Where SailPoint cost vs self-hosted midPoint really differs
If you face a renewal or an IdentityIQ 9.0 upgrade decision, the direct answer is this: midPoint carries no license fee, so the cost does not disappear, it moves. midPoint is dual-licensed under the EUPL-1.2 and Apache 2.0, and Evolveum states it has no enterprise edition, so every feature sits in the same open source code base. What you pay for instead is infrastructure, connector work for each target system, migration effort, and the staff who operate the platform. Those costs are one-time (design, connector build, migration, parallel running) and recurring (hosting, database administration, patching, upgrades, and the people who keep provisioning rules and certification definitions current). SailPoint prices are not part of the facts behind this page, so any comparison must start from a written quote from SailPoint covering your module set, your identity count and your term.
Evolveum sells an optional support subscription. Its Product Support tier covers resolving product bugs with an 8x5 next-business-day or 24x7 SLA, and its Platform Subscriptions add feature development and roadmap influence. The Evolveum page lists no prices, so request a quote and ask which SLA tier, response times and included hours apply to your deployment. Plan your support model against the release calendar: midPoint 4.8 (Curie) is a long-term support release with support until 17 October 2028, while midPoint 4.10 (Braille) is supported until 26 November 2027. Ask your team whether they can absorb upgrades on a feature track, or whether an LTS line and a support contract better match your audit and change-control cycle.
Before you compare totals, make the cost model concrete. Ask SailPoint to itemize the license, the IdentityIQ or Identity Security Cloud subscription, any professional services for upgrades, and the connector licensing or Virtual Appliance costs. On the midPoint side, cost the ConnId connector builds for each application on your inventory, the database and application hosting, the operations staff, and a parallel-run period through at least one audit cycle. Then ask a partner to deliver a fixed-scope estimate against that list, so both sides rest on the same written scope.
Cost components on each side and whether they recur
This table lists each cost component on the SailPoint side and the midPoint side, with whether it is one-time or recurring. No SailPoint prices or DeployOpen estimates are supplied here, so every commercial figure must come from your written quote. Use the third column to separate the charges you pay once from those that repeat every year.
| Cost component | Commercial side (SailPoint) | Self-hosted side (midPoint) | One-time or recurring |
|---|---|---|---|
| Software license or subscription | IdentityIQ modules such as Compliance Manager, Lifecycle Manager, Password Manager and File Access Manager, or an Identity Security Cloud subscription. Confirm which modules each quote includes. | No midPoint license fee. midPoint is open source under EUPL-1.2 with Apache 2.0 as a secondary license. | Recurring on the SailPoint side. No license cost on the midPoint side. |
| Evolveum Product Support or Platform Subscription | Not applicable | Optional. Product Support covers product bug resolution with an 8x5 next-business-day or 24x7 SLA. Platform Subscriptions add feature development and roadmap influence. Evolveum lists no prices, so request a quote. | Recurring if chosen. Not required to run midPoint. |
| Infrastructure and hosting | IdentityIQ servers, database and environments in your data center or cloud account. Ask SailPoint which hosting components its quote assumes. | midPoint runs on Linux in a virtual machine or from Docker images, with PostgreSQL as the native repository database, ideally on a separate server. Multi-node setups add a load balancer and shared database. | Recurring for compute, storage and backup. Sizing drives the figure. |
| IdentityIQ 9.0 upgrade project | Upgrade effort to IdentityIQ 9.0 for customers on older releases, including rules, workflows and testing. Obtain a fixed scope and cost from SailPoint or a partner. | Not applicable unless you stay on IdentityIQ. A move to midPoint replaces this project with a migration project. | One-time. |
| Connector development or adaptation | Connectors supplied with the product or built through vendor services. Confirm connector coverage for each target system. | ConnId connectors are Java code behind a uniform interface. Documented connectors include LDAP, Active Directory, Microsoft Entra ID, SCIM2 and CSV. Other systems may need custom or community connectors. | One-time build, then recurring maintenance when target systems change. |
| Migration and parallel run | Export of roles, applications and workflows, plus vendor or partner services to rebuild them. Ask for the scope in writing. | Rebuilding roles, certifications and workflows in midPoint, plus running both systems through at least one audit cycle. Scope depends on the number of applications and rules. | One-time, but the parallel run may last longer than planned. |
| Operations, upgrades and internal skills | Vendor support and upgrades are part of the subscription. Internal staff still administer the product. | Internal or partner staff run midPoint, apply releases and patch the platform. Confirm which midPoint release line you will follow and its support end date. | Recurring. Staff skill needs and upgrade cadence drive the total. |
| Audit evidence work | Certification reports and evidence exports from the product. Confirm which evidence the auditor expects from the tool. | Building evidence for access reviews, provisioning logs and role approvals from midPoint. DeployOpen prepares evidence and controls for assessment. It does not issue audit reports. | One-time to set up, then recurring for each review cycle. |
What moves the cost up or down
Most of the self-hosted cost of midPoint comes from the work around the software rather than the license. The drivers below decide how much engineering, connector work and operations effort the move will need, so they belong in the written scope before any quote is compared with a SailPoint renewal.
Identities in scope
midPoint is stated to scale to deployments of up to 100 million identities, so identity volume mainly changes sizing of the database, nodes and task scheduling rather than a license count. Ask the vendor or partner to size for your peak population, including leavers, contractors and non-human accounts, and to model the nightly reconciliation window. Volume that is modest in headcount can still be heavy in account and entitlement records.
Connected systems and connector status
Each connected system is a connector project, and the effort depends on whether the Evolveum catalog lists it as supported or only as community or experimental. Documented connectors include LDAP, Active Directory, CSV, DatabaseTable, Microsoft Entra ID, SCIM2 and SCIMv1. Count your systems by connector status, and budget for custom ConnId development or ongoing maintenance on anything outside the supported list.
Certification and role-mining scope
The cost of access reviews grows with the number of campaigns, reviewers, applications and role definitions that must be rebuilt as midPoint certification definitions. Role mining also depends on how clean your existing entitlement data is. Confirm early which SailPoint certification and role workflows are regulated controls, because each one will need test evidence before the first audit cycle.
Availability and multi-node design
A single node is simpler to run, but a highly available deployment needs a sticky HTTP load balancer, a shared central database, cache invalidation between nodes over HTTPS and Quartz for distributed task scheduling. Each added node, database replica and backup target is recurring infrastructure cost. Ask what availability target your provisioning and access request services must meet, since that target sets the node count.
Team skills in Java, PostgreSQL and Linux
midPoint is written in Java, uses PostgreSQL as its native repository database, ideally on a separate server, and runs on Linux or Docker. If your team already operates these, the internal share of operations work falls. If not, you will pay a partner or hire for those skills, and that cost recurs for as long as the platform runs. Ask which of these skills exist in-house before comparing staffing lines.
Support tier and release cadence
Evolveum offers Product Support subscriptions with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. Choosing a tier is the main recurring license-like decision, and it is optional because midPoint has no license fee. Pair the tier with your release plan: midPoint 4.8 is a long-term support release supported until 17 October 2028, while feature releases such as 4.10 have shorter support windows.
What the Evolveum subscription buys and what it does not
The Evolveum subscription is optional. midPoint has no enterprise edition: Evolveum states that every line of midPoint code is published under open source licenses and that the project is open source, not open core. Evolveum funds development through subscriptions, training and professional services, with midPoint developers working on it full-time. That means a subscription is a way to buy vendor accountability and influence, not a key that unlocks features. Two subscription types are listed on Evolveum's support subscriptions page. Product Support covers resolving product bugs, with an 8x5 next-business-day or 24x7 SLA. Platform Subscriptions add feature development and roadmap influence. The page lists no prices, so the figure must come from a written quote.
Support is a recurring cost, and the question is what it replaces. Ask Evolveum which SLA tier matches your incident model, whether the 8x5 next-business-day option meets your recovery objectives for identity outages, and what response covers a provisioning failure that blocks joiner or leaver processing. Compare the quote with the internal on-call capacity you would otherwise staff: the people who read midPoint logs, debug ConnId connectors and patch a production node. Those salaries recur too, and they are usually the larger line for a team without prior midPoint experience.
Platform Subscriptions carry a different question. Feature development and roadmap influence matter only if you have requirements that the public roadmap will not deliver, such as a specific connector or a certification workflow change. Confirm in writing which features, if any, a Platform Subscription commits Evolveum to build, and whether roadmap input is a vote or a commitment. Do not budget for a feature on the assumption it will arrive. If you rely on community or experimental connectors from the integration catalog, weigh their support status separately, because a subscription does not automatically cover every connector in that catalog.
How to build the comparison with your own numbers
This sequence turns a SailPoint renewal into a like-for-like, three-year comparison with midPoint. Each step produces a figure you can check against written quotes, your own staffing plan and the version you intend to deploy.
Inventory every SailPoint line item
Finance and the identity governance owner pull the current contract, order forms, renewal notice and any amendments. List each product, suite and module in use, such as the IdentityIQ Compliance Manager, Lifecycle Manager, Password Manager and File Access Manager modules, or the Identity Security Cloud subscription, plus sandbox tenants, support tier, add-on connectors, identity-count basis and true-up terms. Record the contract term and renewal date beside each item. This step is done when every line has a source document and an owner, and the register totals match the invoices for the last full year.
Request written SailPoint quotes for the target
Ask SailPoint or your reseller for written quotes covering both your current scope and the target version or suite. For IdentityIQ, ask about the upgrade path to IdentityIQ 9.0, which SailPoint announced on October 6, 2026, including any upgrade fees, professional services and environment changes. For Identity Security Cloud, ask what the Human Fabric successor would cost at your identity volume. Request the same scope in each quote so the figures compare directly. This step is done when you hold quotes for the status quo and at least one target, each with stated terms and assumptions.
Fix the midPoint target version
Choose the midPoint release you will budget against before costing anything else, because the release calendar changes the answer. midPoint 4.9 support ends on October 18, 2026, midPoint 4.10 is supported until November 26, 2027, and midPoint 4.8 (Curie) is the long-term support release, supported until October 17, 2028. midPoint 4.11 is planned for October 21, 2026. Version choice sets the JDK: Java 25 for 4.11 and later, or Java 21 for 4.10 and older. Record the chosen version, the support end date and the JDK in the model. This step is done when the version and JDK are written into the assumptions sheet and signed off by the platform owner.
Cost the midPoint infrastructure and support
The platform team sizes servers against the midPoint system requirements, which list Linux in a virtual machine or Docker images, PostgreSQL as the native repository database, ideally on a separate database server, and extra nodes behind a sticky HTTP load balancer for multi-node setups. Price compute, storage, backups, disaster recovery, monitoring and the internal network or cloud charges, whether in your data center or your cloud account. midPoint has no license fee. Decide whether to buy an Evolveum Product Support or Platform Subscription, and ask Evolveum for a written quote because its page lists no prices. This step is done when the infrastructure bill of materials and the support decision are both recorded.
Estimate connector work per application
List every application that SailPoint connects to today and mark each as reused, rebuilt or retired. For each one, check whether a ConnId connector exists in the midPoint connector catalog and at what status: supported, community or experimental. Documented connectors include LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID, SCIM2 and SCIMv1. Where none fits, price a custom Java connector, including testing against the target system and maintenance for each upgrade. Also note SailPoint rules and workflows that must be redesigned rather than copied. This step is done when every application has a connector status, an effort class and an owner for testing.
Add migration and parallel-run effort
Estimate the work to export objects from SailPoint, rebuild roles, access requests and workflows in midPoint, and move certification campaigns and their evidence. Include the parallel run, in which both systems operate until one full audit cycle has passed, because the second platform's infrastructure and staff time recur during that period. Add data cleansing, identity reconciliation and user acceptance testing. Mark which items are one-time. Ask your implementation partner for a fixed-scope written proposal, and compare it with your internal estimate. This step is done when migration tasks, parallel-run scope and acceptance criteria are listed with an estimate for each.
Assign internal and external staff by role
Map the work to roles rather than to named people: identity architect, platform engineer, database administrator, Java developer for connectors, application owners, compliance reviewers and project manager. For each role, estimate effort for build, migration and steady-state operations, and note whether the work is internal or contracted. External costs may include Evolveum support or consulting, and a fixed-scope implementation partner such as DeployOpen, quoted from written scope. Include training and the staff needed for upgrades and testing. This step is done when every role has an effort estimate, a cost rate from your finance team and a split between internal and external delivery.
Model three years with one-time and recurring totals
Build a three-year model with two blocks. The one-time block includes migration, connector builds, infrastructure setup, training, parallel-run costs and any SailPoint upgrade fees. The recurring block includes SailPoint renewals, infrastructure run costs, midPoint support if chosen, operations staff, upgrade and testing effort, and backups. Show SailPoint status quo and the midPoint path side by side, and run a sensitivity case for a later midPoint release date, a larger connector count and a longer parallel run. Label any example figures as illustrative. This step is done when the model reconciles to the contract register and each total traces to a quote, an estimate or a named assumption.
Comparing an IdentityIQ 9.0 upgrade project with a move to midPoint
SailPoint announced IdentityIQ 9.0 on October 6, 2026 as the modernization path for hybrid and on-premises customers, which turns the cost question into a choice between two projects. The first is an upgrade project that moves IdentityIQ onto the new release and keeps the SailPoint subscription and its existing run model. The second is a migration project to midPoint, which ends the subscription but adds a new platform to build, test and operate. Neither option is a one-time expense. Each one leaves recurring costs behind, and the reader should compare those recurring costs as carefully as the project cost.
On the upgrade side, expect recurring spend on the SailPoint subscription for the modules in use, on the infrastructure that hosts IdentityIQ and its database, and on the internal or partner staff who keep customizations working across future releases. The upgrade cost is mostly one-time: rule, workflow and connector regression testing, plus any changes the automated upgrade tool does not handle. On the midPoint side, the license fee disappears, but the recurring costs move to connector maintenance, platform operations and staff time, and to an optional Evolveum subscription if the organization wants vendor-backed support. Evolveum publishes support tiers with an 8x5 next-business-day or 24x7 SLA, but it lists no prices, so the reader must request a quote for the tier they need.
The sibling page on the IdentityIQ 9.0 upgrade covers the scope of the upgrade in depth, including the rules and workflows to port. Use it to size the one-time work for each option, then ask both SailPoint and the midPoint partners for written quotes that show subscription, support, project and run costs separately across a common period. Confirm with SailPoint which modules and connectors your current contract covers in 9.0, and confirm with Evolveum which midPoint release line and support tier you would commit to, since 4.8 is the long-term support release and 4.10 is a feature release with a shorter support window.
Questions buyers ask before comparing SailPoint and midPoint costs
Does midPoint have a license fee?
No. midPoint is open source and has no license fee: its repository is licensed under the European Union Public License (EUPL-1.2) with Apache 2.0 as a secondary license, and Evolveum states that it has no enterprise edition. Evolveum funds development through subscriptions, training and professional services, so the costs you carry are the ones for infrastructure, people and any services you buy. Your cost comparison should therefore replace the SailPoint license line with a line for hosting, database operations, connector work, migration and internal or partner staff. Ask any vendor, including SailPoint, to itemize which components are one-time and which recur each year.
What does Evolveum charge for midPoint support?
Evolveum sells Product Support subscriptions and Platform Subscriptions, and its support page lists no prices, so you need a written quote for your deployment. Product Support covers resolving product bugs, with an 8x5 next-business-day or 24x7 SLA as the options. Platform Subscriptions add feature development and roadmap influence on top of that. Ask Evolveum which SLA level matches your incident obligations, what is included in each subscription, how the price scales with your environment, and whether consulting and training are billed separately. Support is a recurring cost, and it is optional, so model it as a separate line from the platform itself.
Is a midPoint support subscription required?
No, a support subscription is not required to run midPoint, because the software is open source and has no license fee. The decision is about risk tolerance and staffing. Without a subscription, your internal team or a partner handles bug triage, patching and upgrades, and any fix you need depends on your own capacity or on community contributions. With a Product Support subscription, you have a contractual route for product bugs and a defined response level. Many buyers compare the cost of a subscription against the fully loaded cost of engineers who would otherwise investigate defects during an audit cycle. Confirm with Evolveum which option fits your regulatory and uptime commitments.
How long does a migration from SailPoint to midPoint take?
No supplied duration exists for this migration, so no timeline should be assumed from this page. The duration depends on how many applications, connectors, roles, certification campaigns, workflows and custom rules you have, how clean your identity data is, and how long you run both systems in parallel through an audit cycle. Ask any implementation partner for a written plan that lists phases, deliverables, dependencies and acceptance criteria before work starts. A fixed-scope agreement fixes the scope, deliverables and timeline in writing, so compare proposals on the same inventory of your current SailPoint estate. Treat any verbal estimate that is not tied to that inventory as unverified.
Can our internal team run midPoint without outside help?
Possibly, if you have the skills and capacity, but that is a question to answer from your own staffing, not from this page. Running midPoint means owning the Java application, the PostgreSQL repository, the Linux or Docker hosts, the load balancer and database backups, and the ConnId connectors to each system you govern. Evolveum describes its platform as being developed by full-time staff, so you should expect your own team to need training and time to become productive. Many organizations split the work: internal staff own day-to-day operations and business rules, while an external partner handles initial build, connector development and hardening. Decide which parts you will own before you request a quote.
What skills does a midPoint deployment require?
The work needs Java, PostgreSQL, Linux and container skills, with identity governance knowledge on top. Evolveum's system requirements recommend Java 25 for version 4.11 and later (Java 21 supported) and Java 21 for 4.10 and older (Java 17 supported). midPoint uses PostgreSQL as its native repository database, ideally on a separate database server, so database administration is a core task. It runs on Linux in a virtual machine or from Docker images, and multi-node deployments need a sticky HTTP load balancer, a shared central database and Quartz for distributed task scheduling. Connector work requires Java, since each ConnId connector is Java code. Check the current requirements on the midPoint system requirements page before you size your team.
What drives the effort and cost of a midPoint migration up?
The main drivers are the number of connected systems, the amount of custom logic you must port, and the quality of your identity data. Each target system you connect may need a ConnId connector, and integration catalog connectors range from supported to community and experimental status, so less common systems may require custom development. Custom SailPoint rules, workflows and certification definitions must be redesigned rather than copied in many cases. Parallel running through an audit cycle adds operating cost for both platforms. Reduce effort by inventorying applications and entitlements early, cleaning duplicate accounts, and deciding which governance features need to match SailPoint exactly and which can change.
How do we get a fair quote from an implementation partner?
Ask for a fixed-scope proposal based on a written inventory of your environment. DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, and most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, and a quote follows from the written scope. Provide your SailPoint version, module list, connector inventory, certification campaigns, custom rules, target hosting model and audit obligations. Ask each bidder to separate one-time build costs from recurring support and retainer costs, and to name the staff roles involved. Ongoing support, upgrades and continuous testing are available as retainers, so request those as separate line items.
How DeployOpen scopes a fixed-price midPoint implementation
DeployOpen is a Chainscore Labs company that plans, implements, integrates, hardens, backs up, documents and supports self-hosted open-source platforms in your own infrastructure. For SailPoint cost vs self-hosted midPoint, we start from a written scope that separates license spend, infrastructure, connector work and staff time so you can compare each line with your current contract.
How we scope
- Inventory current SailPoint modules, subscriptions and the systems each one connects to
- List the connectors you need, mapping each to a ConnId connector or a custom build
- Agree in writing on scope, deliverables and timelines before any work starts
How we build
- Size midPoint hosting on Linux virtual machines or Docker, with PostgreSQL on a separate database server
- Build and test connectors against non-production copies of your target systems
- Run a parallel test of provisioning, certifications and role models against your own data
How we hand over
- Document the cost model, infrastructure layout, connector inventory and runbooks in your environment
- Deliver backup and restore procedures and test them before cutover
- Provide evidence packs that help your auditors assess controls, without issuing any audit opinion
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover
- Plan midPoint upgrades around the published release support windows you choose to follow
- Coordinate with Evolveum support subscriptions if you decide to buy them for product bugs
