Mattermost Team Edition vs Entry: which build should your team self-host?
A team replacing Slack with a self-hosted platform has to pick a Mattermost build before it installs anything, and the two free options differ in ways that matter later. Team Edition is free but has no SSO, and Mattermost's own docs say it is not recommended for government or sensitive commercial workloads. Entry is free but caps message history at 10,000 channel messages across all channels, and it omits compliance features, delegated admin roles and high availability, with community support only. Neither free build is a fit for a regulated organization, so the decision mostly turns on team size and sensitivity. For a small, non-sensitive team, Team Edition is the simplest free route: a single Linux binary on PostgreSQL under the MIT license, with the SSO gap acceptable only if logins can be managed locally. Entry suits teams of fewer than 50 users that want the Enterprise Edition feature set without paying, provided the history cap is acceptable. Check the cap against your retention expectations before you go live, because older messages beyond it are not kept in the way a team might assume. If you expect the team to grow past 50 users, plan for a paid plan from the start rather than migrating later. Teams that need SSO, compliance exports, high availability or air-gapped operation are outside both free builds. Professional covers SSO and AD/LDAP user sync for teams of up to 250 users, while Enterprise adds eDiscovery, compliance export and high availability, and Enterprise Advanced adds air-gapped workflows. Pricing is not published, so ask Mattermost sales for a quote covering seat count, guest usage and support tier, and confirm which build your identity provider and compliance team require before deployment.
Which Mattermost features sit behind each edition
This table maps the documented feature split across Team Edition, Entry and the paid plans, with the paid column covering Professional, Enterprise and Enterprise Advanced. Where the docs or pricing page do not state a feature for a build or plan, the cell says so and names what to confirm. Use it to find the lowest build that covers your hard requirements, then check the open items in writing before you commit.
| Capability | Team Edition (MIT) | Entry (free mode) | Paid plans |
|---|---|---|---|
| SSO and AD/LDAP sync | SSO is being removed under a 2025 change. No AD/LDAP sync documented. | Confirm SSO and sync availability in Entry with Mattermost before relying on it. | SAML, OIDC and OAuth SSO and AD/LDAP user sync from Professional. |
| Message history | Not documented as capped. Confirm for your build. | Limited to 10,000 channel messages across all channels. | No cap listed in the documented split. Confirm in the subscription terms. |
| Compliance export and eDiscovery | Not included. | Omitted. | Enterprise and Enterprise Advanced. Not listed for Professional. |
| Custom retention policies | Not included. | Omitted. | Enterprise and Enterprise Advanced. |
| High availability and horizontal scaling | Not included. Runs as a single Linux binary. | Omitted. | Enterprise and Enterprise Advanced. Needs shared file storage on S3, S3-compatible or NAS. |
| FIPS 140-3 compliance | Not documented. Confirm if your assessor requires it. | Not documented. Confirm with Mattermost. | Enterprise and Enterprise Advanced, per the pricing page. |
| Guest access | Confirm for your build. | Confirm for your build. | Included from Professional. Single-channel guests are free up to a 1:1 ratio with seats. |
| Air-gapped deployment | Not positioned for sensitive or government workloads. | Confirm with Mattermost. | Enterprise Advanced only. |
| Support level | No vendor support documented. Confirm before production use. | Community support only. | Next business day support from Professional. Confirm tier for Enterprise plans on the quote. |
How team size, sensitivity and SSO needs map to a build
For a hobbyist, a personal project or a household group, the MIT-licensed Team Edition is the simplest fit. It ships as a single Linux binary that uses PostgreSQL, and it carries no license key or subscription. Its documented scope is small teams and personal use under 250 activated users where SSO is not required. The build suits people who accept community support and can maintain the server themselves. The choice stops fitting once the group needs a supported build, an identity provider, or a place to store regulated or customer data, because the vendor docs do not recommend Team Edition for government or sensitive commercial workloads.
- Single binary, low setup: One server process and one PostgreSQL database are the whole core footprint.
- No SSO in this build: Logins use local accounts, so directory-based access control is not available here.
- Community support only: Problems are handled through public channels and your own troubleshooting.
- Upgrade ownership: You schedule and test each monthly server release yourself.
- Exit path: Check the export and import options before you store months of history, because moving later costs time.
Before you commit, confirm the current Team Edition scope and SSO status with Mattermost, since the docs state SSO is being removed from this build.
For a small, non-sensitive team of fewer than 50 users, the free Entry mode of Enterprise Edition is often the most practical option. It runs without a key and carries the feature set of Enterprise Advanced, but it caps message history at 10,000 channel messages across all channels. It omits compliance features, delegated admin roles and high availability, and it offers community support only. This makes it a reasonable fit when the team values current features and can accept the cap. It stops fitting when older messages must stay searchable, when auditors ask for exports, or when the team needs an outage-tolerant setup.
- Message cap: Once channels pass 10,000 total messages, older history falls outside the limit, so plan for this early.
- No compliance exports: eDiscovery and compliance export require a paid plan.
- No high availability: One node means a restart or failure stops chat until service returns.
- Community support: Expect to rely on public resources for incidents.
- Identity limits: Without SSO, sign-in and offboarding depend on local account management.
Confirm the message count your channels will reach in the first year, and confirm whether any policy requires retained history.
When the team has between 50 and 250 users and needs single sign-on, the Professional plan is the usual match. It targets teams of up to 250 users and includes AD/LDAP SSO and user sync, SSO with OpenID Connect, SAML, Google or Entra ID, MFA enforcement, guest access and next business day support. Plans are prepaid annual seat subscriptions, and Mattermost does not publish list prices, so the cost depends on the quote. This build fits a single-region team that wants directory-based sign-in without a high availability design. It stops fitting when the team needs clustering, eDiscovery, custom retention or air-gapped operation.
- Directory sign-in: SAML, OIDC and AD/LDAP sync cover most corporate identity setups.
- MFA enforcement: Policy can be enforced at the chat layer.
- Seat-based licensing: Cost scales with licensed seats, and guest rules affect the count.
- Guest counting: Guests in more than one channel count as paid active users, while one-channel guests are free up to a 1:1 ratio with seats.
- No clustering here: High availability is available only from the Enterprise plan.
Ask the vendor to confirm the seat count, how guests will be counted in your channel model, and the support hours for your time zone.
Regulated and government teams that need compliance exports, high availability or air-gapped operation are pointed toward Enterprise or Enterprise Advanced. Enterprise adds eDiscovery and compliance export, custom retention policies, Elasticsearch-based enterprise search, AD/LDAP group sync, connected workspaces, high availability and FIPS 140-3 compliance. Enterprise Advanced adds classified information controls, zero trust attribute-based policies and air-gapped workflows. High availability needs redundant application servers, database servers and load balancers, plus shared file storage on S3, an S3-compatible service or NAS mounted on every node. Local file storage will not work correctly and risks corrupting files.
- Compliance export: eDiscovery and retention are only in the paid tiers.
- Shared storage: Each HA node must mount the same S3-compatible or NAS storage.
- Database replicas: Read and search replicas can scale concurrent users, with writes going to the primary.
- Air-gapped scope: Confirm which update and license workflows work offline in Enterprise Advanced.
- Certification scope: Mattermost reports FIPS 140-3 compliance from Enterprise, but DeployOpen prepares evidence and does not issue certifications.
Before you purchase, ask for a written statement on the features each control depends on, and confirm the release cadence with your change board.
Why Team Edition no longer covers SSO
Mattermost Team Edition is no longer a route to single sign-on. According to the Mattermost editions and offerings docs, SSO is being removed from Team Edition as part of a 2025 change agreed with GitLab, which had bundled Team Edition in the GitLab Omnibus package since 2016. Team Edition remains the MIT-licensed, self-hosted single Linux binary on PostgreSQL, intended for small teams under 250 activated users where SSO is not required. For a team that picked Team Edition because it needed SAML or OpenID Connect login, that original reason no longer holds, and the build should be treated as a decision to revisit rather than a settled choice.
If an existing Team Edition deployment authenticates users through SSO today, the practical risk is a login path that may stop working or may not receive future fixes once the removal takes effect. Start by inventory: list every instance, the authentication method each one uses, the number of activated users, and whether any compliance or audit requirement depends on identity controls. Then compare that list against the plan requirements. Per the Mattermost pricing page, SSO through SAML, OpenID Connect or OAuth and AD/LDAP user sync are included from the Professional plan, so a team that needs them has to move to a paid subscription or an Enterprise Edition build in Entry mode with a license.
Before planning any migration, confirm the current status of SSO in Team Edition, the version in which the removal takes effect, and the supported path for moving existing users and channels to a paid build with Mattermost directly. Ask whether the database and file storage can move without re-onboarding users, and whether a trial or subscription can be applied to the running instance. The Mattermost SAML single sign-on guide describes what the SSO configuration involves once a plan that supports it is in place. Get written answers before scheduling a cutover, because a change to the authentication layer affects every user at once.
What the free Entry mode is missing for enterprise use
Entry is a free mode of Enterprise Edition, and it carries the Enterprise Advanced feature set with several gaps that matter once chat becomes a system of record. Each card below names one gap, the audit or operational consequence, and what to confirm before you commit a team to Entry.
Message history cap across channels
Entry limits message history to 10,000 channel messages across all channels, not per channel. For a busy workspace, older conversations can fall outside what users can search and scroll back to, which affects onboarding, incident reviews and recordkeeping. Check the expected message volume per month and how far back staff need to reach before you accept the cap. Confirm the current behavior of the cap in the Entry documentation for your build.
No compliance features
Entry omits the compliance features that Enterprise adds, including eDiscovery, compliance export and custom retention policies. Without them, you cannot produce a defined export for a legal hold or apply retention rules that match your records policy. If a regulator, auditor or litigation process could ask for chat records, plan for a paid tier before go-live, and ask your compliance lead which export format and retention period they require.
No delegated admin roles
Entry does not include delegated admin roles, so administrative rights stay concentrated in a small set of system administrators. In a regulated organization, that makes separation of duties hard to show: the same people may create channels, change retention and manage users. Map your privileged access requirements to the roles you need, and confirm with Mattermost which capabilities would be delegated under a paid plan before you design access reviews around Entry.
No high availability
High availability is available only on Enterprise and Enterprise Advanced, and it depends on redundant application servers, database servers and load balancers. Entry runs without that redundancy, so a single node or database failure can stop chat for the whole organization. If chat supports incident response or on-call work, define a recovery objective and test whether Entry can meet it before you rely on it for operations.
Community-only support
Entry includes community support only, with no vendor-backed response commitment. When a database migration, upgrade or authentication problem blocks users, your team carries the troubleshooting alone or waits on public forums. Ask whether your internal operations and on-call model can absorb that risk, and compare it with the next business day support that Professional includes.
Documented fit below 50 users
Mattermost describes Entry as best suited to teams of fewer than 50 users. This is a documented fit, not a hard technical block, but it signals that the gaps above were designed around smaller teams. If your headcount is near or above 50, or you expect growth during the chat rollout, the cost of moving from Entry to a paid plan later increases as history, channels and integrations accumulate. Confirm your activated user count and growth plan before choosing Entry.
Cost components for each Mattermost edition
This table breaks the cost of a self-hosted Mattermost deployment into components and shows, for each build, whether the cost is a software fee, infrastructure, storage or staff time. Mattermost publishes no prices for Professional, Enterprise or Enterprise Advanced and directs buyers to sales, so use the recurring and one-time labels to build the quote request rather than to estimate totals.
| Cost component | Team Edition and Entry | Paid plans (Professional, Enterprise, Enterprise Advanced) |
|---|---|---|
| Software fee | None. Team Edition is MIT licensed and Entry is a free mode of Enterprise Edition with no key. | Prepaid annual subscription based on seat licenses. Recurring. Ask sales how seats are counted, including guests. |
| Hosting and compute | Recurring. Your own servers or cloud accounts run one Linux binary with PostgreSQL. | Recurring. Plans that use high availability need redundant application servers, database servers and load balancers, so expect more nodes. |
| Database | Recurring. PostgreSQL is run and backed up by your team or a service you contract. | Recurring. Enterprise plans add read and search replicas to scale users, each adding infrastructure and administration. |
| File storage | Recurring. Local storage is acceptable for a single server. | Recurring for high availability. Shared storage on Amazon S3, an S3-compatible service or NAS mounted on every node is required, and local file storage risks file corruption. |
| Setup and migration | One-time. Install, configure and any import from Slack or another chat tool is internal or contracted work. | One-time plus recurring. SSO, AD/LDAP sync, eDiscovery exports, retention policies and air-gapped setup add configuration and testing effort. |
| Staff time to upgrade and operate | Recurring. Monthly server releases and support windows must be tracked by your team, and Team Edition has no SSO. | Recurring. Monthly releases and extended support releases apply to paid builds too, and high availability adds failover testing and monitoring. |
| Support | Community support only for Entry. Team Edition is community supported. | Recurring within the subscription. Confirm response times and support tier in writing before signing. |
| Outside services | Optional, one-time or recurring. Consultants for hardening, upgrades or compliance evidence are quoted from written scope. | Optional, one-time or recurring. Implementation partners and compliance preparation are quoted separately from the Mattermost subscription. |
How guest accounts and seat counts change the bill
The Mattermost pricing page sets a rule that matters before any seat count is agreed: guests limited to one channel are free up to a 1:1 ratio with licensed seats, while guests in multiple channels count as paid active users. In practice, a team that buys 100 seats can host up to 100 single-channel guests at no extra subscription cost, but a guest added to a second channel moves from the free group to the paid group. Guest sprawl therefore has a direct price effect. Partner organizations, contractors and project members added to several channels for convenience can grow the paid count faster than internal headcount does.
Seat counts also grow with ordinary user growth, and the subscription is sized on licensed seats and paid active users, so both drivers need to be modeled. Ask the vendor to confirm how a deactivated user, a bot account and a guest who leaves a channel are counted, and over what period active users are measured. Ask whether the 1:1 allowance is calculated against the licensed seat total at a point in time or continuously, and what happens when seats are reduced at renewal. Check the current plan terms on the Mattermost pricing page, since public prices are not listed and each quote follows from the stated user counts.
Before requesting a quote, run an illustrative count from your own channel membership export: list every guest, the number of channels each one belongs to, and the projected headcount for the next renewal term. Separate single-channel guests from multi-channel guests and price both scenarios, one where guests are restricted to a single channel and one where current membership continues. The gap between the two numbers shows how much a channel governance policy is worth. Record the answers in the quote so finance can compare renewal years on the same basis.
Moving from Team Edition or Entry to a paid plan, and back
This sequence takes a self-hosted Mattermost deployment from Team Edition or Entry to a licensed paid plan with SSO, shared storage for high availability and a documented route back if the change fails.
Confirm the current build, version and database
The platform engineer records whether the running server is Team Edition or Enterprise Edition in Entry mode, the exact server version, the PostgreSQL version, the number of activated users and every node or proxy in the deployment. Team Edition is a single Linux binary with PostgreSQL under the MIT license, so the build you are moving from determines which upgrade path applies. The step is done when the inventory is written down and a second engineer has checked it against the running servers.
Export or plan around the Entry message cap
Entry limits message history to 10,000 channel messages across all channels, so the team decides what history must stay searchable after the move. The owner of records and compliance exports the channels that matter and confirms what the paid plan will retain. Before any change, take a verified full backup of the database and file storage. The step is done when the export is stored outside the deployment and a restore of the backup has been tested on a separate host.
Obtain a trial or subscription license
Paid features in Enterprise Edition unlock with a trial or subscription key. Mattermost sells Professional, Enterprise and Enterprise Advanced as prepaid annual subscriptions by seat count, and its pricing page lists no public prices, so the purchasing lead requests a quote that names the plan, seat count, guest use and support level. Guests in multiple channels count as paid active users, which can change the seat count. The step is done when the license is issued and the procurement record shows which plan it covers.
Enable SSO and user synchronization
The identity engineer configures the chosen SSO method, such as SAML, OpenID Connect or AD/LDAP user sync, which the pricing page places from the Professional plan. Test with a small pilot group first, and confirm that existing accounts map to the identity provider records without duplicates. Document the attribute mapping and the fallback login for administrators. The step is done when pilot users sign in through the identity provider and the sync job reports the expected user counts.
Provision shared file storage before enabling HA
High availability is available only on Enterprise and Enterprise Advanced and needs redundant application servers, redundant database servers and redundant load balancers. Every node must mount the same shared store, such as Amazon S3, an S3-compatible service or NAS. Local file system storage will not work correctly and risks corrupting files, so move the file store before adding a second node. Confirm the storage and cluster design with Mattermost's high availability documentation. The step is done when all nodes read and write the shared store in a test.
Validate the paid build in a staging copy
Restore the production backup into a staging environment on the target build, apply the license, enable SSO and run the cluster test. The QA lead checks logins, channel history, search, integrations, mobile access and any compliance exports against a written test list. Compare the results with the pre-change inventory. Confirm each upgrade step in the vendor's upgrade documentation before running it in production. The step is done when the test list passes and the open issues have owners.
Cut over and document the rollback path
Schedule the production change with a maintenance window agreed with the business owners. Take a fresh backup immediately before the change, apply the new build and license, then enable SSO and clustering in the order tested in staging. Write a rollback procedure that names the backup to restore, the previous binary or image and the decision point at which the team reverts. Moving back to Team Edition is a downgrade path that needs its own test, because paid-only features may not carry over. The step is done when the rollback has been rehearsed and the runbook is stored with the change record.
Confirm steps against vendor documentation
Changing build and database engine carries migration risk, so every step above should be checked against Mattermost's current upgrade and high availability guides before work starts. Ask the vendor or the implementation partner to confirm supported version paths, the required PostgreSQL version and how the Team Edition license terms apply to the change. Your environment may add constraints for proxies, certificates or air-gapped networks. The step is done when the signed-off checklist cites the vendor documents used.
Questions buyers ask before choosing a Mattermost edition
Is Mattermost Entry enough for a 40-person team?
Entry can work for a team of that size if you do not need SSO, compliance exports, high availability or air-gapped operation, because the documentation describes Entry as best suited to teams of fewer than 50 users. The limits to check are the 10,000 channel message history cap across all channels, the absence of compliance features, delegated admin roles and high availability, and community-only support. If your identity provider policy requires SSO or your legal team needs retained, exportable message history, Entry will not meet that requirement regardless of headcount. Ask the vendor to confirm the current Entry limits in writing before you commit.
What does it cost to move from Team Edition to a paid plan?
The license cost is a prepaid annual subscription priced by seat, but Mattermost does not publish list prices, so the figure comes from a sales quote. Cost has several parts: the subscription itself, the infrastructure needed for the features you buy (for example, shared file storage and a database for high availability), and the internal or partner labor to run the change. Team Edition is MIT-licensed and free, but SSO is being removed from it, so an SSO requirement is the most common reason to move. Ask for the per-seat price, guest pricing under the one-channel guest rule, renewal terms and which features each tier includes.
How long does an edition change take, and what drives that time?
No duration is documented for an edition change, so treat any timeline as something to get in writing from whoever will do the work. The main drivers are the size of the user base, whether you are only changing the license key or also moving to a clustered architecture, and how much identity integration must be built and tested. High availability needs redundant application servers, redundant database servers and redundant load balancers, plus shared file storage on each node, so a clustered move takes far longer than a license upgrade on one server. Ask for a written plan that lists each stage, its owner and the test criteria.
Can our own engineers make the change without outside help?
Yes, if your team already runs PostgreSQL, Linux and an identity provider, and has time to test SSO and file storage carefully. A license-level change on a single binary is simpler than building a high availability cluster, which requires redundant load balancers and database servers as well as shared storage. The risky steps are identity mapping, user sync and migrating file storage, where mistakes can lock users out or corrupt files. Decide early whether you have the skills in house, and if not, scope outside help to specific deliverables in writing.
What does the change need from our identity provider and storage team?
Your identity team must configure the SSO protocol you buy (SAML 2.0, OpenID Connect, or Google or Entra ID, as listed for Professional), set up AD/LDAP user sync if you use it, and agree how roles and group membership map to Mattermost. Your storage team must provide shared file storage on Amazon S3, an S3-compatible service or NAS mounted on every node, because local file system storage will not work correctly in a high availability cluster and risks corrupting files. Both teams should sign off on a test plan before cutover, including account recovery and offboarding.
When is Enterprise Advanced air-gapped operation worth the subscription?
Enterprise Advanced is worth evaluating when you must run chat with no internet access and also need its extra controls, such as classified information controls, zero trust attribute-based policies and air-gapped workflows. Air-gapped deployment is listed only in Enterprise Advanced, so if you need offline operation and do not need the Advanced controls, ask the vendor whether a lower tier meets your requirement. The decision depends on your accreditation or policy obligations, the number of seats and what offline update and license processes cost you to run. Ask for the air-gapped deliverables, update procedure and support terms in the quote.
Does Mattermost change its server version on a predictable schedule?
Yes, Mattermost releases a new server version in binary form on the 16th of each month, and it publishes support windows for each release. For example, v12.0 was released on 2026-10-16 with support ending 2027-01-15, while v11.7 is an Extended Support Release with support ending 2027-05-15. Plan upgrades around the release you choose: a non-ESR line needs more frequent upgrades, while an ESR gives a longer support window. Confirm which release line your paid plan covers before you choose a version to standardize on.
How DeployOpen scopes and supports either Mattermost edition
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure. For Mattermost, that means first agreeing which build and plan fits your user count, identity needs and network model, then delivering the deployment in your cloud account, data center or air-gapped network.
How we scope
- Engagements are fixed-scope, with the edition, user count and identity requirements agreed in writing before work starts.
- The written scope names which Mattermost build runs, whether Team Edition, Entry or a paid plan, and the reasons for that choice.
- Scope records whether you need SSO, compliance exports, high availability or air-gapped operation, since each one changes the plan.
How we build
- Deployment covers the Linux binary or the Kubernetes route, with PostgreSQL configured for your database standards.
- For high availability, file storage on S3, an S3-compatible service or NAS is set up on every node before go-live.
- Integration with your identity provider, retention settings and hardening steps are built and tested against the agreed scope.
How we hand over
- Handover includes documentation of the installed edition, configuration, backup routines and upgrade steps.
- Your team receives a record of the plan entitlements in use, so license checks can be confirmed against the subscription.
- Runbooks cover the monthly server release cycle and the support end dates for each version you run.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover moving between Team Edition, Entry and a paid plan as user counts or compliance needs change.
- Quotes follow from the written scope, so ask for the edition, user count and support tier you need before comparing offers.
