When the free authentik edition is enough and when Enterprise is needed
A team deciding whether to run authentik on the free edition should start from the protocols it needs, not from the edition names. The free Open Source edition already covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy providers, includes web-based RDP and SSH access, and is OpenID Certified for OpenID Connect. It is a reasonable fit for a team that connects its own applications through OIDC or SAML, protects internal web apps through proxy providers, and keeps user records in authentik or in a directory it can reach over LDAP. The trade-off is support: the free edition has community Discord help and no vendor support, so the team must be comfortable owning upgrades, incidents and troubleshooting, or must buy that work separately.
Enterprise becomes necessary when a specific requirement is on the list. The features that the pricing page reserves for Enterprise include Microsoft Entra ID and Google Workspace integrations, mTLS client certificate authentication, privileged access management, enhanced audit logging, password history checks and scheduled user offboarding. A reasonable check is to write down whether your identity source is Entra ID or Google Workspace, whether any application requires client certificates, and whether your audit or offboarding controls depend on these features. If none of these apply, the free edition may be enough. If one applies, the Enterprise license covers the whole deployment, so the decision is about the full set of users, not one feature.
Before committing, ask the vendor to confirm which features your version and license tier include, and whether any feature you rely on is planned for a different tier. Count internal and external users separately, because Enterprise charges per internal user per month and per external user per month, with service accounts at no cost, and the license is bound to one install ID. Also plan for expiry: the enterprise docs describe a warning two weeks before expiry and read-only mode six weeks after expiry or after exceeding user capacity. Sign-in continues in read-only mode, but administrators cannot change most objects, so renewal should sit on an operational calendar. You can review the license terms in the authentik pricing page and confirm the current details in writing before purchase.
Which authentik features are free and which require Enterprise
This table sorts authentik's listed features into the free Open Source edition and the paid Enterprise edition, based on the authentik pricing page. Read each row as the pricing page's position, then confirm the current edition matrix in the documentation before you buy. The main takeaway: the free edition covers core protocols and browser-based remote access, while directory sync, mTLS, PAM and audit features need a subscription.
| Feature | Open source (free) | Enterprise (paid) | Source and what to check |
|---|---|---|---|
| Core protocols | Included: OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy providers | Listed with the free edition; confirm the same set applies | Pricing page. Confirm the edition matrix before purchase. |
| Web RDP and SSH access | Included in the free edition | Listed with the free edition; confirm session limits | Pricing page. Confirm current remote access behavior in the docs. |
| Google Workspace and Entra ID integrations | Not listed as free | Enterprise-only | Pricing page. Confirm which directory objects sync. |
| mTLS client certificate authentication | Not listed as free | Enterprise-only | Pricing page. Confirm certificate chain needs with your PKI team. |
| Privileged access management and agent accounts | Not listed as free | Enterprise-only; service accounts carry no per-user charge | Pricing page. Confirm whether agent accounts count toward user capacity. |
| Chrome Enterprise Device Trust connector | Not listed as free | Enterprise-only | Pricing page. Confirm Chrome Enterprise prerequisites. |
| Password history checks and enhanced audit logging | Not listed as free | Enterprise-only | Pricing page. Confirm log retention and export options. |
| Scheduled user offboarding and Windows local device login | Not listed as free | Enterprise-only | Pricing page. Confirm supported Windows client versions. |
| RADIUS EAP-TLS | RADIUS provider included; EAP-TLS not listed as free | Enterprise feature | Pricing page. Confirm which EAP methods the free RADIUS provider supports. |
What the free edition already covers for SSO and remote access
The free Open Source edition covers most SSO and remote access needs that a team starts with: OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy providers are all listed on the authentik pricing page, which also says the edition is OpenID Certified for OpenID Connect, includes web-based RDP and SSH access, and covers both B2B and B2C use cases. In practice, a customer-facing application that signs users in over OIDC, an internal SaaS tool that accepts SAML, or a legacy web app placed behind the proxy provider can all run on the free edition. The question to settle first is which protocol each application actually needs, and whether the free edition's provider list meets it.
The paid features matter mainly when the environment depends on specific integrations or controls. Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication and privileged access management are Enterprise-only according to the pricing page, so a team that needs directory sync from Entra ID or certificate-based login should check those requirements before assuming the free edition is enough. Confirm your exact provider mix against the current authentik pricing page, since the feature split is what determines whether Enterprise is needed at all.
The free edition's support model is the main limit to plan for. The pricing page describes community Discord help with no support, and the pricing FAQ says paid support is only offered with an Enterprise subscription. For an identity provider that signs in every user, a team should decide in advance who answers an outage at night and whether that gap is acceptable. Ask the vendor for the current support terms in writing, and write an internal runbook for authentication failures before go-live, whichever edition is chosen.
What Enterprise adds that regulated teams often ask for
The Enterprise features below are the ones regulated teams most often raise when comparing authentik open source with a paid subscription. Each one solves an operational problem, but each matters only under specific conditions, so confirm the need against your own directory, certificate and audit requirements before budgeting for a license.
Entra ID and Google Workspace sync
Enterprise adds Microsoft Entra ID and Google Workspace integrations, which keep users and groups in authentik aligned with the directory your organization already runs. Without them, teams running a free edition typically maintain user lifecycle through LDAP, SCIM or manual steps, which adds work when staff join, move or leave. This matters most when Entra ID or Google Workspace is the authoritative source for identities. Check whether your team can meet its joiner and leaver process with the free protocols alone, and confirm the exact sync behavior with authentik before assuming parity.
mTLS client certificate authentication
Enterprise adds mutual TLS client certificate authentication, so a service or user must present a valid certificate in addition to or instead of a password or token. This matters when your policy requires device or workload identity at the connection layer, or when applications already trust an internal certificate authority. Confirm which certificate authority you will trust, how revocation is handled, and whether your reverse proxy passes the client certificate through to authentik.
Privileged access management
Enterprise includes privileged access management features, aimed at controlling and recording administrative sessions to sensitive systems. This matters when administrators reach servers, databases or network devices through web-based RDP or SSH access and you need approval, session control or accountability beyond the free remote access features. Define which systems fall under privileged access, who approves sessions and where recordings are retained before comparing editions, because the free edition's remote access may already cover some of these needs.
Enhanced audit logging
Enhanced audit logging is an Enterprise feature that records more detail about administrative and authentication events than the free edition. This matters when an internal audit, incident investigation or assessor asks who changed a policy, granted access or signed in, and when. Before relying on it, confirm which events are captured, where logs are stored, how long your organization must keep them, and how they reach your SIEM. Logging detail is a control input for your own program, not evidence of compliance on its own.
Scheduled user offboarding
Scheduled user offboarding lets administrators set a date on which an account is disabled or removed, so access ends on a planned schedule instead of depending on a manual ticket. This matters for contractors, fixed-term staff and external partners whose access should expire automatically. Confirm whether your offboarding process also needs to revoke sessions, remove group memberships in connected applications and update downstream systems, because a scheduled disable in authentik does not by itself change every application's own accounts.
Password history checks
Password history checks prevent users from reusing recently set passwords, a control that many internal password standards describe in their own terms. This matters when your organization uses password-based sign-in for workforce accounts and must enforce a reuse rule in the identity provider. If you adopt passwordless methods, multi-factor authentication or a shorter reliance on passwords, the value of this check shrinks. Confirm how many previous passwords are retained, where the history is stored and how it interacts with your directory policy.
What authentik Enterprise costs per user and what is extra
This table separates the cost components of authentik Open Source from those of Enterprise and Enterprise Plus, so you can see who is paid for what and which charges recur. Use it to build the questions you put to Authentik Security or a partner before you sign, especially how internal and external users are counted.
| Cost component | What it covers and who is paid | One-time or recurring, and what drives it |
|---|---|---|
| Open Source edition | Free to license under MIT for the core. Support comes only from the community Discord, so any paid help is bought separately. | No license charge. Your own hosting, upgrades and staff time are recurring costs regardless of edition. |
| Enterprise, internal users | Billed at 5 US dollars per internal user per month, billed annually, per the authentik pricing page. Unlocks Entra ID and Google Workspace integrations, PAM and mTLS. | Recurring annually. Driven up by every staff member or employee account that counts as an internal user. |
| Enterprise, external users | Billed at 0.02 US dollars per external user per month, per the authentik pricing page. External users are typically customers or partners who cannot access the admin dashboard. | Recurring annually. Driven up by customer-facing volume, so B2C or partner growth can dominate the bill. |
| Service accounts | No charge for service accounts, per the authentik pricing page. Confirm that automation, bots and agent accounts are classified the same way in your quote. | No recurring charge. Misclassifying human accounts as service accounts is a compliance risk, so keep the distinction documented. |
| Enterprise Plus | Starts at 20,000 US dollars a year, per the authentik pricing page. Adds invoice billing, dedicated support with SLAs, volume discounts, multi-instance support and FIPS compliance for FedRAMP requirements. | Recurring annually. Relevant when you need invoicing, contractual SLAs or FIPS-validated operation, not for basic Enterprise features. |
| Ticket support | Ticket support starts with Enterprise subscriptions over 1,000 US dollars, per the authentik pricing FAQ. Paid support exists only with an enterprise subscription. | Included in the subscription threshold. Ask whether the response targets are written into the contract or only described. |
| Implementation and operations | Not priced on the authentik pricing page. Covers installation, PostgreSQL sizing, upgrades and staff time, and may be quoted by a services firm such as DeployOpen against a written scope. | Mostly one-time for setup, then recurring for upgrades and monitoring. Driven by integration count and upgrade cadence. |
| Questions for a written quote | Ask how internal and external users are counted, how active users are measured, whether a usage record is needed for read-only avoidance, and what is included in each edition. | Quotes should state the license term, renewal terms, price changes at renewal and what happens to the subscription if user counts fall. |
Which edition fits internal IT, customer-facing apps and regulated environments
Internal IT teams usually care most about directory sync and access to corporate applications. The free edition already covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy providers, so a team that only needs single sign-on for self-built or open-source apps may not need a paid tier. The paid question starts when the source of truth for staff is Microsoft Entra ID or Google Workspace.
- Entra ID or Google Workspace sync: These integrations are Enterprise-only. If HR-driven joiner and leaver flows already live in one of these directories, the paid edition removes a custom sync job.
- Scheduled offboarding: Scheduled user offboarding is listed as Enterprise. It matters when access removal must follow a fixed schedule without manual steps.
- Privileged access management: PAM matters if administrators need to reach servers or databases through the identity provider with session control. Confirm whether your remote access needs fall within the free web-based RDP and SSH access.
- Per-user cost: Enterprise is billed at 5 US dollars per internal user per month, billed annually, so cost scales with headcount, not with applications.
- Windows local device login: Relevant only if Windows endpoints must sign in against authentik.
Confirm with the vendor which Entra ID or Google Workspace capabilities the Enterprise tier covers in your tenant configuration before you assume a fit.
Customer and partner identity behaves differently from workforce identity. Authentik prices external users separately, at 0.02 US dollars per external user per month, and external users cannot access the application dashboard. That split is why B2B and B2C products often model their customers as external users rather than internal ones.
- Separate counting: Active internal and external users are counted separately, so a large customer base does not multiply the internal rate.
- Service accounts: Service accounts carry no cost, which suits machine-to-machine integrations.
- Free protocols for apps: OIDC, SAML and proxy providers are in the free edition, so a customer-facing app can often use them without a paid license. Confirm the exact external user count your product will reach.
- mTLS for partner APIs: Client certificate authentication is Enterprise-only and matters when partners authenticate with certificates rather than passwords.
- Ticket support: Ticket-based support starts with subscriptions above 1,000 US dollars, so a customer-facing product should weigh support needs against the free community channel.
Ask the vendor for a worked estimate using your projected internal and external active user counts, and confirm how the license counts users during peaks.
Regulated and air-gapped environments often push the decision toward the Enterprise tiers because the controls auditors ask about map to paid features. Enterprise licenses are bound to one install ID and are validated locally without internet access, which is relevant for networks that cannot reach a license server. Enterprise Plus adds the FIPS compliance option for FedRAMP requirements, and it is the tier to evaluate when federal alignment is required.
- mTLS client certificates: Useful where policy requires certificate-based authentication for users or systems. Confirm which certificate authority and revocation model your policy requires.
- Enhanced audit logging: Enterprise-only. It matters when an examiner or assessor needs detailed records of administrative changes. Ask how logs are retained and exported in your environment.
- Password history checks: Enterprise-only. Relevant where password reuse rules appear in your internal standards.
- FIPS compliance: Listed under Enterprise Plus, for FedRAMP requirements. Confirm with the vendor whether the specific build and configuration you deploy meet your required FIPS scope.
- License expiry: Administrators are warned two weeks before expiry. After six weeks the deployment enters read-only mode, so renewal must be in the operating calendar.
DeployOpen can prepare the controls and evidence for an assessment, but the assessor or certification body issues any opinion, and the vendor must confirm which features your assessment relies on.
How to move from the free edition to Enterprise and back
The sequence confirms which Enterprise features you need, licenses a single install, checks internal and external user counts, and sets up the integrations before anything depends on them. It also shows what you keep, and what you may lose, if the subscription lapses.
Confirm which Enterprise features you need
Before buying anything, list the capabilities your deployment depends on and check each one against the pricing page's Enterprise list and the free Open Source list. Typical Enterprise-only items include Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history checks and enhanced audit logging. Your identity team or DeployOpen's scoping work owns this list. It is done when every requirement is marked as either covered by the free edition or requiring Enterprise, and you have asked the vendor to confirm any item you are unsure about.
Obtain an Enterprise subscription
Your organization buys the subscription directly from authentik, and the price follows the per-user model on the pricing page: a per-internal-user monthly rate and a smaller per-external-user rate, billed annually, with service accounts at no charge. Ask the vendor for a written quote that states the internal and external user counts it is based on, how the billing period renews and what support tier is included. Ticket support for subscriptions over the stated threshold is an Enterprise feature, so confirm whether your tier includes it. This step is done when you hold a signed order or quote that matches your scope.
Install the license bound to one install ID
Each Enterprise license is tied to a single install ID, so the license must be issued for the exact deployment that will run it. Your administrator records that install ID from the running instance, sends it to the vendor for the license file and installs the file through the admin interface. Keep a record of the install ID in your change log, because a rebuilt or cloned deployment will have a different one. The step is done when the instance shows the license as active and the install ID matches the one on the license.
Check user counts against the license
authentik counts active internal and external users separately, and the license is validated locally without internet access. Pull current counts from the admin interface, compare internal users against the internal allowance and external users against the external allowance, and include any growth you expect over the license term. Note that a deployment that exceeds its user capacity without a recent valid usage record is placed in read-only mode after a grace period, so headroom matters. The check is complete when both counts sit inside the license and you have documented the monitoring you will use to catch growth early.
Plan configuration of Enterprise integrations
Write a configuration plan for each Enterprise integration you enabled, covering the Google Workspace or Microsoft Entra ID connection, the mTLS trust chain, privileged access rules and the audit log destination. For each item, record the owner, the source system credentials or certificate authority involved and the test users who will validate it. If you have an external implementer, agree the scope in writing before work starts. The step is done when the plan is approved and every integration has a named test that proves it works in a non-production instance.
Configure and test Enterprise integrations
Apply the plan in a staging instance first, then in production during a window your change process approves. Run each test user through sign-in, provisioning and access checks, and confirm that audit events appear where your monitoring expects them. Record the results against each item in the plan. This step is done when every integration passes its test in production and the results are filed with the change record.
Plan the downgrade path before relying on features
Decide in advance what happens if the subscription lapses or is not renewed. According to the authentik enterprise documentation, a deployment enters read-only mode six weeks after its license expires: users can still sign in to applications, but administrators cannot change most objects until a valid license is installed or users are reduced. Enterprise features may also stop working, so ask the vendor in writing which ones would be lost, whether any configuration survives and how to return to the free edition if you choose to leave. Record the answers and the renewal date, and set reminders well ahead of expiry, since administrators are warned two weeks before it. The step is done when the downgrade and renewal decisions are documented and approved by the owner of the identity platform.
What happens when an authentik Enterprise license expires
A self-hosted authentik Enterprise license is bound to one install ID and validated locally, so the deployment does not need internet access to keep working. The documented sequence matters for planning: administrators are warned two weeks before expiry, and six weeks after expiry, or after user capacity is exceeded without a recent valid usage record, the deployment enters read-only mode. Your identity team should treat the warning window as the start of the renewal process, not as a reminder to look at the invoice later. Confirm with authentik how the install ID is tied to your environment before you clone, rebuild or move the server, since a changed install ID is an easy way to lose a valid license by accident.
In read-only mode, users can still sign in to applications, so single sign-on keeps working for the business. Administrators, however, cannot change most objects, which blocks the work that keeps an identity platform healthy: creating or disabling accounts, rotating provider settings, adjusting policies, and responding to an offboarding request. The practical risk is therefore operational rather than an outage in login itself. Ask whether any of your Enterprise-only features, such as Google Workspace or Microsoft Entra ID sync or privileged access management, are part of a process that must run on schedule, because those processes depend on administrative write access.
Because capacity is counted separately for internal and external users, plan renewal and capacity monitoring together. Track active internal and external user counts against the license terms, and review the usage record regularly so a growing customer or partner population does not quietly trigger the same restriction. Put the renewal date, the warning date and the read-only threshold on a shared calendar with the people who own finance and access reviews. Before you sign, ask authentik or your reseller to confirm the current terms in writing, including how capacity is measured and what happens during a late renewal, using the authentik Enterprise account documentation as the baseline.
Questions buyers ask before paying for authentik Enterprise
Is the free authentik Open Source edition production-ready?
The free edition can run in production, but it comes without vendor support. The authentik pricing page lists OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy providers in the Open Source edition, along with web-based RDP and SSH access and B2B and B2C use cases, with help available through the community Discord and no support. Whether that is enough depends on your own operating capacity: who patches the server and worker containers, who monitors PostgreSQL, and who answers when a login flow breaks. Check the authentik security policy for which release lines receive security fixes, and plan your upgrade cadence against it.
How much does authentik Enterprise cost per internal and external user?
Per the authentik pricing page, Enterprise costs 5 US dollars per internal user per month and 0.02 US dollars per external user per month, billed annually, with no charge for service accounts. External users, typically customers or partners, cannot access the application dashboard. Your monthly total therefore depends on two counts: active internal staff and active external accounts, which the license counts separately. Ask the vendor how inactive accounts are counted, whether any minimum applies, and how a mid-term increase in users is billed. Ask for the figures in writing, because the pricing page is the only source for these rates.
What does ticket support require from an authentik subscription?
Paid support is only offered with an Enterprise subscription, and ticket support starts with Enterprise subscriptions over 1,000 US dollars, according to the authentik pricing FAQ. Dedicated support with SLAs, multi-instance deployment support and FIPS compliance for FedRAMP requirements are listed under Enterprise Plus, which starts at 20,000 US dollars a year on the pricing page. Ask the vendor which response times, channels and escalation paths apply to your subscription tier, and whether they are written into the contract. Do not assume an SLA exists unless it appears in your order form.
How long does a move to authentik Enterprise take?
No fact supplied for this page gives a duration, so treat any timeline as something to request in writing rather than assume. Activating a license is a short step: the license is bound to one install ID and validated locally without internet access. The effort lies elsewhere. It rises with the number of Entra ID or Google Workspace integrations you enable, the size of the user base, the number of applications that need mTLS or privileged access management, and how much PostgreSQL sizing you need to check, since authentik stores its configuration, sessions and tasks in PostgreSQL. A fixed-scope written plan from DeployOpen or another provider should list these items separately.
What does an authentik Enterprise rollout need from our team?
At minimum, you need someone who owns the identity provider day to day, someone who can operate PostgreSQL, and someone who manages the integrations you enable. The team needs to understand the server and worker container split, the embedded outpost, and how Enterprise features such as Entra ID or Google Workspace sync and mTLS change your flows. You also need to decide who holds administrator rights during the license period. Work out these roles before you buy, because they determine whether the rollout is handled in-house or through a fixed-scope engagement.
What happens if the authentik Enterprise license expires?
According to the authentik enterprise docs, administrators are warned two weeks before expiry. Six weeks after expiry, or after user capacity is exceeded without a recent valid usage record, the deployment enters read-only mode. Users can still sign in to applications, but administrators cannot change most objects until a valid license is installed or the user count is reduced. Plan renewals in your change calendar, and confirm with the vendor how capacity is measured during growth so a hiring wave does not put you into read-only mode.
Can our own team upgrade authentik, or do we need outside help?
Your team can upgrade authentik if it has the operating skill and a tested rollback plan. The project names releases by year and month, and the GitHub releases page shows 2026.8.4 as the latest release, published on October 14, 2026. Older 2026.5 and 2026.2 lines still received patches on September 9, 2026, so you choose the line you run. Since the 2025.10 release, authentik no longer uses Redis, and the release notes warn of roughly 50% more PostgreSQL connections after upgrading, so test connection limits before rollout. If you lack that capacity, DeployOpen offers upgrades and ongoing support as retainers, scoped in writing.
Which Enterprise features do we actually need before paying?
Start from the requirement, not the edition. The Enterprise-only features on the pricing page include Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history checks, enhanced audit logging, scheduled user offboarding, and RADIUS EAP-TLS. If your apps are protected by OIDC, SAML or proxy providers and your directory is self-managed, the free edition may cover the need. If you must sync from Entra ID, meet an audit logging requirement, or require mTLS, the paid tier is the relevant line item. Confirm each feature against your own environment before signing.
Where to verify authentik edition terms before you buy
Start with the authentik pricing page, which sets out the three editions, the per-user rates for internal and external users, the Enterprise feature list and the Enterprise Plus extras. Use it to confirm what you would pay and which controls sit behind the paywall, such as Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication and privileged access management. Ask the vendor to put the current rates, billing period and the definition of an internal versus external user in writing, because those definitions decide your invoice. Pricing: authentik pricing
Read the authentik Enterprise account documentation next. It explains that a license is bound to one install ID, that active internal and external users are counted separately, that validation happens locally without internet access, and that administrators receive a warning two weeks before expiry. It also describes the read-only mode that starts six weeks after expiry or after capacity is exceeded. Test this path in a non-production install before you rely on it, and confirm with the vendor how a license is renewed or moved if you rebuild the server, since that changes the install ID. Account documentation: Manage your Enterprise account
Open the LICENSE file in the repository to confirm where the license split falls. Core code is MIT, while the code under authentik/enterprise carries the separate enterprise license, so a legal review should map which directories your deployment actually uses. Then check the security policy for the release lines that receive security fixes and the advance notice given for security releases. Schedule upgrades against those lines, and re-check all of these sources on the day you buy, because vendor terms, rates and support windows can change without notice.
How DeployOpen scopes authentik deployments on either edition
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For authentik, we start by confirming which edition your requirements actually need, then agree the scope in writing before any work begins.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We confirm which protocols, user populations and remote access needs apply, and whether Enterprise-only features are required.
- We record the internal and external user counts and the license tier the written scope depends on, so the quote follows from them.
How we build
- We deploy authentik in your environment with its server, worker and PostgreSQL components, sized to the scope agreed.
- We configure providers, flows and outposts for your applications, and test sign-in paths for each protocol in the scope.
- If Enterprise is in scope, we install and validate the license against your install ID and verify the admin and user behavior it enables.
How we hand over
- We document the deployed architecture, configuration, upgrade steps and the license renewal and capacity procedures agreed in scope.
- We deliver runbooks for backup, restore and upgrades, so your team can operate authentik without relying on us day to day.
- We provide evidence of configuration and testing that your internal team or independent auditors can review for compliance readiness.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers, scoped separately from the initial build.
- Retainers can cover tracking authentik release lines and planning upgrades before a supported version reaches end of support.
- Ask for a quote that states which edition, user counts and renewal responsibilities sit inside the retainer and which stay with your team.
