, and that is a one-time cost. Check which runtime versions your platform team already supports, since midPoint recommends specific Java versions for each release line, and plan the database server layout before you size hardware.
How do you build the cost model with your own numbers?
This sequence turns the cost comparison into a model built from your own licenses, infrastructure rates, staff time and quotes, so the three-to-five year totals reflect your environment rather than generic assumptions.
Inventory current One Identity and platform costs
Gather every One Identity subscription and renewal term, along with each Windows Server, SQL Server, hosting and hardware line that Identity Manager depends on. Pull these from procurement records, the license agreement and the infrastructure asset register, and confirm which lines are shared with other systems. The output is a single sheet listing each line, its annual amount from your own invoices, its renewal date and its owner, so that nothing sits outside the baseline.
List target systems and connectors
Enumerate every source and target system that Identity Manager provisions to or reads from, including directories, SAP, databases, SaaS applications and custom scripts. For each one, record whether a ConnId connector already exists in midPoint's documented catalog, whether it is supported, community or experimental, or whether custom connector development will be needed. The output is a connector register that shows which integrations carry build effort and which are low risk.
Estimate migration and parallel-run effort
Ask your architects, identity engineers and application owners to estimate, in their own staff days, the work to rebuild policies, approvals, roles and connectors, plus the time to run both platforms in parallel during cutover. Separate project staff from business reviewers and from your security and audit team. The output is a labeled effort table by role, which you can later price with your internal rates or the rates in a written quote.
Price infrastructure at your own rates
Cost the midPoint target environment using your own cloud or data center rates: virtual machines or container capacity for application nodes, a PostgreSQL database server, load balancing, backup storage, and non-production environments for testing. Apply the same method to the current Windows and SQL Server footprint. Use your internal chargeback rates or your cloud provider's invoices, not published list prices. The output is two infrastructure cost sheets with the same structure, so the comparison is like for like.
Select a midPoint support tier and request quotes
Review Evolveum's published support options, which include Product Support with an 8x5 next-business-day or 24x7 SLA and Platform Subscriptions that add feature development and roadmap influence. Decide which tier matches your uptime and roadmap needs, then request a written quote for that tier, and ask for quotes from implementation partners based on your scope. Ask Evolveum whether the quote includes named release support for the version you will deploy. The output is a written subscription quote and at least one written implementation quote, each attached to the model.
Model a three to five year total
Build a yearly model over three to five years that separates one-time costs, such as migration, connector development, testing and training, from recurring costs, such as subscriptions, infrastructure, operations staff and upgrades. Keep your One Identity renewals and the Windows and SQL Server lines in the same model with their own renewal timing. Run a sensitivity check on the drivers that move totals most, such as identity count, number of connectors and staffing. The output is a total cost view for each option that your finance and security leaders can review and challenge.
Confirm quotes and figures you must source
Before the model goes to decision makers, confirm in writing every figure that came from outside your organization, including vendor renewal terms, subscription quotes, partner fixed-scope quotes and cloud rates. Mark any figure still based on an estimate and assign an owner to replace it. Ask each vendor and partner to state what is excluded, such as taxes, travel or extended support. The output is a model where every external number has a source document and a named owner.
How midPoint release timing affects your upgrade budget
The release you choose sets how often you upgrade midPoint and how much regression testing each upgrade needs, so it belongs in the cost model from the start. The supplied release facts show a clear split: midPoint 4.8 (Curie) is the long-term support release, supported until 17 October 2028, while midPoint 4.10 (Braille) is a feature release supported until 26 November 2027. midPoint 4.9 support ends on 18 October 2026, so any deployment still on 4.9 is already on a path that needs a move. midPoint 4.11 (Čapek) is planned for 21 October 2026 according to the midPoint releases page, and that date should be confirmed on the same page before you fix a budget around it.
A long-term support track means fewer major upgrades over the life of the system, so the testing effort for connectors, role definitions and approval flows is spread across a longer window. A feature track brings newer capabilities sooner but shortens the support window, which means more frequent upgrade cycles and more regression runs against your target systems. Ask your implementation partner and, if you hold one, your Evolveum subscription provider, which track they recommend for your Java and database platform, and what each upgrade in your chosen track typically requires in connector retesting. Those answers, not the license fee (which is zero for midPoint itself), drive most of the recurring labor cost.
Platform changes also affect the budget. midPoint recommends Java 25 for version 4.11 and later (with Java 21 supported), and Java 21 for 4.10 and older (with Java 17 supported). If you plan to move to 4.11 or later, confirm that your application server image, monitoring agents and security scanning tools support Java 25 before the upgrade is scheduled, because a runtime change can add work that has nothing to do with midPoint itself. Budget for that compatibility check as a separate line item in your quote.
What do buyers ask before comparing One Identity Manager with midPoint?
Does midPoint cost nothing to license?
Yes, midPoint has no license fees. It is dual-licensed under EUPL-1.2 with Apache 2.0 as a secondary license, and Evolveum states that it has no enterprise edition, so every line of code is published under open source licenses. Your costs shift to the components you still pay for: the servers or virtual machines, the PostgreSQL database (ideally on a separate database server), staff or a partner to run it, connector work, and any support subscription you choose. Ask Evolveum and your partner to show these lines separately in any quote so you can compare them with your current One Identity subscriptions and Windows and database infrastructure.
What does a midPoint support subscription cover versus Platform Subscriptions?
A Product Support subscription covers resolving product bugs, offered with an 8x5 next-business-day or 24x7 SLA. A Platform Subscription adds feature development and roadmap influence on top of that. Evolveum's support subscriptions page lists no prices, so you need a written quote to compare them. Choose the level based on how much of your operation depends on midPoint being fixed quickly versus how much you want to shape future features. Confirm the exact terms, response times and what is included directly with Evolveum before you budget.
Can our team run midPoint without an outside partner?
Possibly, but it depends on your skills and capacity. midPoint is written in Java, runs on Linux in a virtual machine or from Docker images, and uses PostgreSQL as its repository database, so your operations team needs those skills. Connectors use the ConnId framework, where each connector is Java code, so anyone maintaining custom connectors needs Java development experience. Many organizations keep a partner for the first implementation, the connector build-out and upgrades, and then move operations in-house. Evolveum also offers training and professional services, which can close skill gaps. Decide this by mapping the roles you have against the work in your own environment.
How long does a migration take and what drives the timeline?
The timeline depends on the number and complexity of your processes, not on a standard duration. The main drivers are how many target systems need connectors, how many lifecycle, attestation and request processes you must map to midPoint policies and approvals, how much of your One Identity Manager customization must be rewritten, and whether you run both systems in parallel during cutover. Multi-node deployments add work for sticky load balancing, a shared central database and cache invalidation between nodes. Ask any provider for a written scope that lists these items and the timeline per item, and check it against your own inventory before accepting it.
Which skills does a midPoint implementation actually need?
A midPoint implementation needs several skill areas working together:
- Identity governance design: roles, policies, approvals and access certification, which map your current attestation and request processes.
- Java and connector development: ConnId connectors for systems without a documented connector, such as custom LDAP or database targets.
- Database and infrastructure operations: PostgreSQL administration, Linux, Docker or virtual machines, and a sticky HTTP load balancer for multi-node setups.
- Security and audit: evidence of access reviews and change history that your auditors will accept.
MidPoint recommends Java 21 for version 4.10 and older and Java 25 for 4.11 and later, so confirm which Java version your chosen release needs.
Does midPoint scale to our number of identities?
Evolveum states that midPoint scales to deployments of up to 100 million identities. Scale in practice depends on your architecture: the number of nodes, the sizing of the central PostgreSQL database, how often synchronization and reconciliation tasks run, and how many connectors are active at once. Quartz handles distributed task scheduling across nodes. Ask Evolveum for reference architectures closest to your size, and run a load test with a copy of your data before you commit to hardware. Your One Identity Manager sizing will not translate directly, so measure your own workload.
What must we ask for in a quote for this comparison?
Ask for each cost component on its own line so you can compare it with your current spend:
- Software: confirm that the midPoint license is zero and list any Evolveum support or platform subscription separately.
- Implementation: scope, deliverables, connectors in scope, and the process mapping workshops.
- Infrastructure: servers or virtual machines, PostgreSQL, backup, and load balancing, with a note on what you already own.
- Operations: who runs upgrades, monitoring and on-call, and the cadence for release updates.
- Exit and transition: knowledge transfer, parallel running and decommissioning of One Identity Manager and its Windows and database hosts.
For fixed-scope work, DeployOpen agrees scope, deliverables and timelines in writing before work starts, and quotes follow from that written scope.
What a migration from One Identity Manager adds to the cost
Migration is the largest one-time cost in this comparison, and most of it is labor rather than software. Licensing for midPoint is zero, so the budget question is how many person-days your team, an implementation partner or Evolveum's consultants will spend on three activities: mapping lifecycle and attestation processes to midPoint objects, rebuilding each target system connector on ConnId, and running One Identity Manager and midPoint side by side through cutover. Two drivers dominate: the number of joiner, mover and leaver processes, approval chains and attestation policies you have today, and the number of connected systems. Ask any bidder to price these as separate line items with a stated count of processes and connectors. The process mapping is where most surprises appear. Each One Identity Manager policy, approval step and recertification rule has to be re-expressed as a midPoint role, policy rule, approval flow or access certification definition, and the reviewer logic has to match what auditors have already accepted. Treat the sibling migration page as the process guide and the attestation page as the detail for review evidence. Before estimating, inventory every workflow and its approvers, and confirm with the business owners which ones are still used. Parallel running adds recurring cost while it lasts, because two identity stacks, their infrastructure and their operators are funded at once. Plan the cutover window, the reconciliation checks between the two systems and the rollback path in writing, and agree with the quoting party how long the overlap will run. The shorter that overlap, the lower the cost, but it should never be shortened to the point where access decisions cannot be compared against the old system.
How DeployOpen scopes a fixed-price midPoint cost review and implementation
DeployOpen starts with a written scope that compares your current One Identity Manager cost components with a self-hosted midPoint model inside your own infrastructure. Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any build work begins.
How we scope
- Inventory every One Identity Manager subscription, Windows server, SQL Server licence and database cost in your environment
- Agree which connected systems, lifecycle processes and attestation flows move to midPoint in the written scope
- Confirm target infrastructure options, including virtual machine or Docker hosting and PostgreSQL placement, with your team
- Define what a quote covers and ask for the same cost components on both sides of the comparison
How we build
- Build midPoint on Linux in your cloud account, data center or air-gapped network, using the Java version your release requires
- Map each target system to a ConnId connector and document where a connector is supported, community or needs custom work
- Test provisioning, deprovisioning and role assignments against non-production copies of your identity data before cutover
- Run cost and effort tracking against the scope so you can see which components drive the total
How we hand over
- Deliver architecture, configuration and connector documentation that your operations team can maintain without us
- Hand over runbooks for backup, restore, upgrades and multi-node operation behind a sticky load balancer
- Document the cost model for licences, support subscriptions and infrastructure so finance can track recurring spend
- Run knowledge transfer sessions with your administrators and confirm acceptance criteria in writing
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the fixed-scope work ends
- Plan midPoint upgrades around the support windows of the release you run, confirmed against the official release documentation
- Ask Evolveum directly about support subscription levels if you want vendor-backed product support alongside DeployOpen
- Agree the retainer scope, response expectations and review cadence in writing before support begins
