Saviynt cost vs self-hosted midPoint

Does self-hosting midPoint cost less than Saviynt's Identity Cloud?

Short answer: midPoint carries no license fee, so the comparison is not between two price tags. It is between Saviynt's subscription, which is quoted per module and per scope, and the recurring and one-time costs of running midPoint in your own infrastructure. Saviynt's prices are not part of the supplied research for this page, so the Saviynt side must come from its written quote. Ask the vendor to price each module you use (identity governance, privileged access, application access governance and non-human identities) separately, and to state the identity volume, term and any multi-year discount the figure assumes. Without that breakdown, a side-by-side comparison will not hold up in a renewal review.

Self-hosting shifts cost into labor and infrastructure. The largest recurring items are staff who operate midPoint and PostgreSQL, the Java runtime and the hosting environment, which may be virtual machines, Docker or a multi-node layout with a sticky load balancer and shared database. Connector work is the main one-time cost. midPoint uses ConnId connectors, and documented connectors cover LDAP, Active Directory, Microsoft Entra ID, SCIM2 and others, but any system outside that catalog needs development or a vendor-supported connector. Migration effort, PAM tooling for privileged accounts (midPoint is not a privileged access product) and audit evidence work also add cost. Each of these is where self-hosting tends to cost more than the subscription it replaces.

Self-hosting tends to cost less where your Saviynt bill is driven by module count or identity volume that you do not actively govern. Evolveum offers an optional Product Support subscription with an 8x5 next-business-day or 24x7 SLA, and a Platform Subscription for feature development, but both are priced by Evolveum and are optional. Ask Evolveum for its current support quote alongside your internal staffing estimate, and compare the total over a three to five year horizon. Set the Saviynt quote, the midPoint support quote, your staffing plan and the connector backlog side by side. The answer changes depending on how many modules you truly need, so resolve that question first.

Which cost components sit on each side of the comparison

This table sets Saviynt's vendor-delivered model against a self-hosted midPoint deployment, row by row, so you can see who is paid for each component and whether it recurs. Read the one-time and recurring notes first, because the largest differences usually sit in hosting, connector work and internal skills rather than in license lines. The main takeaway is that midPoint removes the license line but moves operating and engineering work onto your team or a partner.

Cost component	Saviynt Identity Cloud	Self-hosted midPoint
Subscription or license (recurring)	Subscription priced per module, such as governance, privileged access and application access governance. Confirm module scope and term in the written quote.	No license fee. midPoint is open source under EUPL-1.2 with Apache 2.0 as a secondary license, and Evolveum publishes no enterprise edition.
Vendor support (recurring, optional)	Included in the subscription as defined by Saviynt. Ask what severity levels, response targets and upgrade rights the contract covers.	Optional Evolveum Product Support subscription for product bugs, with 8x5 next-business-day or 24x7 SLA options. Platform Subscriptions add feature development. The support page lists no prices.
Hosting infrastructure (recurring)	Vendor-run cloud hosting, so Saviynt carries the infrastructure cost inside the subscription. Confirm data location and tenancy model.	Your cloud or data center: virtual machines or Docker, a separate PostgreSQL server, a sticky load balancer and a shared database for multi-node setups. Sizing and monitoring are your responsibility.
Implementation (one-time)	Vendor or partner onboarding and configuration, scoped in the Saviynt contract or a services order. Ask who builds the initial access model.	Internal effort or a fixed-scope partner engagement to install, configure, integrate and harden midPoint. The cost depends on scope and team skills, so request a written scope before comparing.
Connector development (one-time, then recurring for upkeep)	Connectors come with the platform for supported applications. Ask which target systems need custom work and who maintains them.	midPoint uses ConnId connectors. Documented connectors include LDAP, Active Directory, CSV, Microsoft Entra ID and SCIM2. Gaps need Java connector work, and each connector needs maintenance after upgrades.
Migration (one-time)	Export of identities, entitlements and certification history from Saviynt, subject to what the vendor provides. Confirm export formats and any fees.	Extraction and loading of identities, roles and audit history into midPoint, plus parallel running. Effort rises with the number of target systems and the depth of certification history you must keep.
Upgrades and patching (recurring)	Handled by Saviynt as part of the cloud service. Confirm the notice period and whether custom configuration needs retesting.	Your team plans and tests upgrades across midPoint releases. For example, 4.8 (Curie) is long-term support until October 17, 2028 and 4.10 (Braille) is supported until November 26, 2027, per Evolveum's release documentation. Java version changes also require testing.
Internal skills and operations (recurring)	Smaller administration team focused on policy and configuration, with the vendor operating the platform. Confirm which tasks remain with your staff.	Staff for Java, PostgreSQL, Linux, identity modeling and connector maintenance, along with on-call coverage. Build this into the total cost, or budget for an ongoing partner retainer.
Privileged access tooling (recurring, if needed)	Included in Saviynt's converged platform where the module is licensed. Confirm the PAM and application access modules in your quote.	midPoint does not cover PAM. Budget separately for tools such as Teleport, JumpServer or a secrets manager, with their own licenses or hosting and their own operating effort.

What moves the Saviynt versus midPoint cost gap

The gap between a Saviynt subscription and a self-hosted midPoint deployment is set less by the software, which carries no license fee, than by a handful of variables in your environment. Model each driver below against your own identity counts, system inventory and staffing before comparing totals.

Identity count and scale

Saviynt subscriptions are typically priced against the number of identities under governance, so headcount, contractors and non-human accounts all move the quote. midPoint has no per-identity license, but Evolveum states it scales to deployments of up to 100 million identities, so larger populations mainly change sizing, database capacity and node count. Ask Saviynt how its quote counts identities and whether non-human accounts are included, then size midPoint nodes and PostgreSQL for your real population.

Number of target systems

Each target system you connect needs a connector, and that work is usually the largest recurring effort in a midPoint project. midPoint ships with connectors for LDAP, Active Directory, CSV, databases and Microsoft Entra ID, while Saviynt includes a broad connector catalog in its subscription. Count applications that lack a documented connector, since each one with a custom ConnId connector adds build, test and maintenance cost.

Which Saviynt modules are licensed

Saviynt bundles governance, privileged access and application access governance in one platform, but your contract may license only some of them. Cost comparison should cover only the modules you actually pay for. midPoint covers provisioning, lifecycle, role-based access control, auditing, access requests and role mining, so any licensed privileged access or application governance module needs a separate tool in the midPoint scenario. Ask for the order form line items.

Support level and availability

midPoint is free to download and run, but production operators often buy support. Evolveum offers Product Support subscriptions with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development. A 24x7 requirement, a fixed release cycle or internal staff on call raises the recurring cost, while an internal team that accepts business-hours response lowers it. Compare the support tier to the Saviynt support terms in your contract.

Data residency and hosting model

Saviynt runs as a cloud service, while midPoint runs in your own virtual machines, containers or data centers. Hosting cost therefore becomes a line you pay directly, covering compute, storage, backup, high availability and a separate PostgreSQL server. Residency requirements may rule out a SaaS quote entirely, which shifts the comparison toward infrastructure and operations cost. Ask whether Saviynt can host in your required region and what it charges for that option.

Existing Java, PostgreSQL and Linux skills

midPoint is written in Java, uses PostgreSQL as its native repository, and runs on Linux, with recommended Java versions depending on release. Teams that already operate these stacks absorb midPoint with less new hiring or training, while teams without them must budget for skills or external services. The effort of learning the platform, tuning the database and patching the runtime is the cost most often underestimated. Inventory those skills before comparing totals.

How to build the comparison with your own numbers

This sequence turns a Saviynt quote and a midPoint deployment plan into one side-by-side model of one-time and recurring costs over the horizon you choose. Each step produces a figure you can defend in a budget review.

Request an itemized Saviynt quote by module and term
Ask Saviynt or your reseller for a written quote that lists each module you would license, the identity count tier, the connected application count, the term length and any separate charges for privileged access or application access governance. Procurement or the finance lead owns this request. The step is done when every line item maps to a capability you actually need, and when the quote states which modules are optional. Saviynt sells one converged platform, so ask for each module separately so you can remove the ones midPoint would replace.
Count identities and connected systems
Export counts of workforce, contractor, service and privileged identities from your HR source and directories, and list every target system that needs provisioning, certification or password management. Identity engineering and the application owners do this together. Record which systems use protocols that ConnId connectors already cover, such as LDAP, Active Directory, SCIM2 and Microsoft Entra ID, and which need custom connector work. The step is done when you have one sheet with identity counts by type and a connector status for each system, because both drive license tiers on the Saviynt side and connector effort on the midPoint side.
List the midPoint components you would run
Write down every component the deployment needs: application server nodes, the PostgreSQL database server (midPoint recommends a separate database server), the sticky HTTP load balancer, the shared central database, the Quartz-based task scheduling nodes, and the environments for development, test and production. Platform or infrastructure engineering owns this list. Check the system requirements for the Java version that matches your chosen release, since midPoint 4.11 and later recommend Java 25 while 4.10 and older recommend Java 21. The step is done when each component has a host, an owner and a hosting location inside your own infrastructure.
Price internal and external labor per component
For each component and each integration from the earlier steps, estimate the labor split between your staff and any external implementation partner. Separate one-time work such as installation, connector development, role design, migration and testing from recurring work such as patching, backups, monitoring, access reviews and upgrades. Ask any implementation partner for a fixed-scope written proposal, since DeployOpen engagements are agreed in writing before work starts. The step is done when every line has a labor source and a one-time or recurring flag, and when you have noted which lines are sized from your own team's capacity rather than a vendor figure.
Decide the support tier and release line
Choose between running midPoint without a subscription and buying an Evolveum Product Support subscription, which covers product bugs with an 8x5 next-business-day or 24x7 SLA, or a Platform Subscription, which also adds feature development and roadmap influence. Ask Evolveum for current prices, since its support page lists none. Also choose the release line. midPoint 4.8 (Curie) is a long-term support release supported until October 17, 2028, while 4.10 (Braille) is supported until November 26, 2027. A longer-supported line can reduce how often you must run upgrade projects, but confirm the current support dates on the releases page before you commit. The step is done when the support tier and release line appear as separate recurring or one-time items.
Total one-time and annual costs over the planned horizon
Place the Saviynt module lines, the midPoint component and labor lines, the support fee, hosting, and separate PAM or application access tooling into one model with two totals: one-time costs (migration, connector build, design, testing) and annual recurring costs (licenses or subscriptions, hosting, staff time, backups, upgrades). Finance and the identity program owner review the model together. Run it over the number of years your contract or budget cycle covers, and show the cumulative totals year by year. The step is done when the model is reviewed, every assumption is labeled, and you can explain which inputs would change the result most.

Costs teams forget on each side

Licence lines are only part of the comparison. The costs below tend to appear late, after a contract is signed or a pilot is underway, and they sit on both the Saviynt side and the midPoint side. Check each one against your own scope before comparing totals.

Professional services for configuration

Saviynt's cloud platform still needs its governance model built: entitlement catalogues, certification campaigns, workflows and connector setup. Ask whether the quote includes this work, who performs it, and whether it is fixed-scope or billed by time. Internal staff time to review and sign off the configuration is a separate cost that often goes uncounted.

Fees for modules found during scoping

Saviynt sells governance, privileged access and application access governance as distinct functional areas. Requirements that surface during scoping, such as privileged session control or application governance for a line-of-business system, may fall outside the first order. Ask the vendor to map each requirement to a named module and a written price before the contract is signed.

Export and exit effort

Leaving any identity governance platform means extracting identities, entitlements, role definitions and certification history in a usable format. Ask how Saviynt exports this data, in what formats, and whether historical campaign records remain accessible after termination. Budget time for reconciling exports against the target system before any cutover.

Custom ConnId connector development

midPoint reaches systems through ConnId connectors. Documented connectors include LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID and SCIM2, but some line-of-business or legacy applications have no documented connector. Each custom connector is Java code that your team or a partner must write, test, document and maintain across application upgrades.

Java and PostgreSQL maintenance

midPoint recommends Java 25 for version 4.11 and later and Java 21 for 4.10 and older, and uses PostgreSQL as its native repository, ideally on a separate server. Operating system, Java runtime and PostgreSQL patches, plus the midPoint upgrades that follow each release line, are recurring work. Confirm the release you plan to run and the support window that applies to it.

Monitoring, backup and recovery testing

A self-hosted midPoint deployment needs monitoring of nodes, the shared database and scheduled tasks, plus backups that are restored and tested on a schedule. Multi-node deployments add a sticky load balancer and Quartz task scheduling to watch. Disaster recovery testing is easy to defer and expensive to skip, so put its frequency and owner into the run budget from the start.

Audit evidence collection

Certifications, provisioning logs and access review records must be retained and presented to auditors in a consistent form. With a self-hosted platform, your team owns the log pipeline, retention settings and evidence exports that a SaaS vendor may have provided in part. Agree early with your assessor which evidence is needed and who produces it each cycle.

How the bill changes by scope: full IGA, governance only, or with PAM

When the Saviynt scope you are replacing is identity governance and administration, midPoint covers much of the functional ground. Evolveum lists provisioning and deprovisioning, identity lifecycle, role-based access control, auditing, self-service access requests, password reset and role mining as core capabilities. In a governance-only move, the cost picture shifts from a recurring Saviynt subscription to midPoint's zero license fee, with the remaining spend concentrated in people, hosting and connector work.

Subscription removed: The Saviynt fees for the governance modules go away, but you still pay for the migration project, which is typically the largest one-time cost.
Support is optional: midPoint has no license fee. Evolveum's Product Support subscriptions, with 8x5 next-business-day or 24x7 SLA options, are an add-on you can choose or skip.
Hosting moves to you: You pay for virtual machines or containers, a PostgreSQL database, and, for multi-node setups, a load balancer and shared database.
Connector work recurs: Connectors for your target systems come from the ConnId catalog or must be built, and each one needs maintenance when target systems change.
Staff time: Your team or a services partner owns configuration, upgrades and certification workflows.

Confirm with your own inventory that every governance module in your current Saviynt contract maps to a midPoint capability before you model the savings.

What support and upgrades cost when midPoint runs in-house

The recurring cost that matters most after licensing is the choice of vendor support. Evolveum sells two kinds of subscription. Product Support covers resolution of product bugs and is offered with either an 8x5 next-business-day SLA or a 24x7 SLA, so the first decision is how quickly a production defect must be answered. Platform Subscriptions add feature development and roadmap influence, which buys direction as well as fixes. Evolveum's support subscriptions page lists no prices, so you must obtain a written quote for each tier. Ask which environments are covered, how many named contacts may open tickets, and whether the subscription includes upgrade assistance. Compare that quote with the internal cost of an on-call rota and the time your engineers would need to diagnose a fault in midPoint's Java code.

Upgrade cadence is the second recurring cost, and the release dates set its shape. midPoint 4.8 (Curie) is a long-term support release supported until October 17, 2028, while 4.10 (Braille) is supported until November 26, 2027. midPoint 4.9 support ends October 18, 2026, three days before 4.11 (Čapek) is planned for October 21, 2026. A deployment still on 4.9 therefore faces an upgrade decision almost at once, and one on 4.10 faces a fixed deadline in late 2027. Confirm the current line on the midPoint releases page, then ask Evolveum whether your subscription covers patches on a long-term support branch. Staying on the long-term support line reduces how often production changes, which lowers the regression testing your team carries each year.

The Java runtime adds a third line item. midPoint recommends Java 25 for version 4.11 and later, with Java 21 supported, and Java 21 for 4.10 and older, with Java 17 supported. A move to 4.11 may therefore require a JDK change on every midPoint node, along with retesting of any connector or custom code built against the older runtime. Confirm which Java versions your chosen midPoint line supports before you commit to a platform, and treat the runtime change as its own work item in the plan. Scope each upgrade in writing before the release window opens, covering test environments, connector regression testing and a rollback plan. DeployOpen offers upgrades as fixed-scope work or as retainers, and the price follows from the written scope.

Questions buyers ask about midPoint cost and effort

Is midPoint free to use, and what does Evolveum charge for?

midPoint has no license fees. Its repository is licensed under the European Union Public License (EUPL-1.2) with Apache 2.0 as a secondary license, and Evolveum states that it has no enterprise edition, so every line of code is open source. Evolveum funds development through subscriptions, training and professional services. What you pay for is what you choose to buy: a Product Support subscription for resolving product bugs, a Platform Subscription that adds feature development and roadmap influence, consulting, and training. Evolveum's support subscriptions page lists no prices, so ask for a quote against your scope and SLA needs. Your own costs remain: infrastructure, database, connector development, migration and staff time.

What drives the internal effort to run midPoint day to day?

Effort is driven by the number and type of systems you connect, the complexity of your role model, the number of identities, and how often you change policies. Each source and target system needs a connector from the ConnId framework, and each connector must be maintained as target systems change. Operations include patching midPoint, the Java runtime and PostgreSQL, monitoring a multi-node deployment (which uses a sticky HTTP load balancer, a shared database and Quartz for task scheduling), backups, and access certification cycles. Evolveum's system requirements list Java 25 for 4.11 and later, and Java 21 for 4.10 and older, so plan for runtime upgrades as part of the release cycle.

How long does a migration from Saviynt to midPoint take?

The duration depends on scope, so it must be agreed in writing before work starts. The main variables are the number of systems to connect, how many connectors must be built or customized, the volume and quality of identity and entitlement data, how much certification history you need to carry over, and whether privileged access or application access governance functions must be replaced by other tools in parallel. A fixed-scope engagement sets deliverables and timelines in writing. Ask any implementation partner to break the timeline into discovery, connector work, parallel running, cutover and evidence handover, and to state which assumptions the schedule depends on.

Can our own team do the migration without outside help?

Yes, it is possible for a team with strong identity and Java skills, but it is a larger project than a configuration exercise. midPoint is a full identity management system with its own object model, policies and task engine, and it requires knowledge of your directories and applications. Teams that choose to work alone should budget time for learning the platform, for building connectors and for testing against production-like data before cutover. Evolveum's training and professional services are an option if you want structured enablement. Whatever path you choose, confirm the approach with your auditors early, because the evidence trail must stay continuous.

What skills and staffing does a self-hosted midPoint need?

You need people who can operate Linux, PostgreSQL, Java-based services and load balancers, and people who understand identity concepts such as provisioning, roles, entitlements and certifications. Connector development requires Java and familiarity with the target system's protocol, such as LDAP, Active Directory or a REST API. Plan for named owners across platform operations, identity engineering and business approvers for access reviews. Staffing needs depend on the number of connected systems and whether you run separate environments for development, testing and production. Confirm the role split with your team before committing to a delivery model.

Do we need a midPoint support subscription to run it in production?

No. midPoint is open source and can be run without a subscription, so a support contract is an optional cost. Evolveum's Product Support subscriptions cover resolving product bugs, with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions add feature development and roadmap influence. Whether you need one depends on your risk tolerance, the availability you require, and whether your team can diagnose and patch issues internally. Compare the subscription cost against the staff time and downtime risk of handling bugs yourself, and ask Evolveum to confirm the current terms for the release you plan to run.

How DeployOpen scopes a fixed-price midPoint cost model and implementation

DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, so a Saviynt cost comparison can be tied to a concrete midPoint design. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we scope

Inventory the current Saviynt modules, licensed identity counts and connected systems to define what midPoint must replace.
Separate governance functions that midPoint covers from privileged access and application access work that needs other tools.
Document hosting, database, connector and support assumptions so the written scope can be quoted line by line.

How we build

Deploy midPoint in the client's cloud account, data center or air-gapped network on the chosen Java and PostgreSQL versions.
Build or adapt ConnId connectors for each in-scope source and target system, and test provisioning and deprovisioning paths.
Configure roles, certification campaigns and audit logging, then test them against representative data before go-live.

How we hand over

Deliver architecture, connector, configuration and runbook documentation tied to the agreed deliverables.
Run knowledge transfer with the client's identity, platform and security staff on daily operations and change handling.
Provide evidence of controls and configuration for the client's auditors, noting that DeployOpen prepares evidence but does not issue audit reports.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer after handover, scoped separately from the build.
Plan upgrades around midPoint release support dates so the client chooses a long-term or feature release deliberately.
Confirm with Evolveum which support subscription level fits the client's operating model, since DeployOpen is not an Evolveum partner.