Where SAP IdM cost ends and midPoint cost begins
If your SAP Identity Management maintenance renewal or the 2027 end of mainstream maintenance is already on the calendar, the first thing to know is that midPoint carries no license fee. The comparison is therefore decided by implementation, migration, connectors, infrastructure and staffing, not by the price of the software. midPoint is dual-licensed under the European Union Public License (EUPL-1.2) and Apache 2.0, and Evolveum states that it has no enterprise edition: every line of its code is published under open source licenses. An Evolveum subscription is optional. Evolveum funds development through subscriptions, training and professional services, so a support contract buys bug resolution and, at a higher tier, feature development and roadmap influence, not access to the software.
On the SAP side, ask for a written statement of what the current renewal covers, what the extended maintenance terms are, and what a new license for a successor would cost. Those figures come from SAP, and this page does not estimate them. On the midPoint side, the recurring and one-time costs are the ones you must build yourself: the migration and implementation work, the ConnId connectors you need for each target system (checking whether each is supported, community or experimental in the integration catalog), servers for midPoint nodes, a separate PostgreSQL database server, and the people who run the platform after go-live. Each of these is paid to a named party, whether an internal team, an Evolveum partner or an implementation firm such as DeployOpen.
Costs grow with the number of connected systems, the depth of role models and approval workflows, and the number of identities, since midPoint is stated to scale to up to 100 million identities. Ask any implementation partner for a fixed scope that lists the source systems, the target systems by connector, the approval and certification flows to port and the parallel run period, and ask Evolveum which support tier you would need to meet your uptime expectations. Compare those written scopes side by side with the SAP renewal quote, and treat the difference in staffing as the number that decides the case.
Cost components on each side
This table sets the cost components of keeping SAP Identity Management against those of running self-hosted midPoint, row by row, with each component marked as one-time or recurring. Read it as a checklist for the quote you request from each side, because most of the difference sits in services, connectors and the team that operates the platform rather than in license fees.
| Cost component | Commercial side (SAP IdM) | Self-hosted midPoint side |
|---|---|---|
| License or extended maintenance | SAP IdM license and maintenance fees, or a new license if you move to a different SAP product. Confirm the terms of any extended maintenance with SAP. Recurring. | No license fee. midPoint is published under EUPL-1.2 with Apache 2.0 as a secondary license. Optional Evolveum subscriptions are recurring. Confirm the terms in writing. |
| Migration services | Typically one-time, covering scoping, workflow and role model porting and parallel running. Confirm whether your SAP partner or SAP itself quotes these separately. | One-time, delivered by your internal team, Evolveum consulting or an implementation partner. Ask for a fixed-scope written quote covering the same workflow and role work. |
| SAP connectors | Included in or licensed alongside the SAP IdM stack. Confirm which SAP targets and versions your contract covers. | Confirm the status of SAP R/3 and SuccessFactors connectors in midPoint's connector catalog before costing. Connector build or adaptation work is one-time. |
| Non-SAP connectors | Typically licensed or delivered per target system. Ask for each connector's price and maintenance terms. | ConnId connectors are open source. Documented options include LDAP, Active Directory, SCIM2 and Microsoft Entra ID. Custom or community connectors need testing and support effort. |
| Infrastructure | Application servers, database and hosting for the SAP IdM stack, sized by your SAP vendor. Recurring. | Servers or virtual machines for midPoint nodes, a load balancer and separate database hosts. midPoint runs on Linux virtual machines or Docker images. Recurring. |
| PostgreSQL | Database licensing or hosting is part of the existing SAP IdM stack. Confirm the supported database engines. | midPoint uses PostgreSQL as its native repository, ideally on a separate database server. Open-source licence. Recurring hosting and backup effort. |
| Implementation | Vendor or partner configuration of the SAP IdM stack, usually one-time for new projects. | One-time build of the midPoint deployment, integrations, role model and audit configuration, delivered by your team or a partner under a written scope. |
| Support | Vendor support contract, typically recurring. Ask for the response times included. | Optional Evolveum Product Support or Platform Subscriptions, recurring. Evolveum publishes SLA options (8x5 next business day or 24x7) but no prices. Alternatively, a partner retainer. |
| Upgrades | Vendor-driven upgrades, often bundled with maintenance. Confirm what is included after 2027. | Planned upgrades between midPoint releases, such as moving to 4.11 or later, with Java version changes. Recurring internal or partner effort. |
| Internal skills and training | Staff trained on SAP IdM administration. Recurring training and retention cost. | Staff need Java, PostgreSQL and midPoint administration skills. Evolveum offers training. One-time ramp-up, then recurring operations effort. |
What you pay for on the SAP side and the midPoint side
On the SAP side, the recurring cost is the license or maintenance agreement, and the one-time cost is the work around it. Confirm with SAP which term applies to your estate: extended maintenance for an installed SAP Identity Management system, or a new license if you move to a different SAP product. Then add the SAP-linked integration work that keeps provisioning running: connectors to SAP R/3 and SuccessFactors, the custom logic written for your approval workflows and role model, and the internal time to test each target system. Ask SAP and any migration partner to price these as separate lines so you can see which costs disappear when you decommission the system and which stay with you.
On the midPoint side, the software carries no license fee, so the bill is made of components you pay for directly. These are servers or virtual machines, a PostgreSQL database on a separate server as midPoint recommends, implementation and connector work, and the people who operate the platform afterwards. Staffing usually costs the most over time, so estimate how many engineers must understand midPoint, ConnId connectors and the database, and whether that skill already exists in-house. Evolveum's Product Support subscriptions, which offer an 8x5 next-business-day or 24x7 SLA, and its Platform Subscriptions, which add feature development and roadmap influence, are optional. Evolveum's support subscriptions page lists no prices, so request a written quote for the tier you need and compare its SLA against your operating hours.
When you request quotes, ask each vendor and partner to split one-time costs (migration, connector build, parallel running, decommissioning) from recurring costs (licenses, subscriptions, hosting, staffing, upgrades). Ask what drives each figure up, such as the number of connected systems, custom connectors, identity volume or the number of approval flows. A fixed-scope quote written from an agreed inventory makes these comparisons possible. DeployOpen does not publish prices, and its quotes follow from the written scope of your environment.
What moves the comparison up or down
The cost of replacing SAP Identity Management with midPoint depends less on the license line than on a few operating factors. The cards below cover the decisions that most change the total, and each one names what to confirm before asking for a quote.
Identity count and growth
Evolveum states that midPoint scales to deployments of up to 100 million identities, so scale is rarely the constraint. What changes the cost is the number of identities that must be reconciled each night, the sync frequency and the size of the initial load. Ask for the current identity count across HR, SAP and directory sources, the expected growth over the next few years, and the number of joiner, mover and leaver events per day. These figures drive the size of the database, the number of midPoint nodes and the tuning effort.
SAP and non-SAP target count
Each target system needs a connector, a mapping and a test cycle. Connectors that cover common protocols such as LDAP, Active Directory, Microsoft Entra ID and SCIM2 are the lowest-effort targets. SAP-specific targets, and any custom SAP interfaces that SAP IdM currently reaches through its own adapters, need a connector decision, a build or buy choice and a test plan. Make an inventory of each target, its protocol, its owner and whether it is in scope for the first wave of migration.
Connector support status
midPoint uses the ConnId framework, and its catalog ranges from supported connectors to community and experimental ones. A supported connector usually carries the least project risk, while a community or experimental connector may need code review, patching and internal ownership. Ask for the status of each connector your targets require, and for the license and maintainer of any community connector. Budget for development or subscription-backed support where a required connector is not in the supported tier.
Availability and 24x7 support
Evolveum offers Product Support subscriptions with either an 8x5 next-business-day SLA or a 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. Whether a provisioning outage can wait until the next business day is a business decision, and it determines the subscription tier and the on-call rota you need. Confirm your provisioning criticality, the acceptable recovery time for joiner processing and whether your operations team can cover overnight incidents. The page lists no prices, so ask Evolveum for a quote against the tier you choose.
Java and PostgreSQL platform choices
midPoint recommends Java 25 for version 4.11 and later, with Java 21 supported, and Java 21 for 4.10 and older, with Java 17 supported. It uses PostgreSQL as its native repository database, ideally on a separate server. Choosing the release line therefore sets the JVM you patch, the database version you maintain and how long the platform stays on a supported track. Check the support windows for 4.8 and 4.10 before you choose a release, and confirm your organization's standard for Java and PostgreSQL hosting.
In-house skills to run it
The largest recurring cost is usually the team that operates midPoint, not the software. Running it needs people who can write midPoint XML and object configuration, manage ConnId connectors, operate PostgreSQL, handle Java runtime upgrades and run the release cycle. If those skills are not in-house, the choices are to hire, train or contract them. Assess current skills in IAM engineering, Java operations and database administration, and decide who owns the platform after go-live.
How to build the comparison with your own numbers
This sequence turns a vague sense that SAP IdM costs too much into a dated, line-by-line comparison that your finance, security and platform teams can defend. It separates what you pay today from what a midPoint program would cost, and shows how each assumption moves the result.
Inventory identities and connected systems
Start by counting what SAP IdM manages today: identity populations by type (employees, contractors, service and non-human accounts), authoritative HR sources, and every target system with its connector type. Record which targets are SAP systems and which are non-SAP, because connector work differs between them. Ask the SAP IdM administrators to export the connector and job list, and have the HR team confirm the source of truth for each population. The step is done when one table lists every source and target with its owner and last change date.
List every SAP IdM component and its contract terms
Record each SAP IdM component you run, including the base product, any connectors, custom workflows and related SAP licenses, and attach the current contract terms for each. Ask procurement and SAP account owners which support or maintenance path applies to you and what the paid options are for the period after mainstream maintenance ends. Note the renewal dates, notice periods and any price-escalation clauses. The step is done when every line has a contract reference and a named owner, and gaps are listed as questions for SAP.
Request written quotes for each midPoint cost component
Price midPoint component by component rather than as one bundle. Request an Evolveum subscription quote for the support level you need, which is either Product Support with an 8x5 next-business-day or 24x7 SLA, or a Platform Subscription, and ask Evolveum which option fits your roadmap needs. Request a separate written scope from any implementation partner covering migration, connector development, approvals and testing. Ask for infrastructure sizing for servers, a PostgreSQL server and backups, and an estimate of internal staffing. The step is done when each component has a written quote or scope, and none relies on a figure from this page.
Separate one-time costs from recurring costs
Sort every line into one-time costs such as migration scope, connector development, testing, data cleanup and training, and recurring costs such as subscriptions, hosting, database operations, patching and staff time. Keep the midPoint software license line at zero, because midPoint is published under open source licenses, but do not treat zero licensing as zero total cost. Choose a comparison horizon that matches your board or budget cycle, and apply it equally to the SAP option. The step is done when both paths show the same horizon with one-time and recurring totals side by side.
Model the parallel-run period
Add a parallel-run period in which SAP IdM and midPoint both provision in agreed scope, so you can compare results and keep a rollback path. Cost the extra licenses, servers, support and staff time needed while both systems run, and list the reconciliation work between them. Ask your implementation partner how they propose to structure the parallel run and what evidence they will produce at the end of it. The step is done when the parallel-run cost appears as its own line and the team can state what must be true to decommission SAP IdM.
Run sensitivity on connector effort and team size
Test how the result changes when the two inputs most likely to move, connector effort and team size, are varied. Build a simple spreadsheet with low, expected and high cases for each connector and for the number of staff who will run midPoint after go-live. Keep the cases illustrative until quotes come back, and label them as such in the workbook. Check which connectors are supported, community or experimental in the Evolveum connector catalog, since that status drives the effort estimate. The step is done when the team can name the two or three assumptions that change the decision most.
Confirm scope and assumptions in writing
Before the business case goes to decision makers, send every assumption back to the vendor, partner and internal owners for written confirmation. Ask each party to state what is excluded from its figure, such as data cleanup, custom workflow porting, security testing, compliance evidence or ongoing upgrades. Reconcile any figure that is not backed by a written quote and mark it as an open item. The step is done when the model has a named source or owner for every number and an open-items list with dates agreed with each owner.
How the comparison changes by situation
When most provisioned targets are SAP systems, such as SAP R/3 or ECC clients, the largest cost lines usually sit in connector work and in the SAP-side skills needed to test it. midPoint's ConnId framework is open source, but the connector coverage for SAP systems is the decisive question, and the status of each SAP connector must be confirmed in Evolveum's connector catalog before any budget is set. Most of the effort will sit in mapping SAP roles, authorizations and transaction logic into midPoint roles.
- Connector status: Confirm whether the SAP R/3 connector you need is supported, community or experimental in the Evolveum connectors catalog.
- Custom connector work: Budget for development and testing if a required SAP function is not covered, since that work is paid for once but must be maintained through every midPoint upgrade.
- Role model migration: SAP authorization objects are often more granular than the roles SAP IdM previously assigned, so role mining and redesign typically take the largest share of effort.
- Specialist skills: Ask any partner whether their SAP basis and authorization consultants are included in the quote or billed separately.
- Support subscription: An Evolveum Product Support subscription may be worth comparing against internal staffing for SAP-specific bug resolution.
Before comparing totals, confirm the connector status for every SAP target in writing with the vendor and ask a partner for a fixed-scope estimate built on your actual role count.
Most organizations run SAP alongside directory services, SaaS applications, databases and HR sources. In this situation the cost is spread across many connectors and integration points rather than concentrated in one. midPoint's documented connectors include LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID through the Graph API and SCIM2, which cover a broad share of non-SAP targets without custom code. The cost question becomes how many of your targets map to existing connectors and how many need work.
- Connector inventory: List every target and check its connector against the documented set and the wider integration catalog.
- Standard protocols: Targets that speak SCIM2 or LDAP usually cost less to connect than proprietary interfaces that need scripting.
- Parallel running: Running SAP IdM and midPoint side by side adds server, licensing and staff time for the overlap period, so ask how long each target will be dual-provisioned.
- Integration testing: Test each connector against a non-production copy of the target before cutover, as this is often the largest recurring test effort.
- Operating model: Decide whether your own team or a partner will run the platform after go-live, since that choice drives recurring cost more than the initial build.
Before committing, confirm which of your non-SAP targets are on the supported list and which will need community or custom connectors.
A small estate with few connectors has a different cost profile. The fixed costs of running any identity platform, including servers, PostgreSQL, backup, monitoring and an operator, are spread over fewer targets, so they make up a larger share of the total. Because midPoint carries no license fee, the decision often turns on how much staff time the platform requires and whether a support subscription is needed to cover that gap. Illustrative example: an organization with a handful of directory and application targets may find that the operating team, not the software, is the main recurring expense.
- Fixed infrastructure: Servers, database hosting and backups are required whatever the target count, so ask what the minimum footprint is for a single-node deployment.
- Skills coverage: Check whether one or two people can cover upgrades, which follow the midPoint release schedule, and whether that coverage is adequate.
- Support subscription: Decide whether an Evolveum Product Support subscription with an 8x5 or 24x7 SLA is proportionate to the risk of downtime in your environment.
- Simpler migration: Fewer targets usually means a shorter parallel run and less connector testing, which lowers one-time cost.
- Vendor exit cost: Compare the remaining SAP IdM maintenance cost against the one-time migration cost, because a small estate may reach break-even sooner.
Before deciding, ask a partner for a fixed-scope quote covering the minimum infrastructure, the operating model and a support tier, then compare it with your current renewal.
Cost and effort questions buyers ask before hiring help
Is midPoint really free to license?
Yes, midPoint has no license fee. Evolveum states that midPoint has no enterprise edition and that every line of its code is published under open source licenses, with the repository under EUPL-1.2 and Apache 2.0 as a secondary license. Your costs therefore sit in the components around the software: servers, PostgreSQL, connector work, implementation services and the people who operate the platform. Ask any vendor or partner to show which of these they are quoting, so the price comparison with SAP IdM covers the same components on both sides. Confirm the license terms with your legal team before you rely on them for a specific use.
What does an Evolveum subscription add to midPoint?
An Evolveum subscription adds vendor-backed support and, at higher tiers, influence on the product. Evolveum offers Product Support subscriptions for resolving product bugs, with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. The support page lists no prices, so request the current figures from Evolveum in writing. Whether you need a subscription depends on your tolerance for waiting on bug fixes, your internal skills and whether a third party will provide support. Evolveum also sells consulting and training, which are separate line items.
How much internal effort does running midPoint need?
The effort depends on deployment size, number of connected systems and how much change your identity model sees. The recurring work includes patching and upgrading midPoint on its release cycle, maintaining connectors for each target system, operating PostgreSQL and backups, monitoring the multi-node setup and handling access request and certification workflows. midPoint 4.8 is a long-term support release supported until 17 October 2028, which lowers how often you must make major upgrades. Ask your implementation partner for a written estimate of the run team's hours per month, broken down by these tasks.
Can our team do the migration alone?
A capable team can do it alone if it has time, skills in Java-based platform operations, PostgreSQL and the target systems you need to connect. The harder parts are usually the source of truth decision, the role model redesign, approval flows and parallel running with SAP IdM until cutover. midPoint uses the ConnId connector framework, where each connector is Java code, so a team without that skill may need outside help for non-standard targets. Be honest about who will own the platform after go-live, because an in-house project that loses its owners often stalls before decommissioning SAP IdM.
How do we choose between a fixed-scope implementation and a retainer?
Use a fixed-scope engagement for a defined piece of work, such as a connector set, a role model or a cutover, and use a retainer for work that continues after go-live. Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ongoing support, upgrades and continuous testing are available as retainers. A useful test is whether the work has a clear finish point. If the platform must be patched, backed up and upgraded every year, plan for a retainer or an internal run team from the start.
What should a quote for a midPoint migration include?
A useful quote lists each cost component separately so you can compare it with your SAP IdM figures. Ask for the following in writing:
- Scope and the list of source and target systems, including which connectors are supported, community or custom
- Infrastructure sizing for midPoint nodes, the load balancer and PostgreSQL, with one-time and recurring costs marked
- Evolveum subscription tier, if any, and whether it is quoted separately
- Parallel running period, cutover plan and decommissioning steps for SAP IdM
- Handover, documentation and the run model after go-live, including who patches the platform
DeployOpen does not publish a price list, and a quote follows from the written scope.
Which SAP IdM costs does midPoint remove, and which ones stay?
midPoint removes the recurring SAP IdM license and maintenance fees and any dependency on SAP's proprietary connector licensing for the systems you move. Some costs stay: infrastructure, database operations, the team that runs the platform, connector development for systems without an existing connector and the cost of migration itself. SAP ends mainstream maintenance for SAP IdM in 2027, so compare the extended maintenance quote with the cost of a new platform, not just the license. Ask SAP for the exact extended maintenance terms and their duration in writing before modeling the comparison.
How timing changes the cost of switching
The cost of switching depends mainly on when the work starts relative to three dates: SAP's 2027 end of mainstream maintenance for SAP Identity Management, your next SAP IdM renewal, and the midPoint release you plan to run. Starting late pushes the project into a period where keeping SAP IdM alive is the only way to keep provisioning running, and that spend recurs until cutover. Ask SAP in writing what extended maintenance or bridging terms apply to your contract and what they cost in each year. Also get your renewal notice period in writing, because it sets the latest date you can decide without committing to another term.
The midPoint release calendar affects both the pilot and the production build. According to the midPoint releases page, midPoint 4.9 support ends on 18 October 2026, so a pilot started on it will need an upgrade early. midPoint 4.11 is planned as a feature release for 21 October 2026, and midPoint 4.10 is supported until 26 November 2027. midPoint 4.8 is a long-term support release supported until 17 October 2028, which gives a stable base for a multi-year parallel run with fewer upgrade cycles. Confirm the current calendar before you fix the target version, and weigh newer features against the upgrade effort each release adds during migration.
Do not make a cost decision that leaves no time for parallel running. The cheapest-looking plan often removes the overlap period, but a short overlap is where account reconciliation, joiner, mover and leaver testing, and rollback happen. Budget for SAP IdM to stay in service while midPoint takes over one target system at a time, and decide in advance which Evolveum support tier covers the cutover window. Product Support is offered with an 8x5 next-business-day or 24x7 SLA, so match the tier to the hours your HR and access teams actually work. If the schedule forces a cutover before these steps are done, the cost of an outage in provisioning will likely exceed what you saved.
How DeployOpen scopes a fixed-price midPoint implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For SAP Identity Management cost vs self-hosted midPoint, we start from a written scope that separates license, maintenance, migration, connector and run costs so you can compare options on the same basis.
How we scope
- Inventory every SAP IdM connector, source feed, role and approval workflow that a midPoint replacement must cover.
- Agree which SAP and non-SAP target systems are in scope, and which connectors need custom ConnId work.
- Record the written scope, deliverables and timeline before any work starts, since most engagements are fixed-scope.
- Ask for a quote that lists each cost component separately: migration, connectors, infrastructure and run effort.
How we build
- Deploy midPoint on your Linux virtual machines or Docker images, with PostgreSQL on a separate database server.
- Build or adapt ConnId connectors for SAP and non-SAP systems, and test each one against a non-production target.
- Run simulations against a copy of production identity data to check role and provisioning results before cutover.
- Harden the platform, configure auditing and document the controls that assessors and internal reviewers will ask about.
How we hand over
- Document the architecture, connector configuration, role model and runbooks so your team can operate midPoint afterwards.
- Run parallel-operation and cutover tests, then agree the decommissioning steps for SAP IdM in writing.
- Train the administrators who will own connectors, roles and upgrades, and record the knowledge transfer as a deliverable.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover, priced separately from the implementation.
- Plan upgrades against midPoint's published release and support dates, so each upgrade is scheduled rather than forced.
- Confirm with Evolveum which subscription tier fits your support requirements, since DeployOpen is not a vendor reseller.
