When OpenProject Community is enough and when Enterprise is needed
For most self-hosted teams, the deciding question in OpenProject Community vs Enterprise is not team size but whether you need identity, portfolio or governance features that the free edition does not include. If your install needs single sign-on, LDAP group sync, SCIM provisioning, portfolio or resource management, or a custom theme and logo, the Community edition will not cover you and you should plan for an Enterprise plan. If none of those are on your requirements list, the free Community edition, which includes work packages, Gantt charts, agile boards, time tracking and dashboards, is a reasonable place to start.
Identity is usually the first check. The pricing page places single sign-on with SAML, OpenID Connect, CAS or Kerberos and LDAP group sync in the Enterprise tiers, while basic LDAP authentication and two-factor authentication appear in the Basic plan. Confirm which of your sign-in methods your identity provider needs, and whether you need group-based role assignment (which depends on LDAP user and group sync in Premium) or SCIM provisioning (listed in Corporate). Those answers decide the tier before any price comparison. Check the current feature split on the OpenProject pricing page, because plan contents change between releases.
Before you buy, run a short trial. A 14-day Enterprise trial token can be started on a self-hosted Community install under Administration, and an install that is not upgraded reverts to Community automatically. Use the trial to test your SSO flow, group sync and any governance features on a copy of your data, and record the results in your decision file. Ask the vendor to confirm how the trial token behaves in your exact deployment method, including Docker Compose and packaged installs.
Which features sit in Community and which start at each Enterprise plan
This table maps the feature split the vendor documents on its pricing page, from the free Community edition up through Basic, Professional, Premium and Corporate. Read each row as the lowest plan where a feature appears, and confirm the lists on the pricing page before you buy, since plan contents can change.
| Tier | Features listed at this tier | Who it usually matters for |
|---|---|---|
| Community (free) | Work packages, Gantt charts, agile and Kanban boards, wiki, REST API, custom fields and workflows, time and cost tracking, community support | Teams that need core project tracking and can run the install and support themselves |
| Basic | LDAP authentication, two-factor authentication, custom theme and logo, Gantt PDF export, placeholder users, team planner | Teams that need directory-based sign-in or branded, shareable Gantt output without SSO |
| Professional | Single sign-on, MCP server, OneDrive and SharePoint integration, sharing work packages with external users, internal comments | Teams that must centralize sign-in and collaborate with outside parties |
| Premium | Portfolio management, resource management, customizable project life cycles, LDAP user and group sync | Programme and PMO teams that manage several projects and capacity together |
| Corporate | OpenID Connect for Nextcloud Hub, openDesk and XWiki integrations, SCIM provisioning, ClamAV antivirus scanning | Organizations standardizing on those suites or needing automated user provisioning and malware scanning |
Which team profile points to Community, Basic, Professional or Premium
A small team that needs work packages, Gantt charts, boards, time tracking and a wiki has little reason to buy a paid edition. The free Community edition includes those features, along with forums, custom fields, workflows, project templates and the REST API, and it is supported by the community rather than by a vendor contract. Community suits a team that signs in with local accounts and does not need to manage project portfolios across many programs.
- Included in Community: work packages, Gantt charts, agile and Kanban boards, Scrum, meetings, time and cost tracking, budgets and dashboards.
- Community support: support comes from the community, so plan internal ownership of upgrades and backups.
- Upgrade trigger: LDAP login or two-factor authentication moves you to Basic, so revisit this choice if either becomes a requirement.
- Hosting cost: the license is free, but you still pay for the server, the database and the staff who run them.
Before you commit, confirm that local accounts meet your password and access policy, and that your team will handle upgrades on the release cadence without a vendor contract.
A team that needs directory-based sign-in or second-factor checks for its project tool is the first group that needs a paid edition. Basic adds LDAP authentication and two-factor authentication, along with a custom theme and logo, Gantt PDF export, placeholder users, the team planner and configurable work package forms. Basic is priced per named user per month at 5.95 euros on OpenProject's pricing page, so the cost grows with the number of users who sign in.
- LDAP authentication: Basic covers LDAP sign-in, but LDAP group synchronization is listed under Premium, so group-based roles need a higher edition.
- Two-factor authentication: included in Basic, which suits teams that need a second factor on local or directory accounts.
- Per-user pricing: the Basic rate of 5.95 euros per user per month is the figure to use in your model, and it recurs for as long as the subscription runs.
- Trial path: a 14-day Enterprise trial token on a self-hosted install reverts to Community if it is not upgraded.
Confirm with your directory administrator that your LDAP server is reachable from the OpenProject host, and decide whether you need group sync, since that changes the edition.
A team that wants single sign-on through its identity provider and must share work packages with people outside the organization needs Professional or higher. Professional adds single sign-on, the MCP server, the OneDrive and SharePoint integration, sharing work packages with external users and internal comments. The published Enterprise feature list names SAML, OpenID Connect, CAS, Kerberos and Okta as SSO options, which is the first thing to check against your provider.
- SSO protocols: confirm that your identity provider speaks SAML, OpenID Connect, CAS, Kerberos or the Okta integration named on the pricing page.
- External sharing: Professional allows external users on work packages, which affects who can see project data and should be reviewed with your data owners.
- Per-user pricing: Professional is listed at 10.95 euros per named user per month with a 25-user minimum, so smaller teams pay for the minimum.
- Other paid features: if you need SCIM provisioning or ClamAV scanning, those sit in Corporate, not Professional.
Confirm your identity provider protocol and its version with OpenProject support before purchase, and test the SSO flow in a non-production install first.
A portfolio office that compares projects, balances staff across them and needs to govern project life cycles should look at Premium. Premium adds portfolio management, resource management, customizable project life cycles and LDAP user and group sync. It is priced at 15.95 euros per named user per month with a 100-user minimum on the on-premises plan, so a small portfolio office may find the minimum shapes the total more than the rate does.
- Portfolio and resource views: Premium is the lowest listed edition that includes both, so a team that needs only one of them still needs to confirm the feature list.
- Group sync: LDAP user and group sync is in Premium, which matters if roles follow directory groups.
- Minimum seats: the 100-user minimum applies to Premium, so count named users before comparing it with a smaller plan.
- Scale: Corporate, quoted on request for 250 or more users, adds SCIM provisioning and ClamAV scanning.
Ask for a written quote that lists named users, the edition, the subscription term and any multi-year discount, and confirm that the portfolio views meet your reporting needs.
Which Enterprise features justify the upgrade
The Enterprise features that matter most are the ones tied to identity, access and regulated data handling. Each card below names the condition under which a feature becomes a requirement and what a Community-only team does instead, so you can match the plan to your environment rather than to a feature list.
SSO against existing identity providers
Single sign-on with SAML, OpenID Connect, CAS or Kerberos sits in the Professional plan on OpenProject's pricing page, and Okta is listed among the supported providers. It matters when your staff already sign in through a central identity provider and you want project access to follow that login, including joiners and leavers. Check which protocol your identity provider supports and whether your team needs it on the on-premises plan you are quoted. A Community-only team typically keeps local OpenProject accounts and manages sign-in and offboarding by hand, which adds review work and a longer window for stale access.
LDAP group sync for role mapping
LDAP authentication is available from the Basic plan, while LDAP user and group synchronization is listed under Premium. Group sync matters when project roles should follow directory groups that your HR or access process already maintains, so membership changes without an administrator editing each project. Confirm that your directory exposes the group attributes you need and test how removed users are handled. A Community-only team can still authenticate against a directory at the Basic tier, but assigns project roles and group membership manually.
Portfolio and resource management
Portfolio management and resource management are Premium features, alongside customizable project life cycles. They matter when a program office needs to compare many projects, see capacity across people and make allocation decisions in one view. Ask whether your reporting needs are met by project-level Gantt charts and dashboards from the Community edition, since many teams only need a consolidated view for a few programs. A Community-only team usually builds portfolio reports from exported data or in a separate reporting tool, which takes ongoing maintenance.
Custom branding
Custom branding is an Enterprise feature, while the Basic plan adds a custom theme and logo. It matters mainly for client-facing portals or internal rollouts where the tool must match corporate identity. If the goal is only visual consistency for internal users, confirm whether the Basic theme and logo options cover it before paying for a higher tier. A Community-only team can publish guidance and a shared landing page that points users to OpenProject, which keeps branding out of the application itself.
SCIM provisioning for automated accounts
SCIM provisioning is listed in the Corporate plan, which is priced on request for 250 or more users. It matters when your identity provider should create, update and deactivate OpenProject accounts automatically as part of a lifecycle process. Before you request a Corporate quote, confirm the user count, the identity provider you will connect and whether your audit process requires automated deprovisioning evidence. A Community-only team handles provisioning through administrator tasks or scripts against the REST API, which the Community edition includes, and must maintain that process itself.
ClamAV scanning for regulated uploads
ClamAV antivirus scanning is part of the Corporate plan. It matters when users upload files such as client documents, specifications or scanned forms that your security policy requires to be checked before storage or download. Ask your security team whether a scan at upload time, rather than at endpoint level, satisfies your malware control, and confirm how scan results are logged. A Community-only team typically relies on scanning at the file server, mail gateway or endpoint layer outside OpenProject, which covers uploads only if those layers see the same traffic.
What Enterprise on-premises costs and what drives the total
This table sets out the published OpenProject Enterprise on-premises prices and the separate cost components that sit around the subscription. Read the subscription rows as the licence line only, then use the driver rows to build the full budget before asking for a quote.
| Cost component | What the published figure covers | What drives it up or down |
|---|---|---|
| Basic plan | 5.95 euros per named user per month, on premises (OpenProject pricing page) | Named user count and whether LDAP, two-factor and custom branding are required at this tier |
| Professional plan | 10.95 euros per named user per month, with a 25-user minimum (OpenProject pricing page) | Need for single sign-on, the MCP server and external sharing; minimum seat count applies even for smaller teams |
| Premium plan | 15.95 euros per named user per month, with a 100-user minimum (OpenProject pricing page) | Need for portfolio and resource management, custom project life cycles and LDAP user and group sync |
| Corporate plan | On request for 250 or more users (OpenProject pricing page) | Requires a written quote; Nextcloud Hub OIDC, openDesk, XWiki, SCIM and ClamAV scanning are scoped here |
| Multi-year discount | 5 months free for 2 years, 8 months for 3 years, 11 months for 4 years and 15 months for 5 years (OpenProject pricing page) | Term length committed up front; confirm how the free months apply to your named user count and renewal terms |
| BIM add-on | 1 euro per user (OpenProject pricing page) | Only relevant if building information modelling use is in scope; confirm whether it applies per named user across all plans |
| Internal staff time | Not included in any subscription price; covers project admins, identity engineers and the people who run upgrades | Number of administrators, upgrade cadence and how many integrations you operate in-house |
| Hosting and infrastructure | Not included; you run the servers, database and backups in your own infrastructure | User count and sizing (OpenProject sizing guide starts at 4 cores and 4 GB RAM for up to 200 users), plus backup and high-availability design |
| Identity integration and migration | Not included; SSO, LDAP sync and any Jira Data Center import are scoped separately | Number of identity providers, directory complexity and whether the Jira Migrator beta is used in a test setup only |
How the 14-day trial token on a self-hosted install reverts to Community
This sequence takes a self-hosted Community install through a 14-day Enterprise trial, a documented evaluation of the paid features, and a purchase or reversion decision, so the team knows exactly which edition is running at each point.
Confirm the install and edition baseline
Before requesting anything, the administrator records the current OpenProject version, the install method (Docker Compose, packages, or Helm chart) and the edition in use, which should be Community. Keep a copy of the configuration and database backup so the state can be restored if the trial is handled differently than expected. The step is complete when the team has a written baseline for the install and a tested backup.
Start the trial token under Administration
A system administrator opens Administration, goes to the Enterprise edition section and requests a 14-day Enterprise trial token for this self-hosted Community install. The token is applied to that single instance. The step is done when the Enterprise edition page shows the trial as active with its expiry visible, which confirms the token was accepted.
Build a non-production copy for testing
Before evaluating SSO or LDAP sync against real accounts, the platform team clones the install to a non-production environment with the same version, database and directory settings, or a close equivalent. Test identity providers and directory groups there first, so a misconfigured sync cannot change access in production. The step is complete when the copy starts, shows the trial state, and the team has a list of identity settings to test.
Evaluate Enterprise features within the window
During the 14-day window, the evaluation team tests the features that matter for their decision: single sign-on, LDAP group synchronization, portfolio or resource management, and custom branding, each checked against the plan tier that the pricing page lists it under. They should run a real-world scenario with test users and record results. The step is complete when each required feature has a pass or fail note and a named owner.
Decide whether to purchase an Enterprise plan
The sponsor compares the evaluation notes with the Basic, Professional, Premium and Corporate feature lists and the on-premises pricing, which is quoted per named user per month. They should request a written quote covering user count, plan tier, and any multi-year discount before the trial expires, since purchase is what keeps Enterprise features active. The step is done when the decision is recorded and the quote, or a decision to stay on Community, is on file.
Apply the purchase or let the trial lapse
If the team buys, it applies the subscription token to the same install under Administration and Enterprise edition, then verifies that the paid features are active. If it does not buy, the team takes no further action on the trial, and it should confirm that the install is not upgraded to a newer edition. The step is complete when the edition shown in Administration matches the decision.
Verify reversion behavior for the install method
An install that is not upgraded reverts to Community automatically once the trial ends, according to OpenProject's pricing page. Because reversion behavior depends on how the install is run, the operations team should confirm with OpenProject, or in its own test copy, what happens under its Docker Compose, package or Helm deployment, and check that the Community features and data remain intact. The step is done when the team has a written note of the confirmed behavior and a rollback plan.
Moving from Community to Enterprise and back without losing data
Upgrading does not move your data. Applying an Enterprise subscription or trial token converts the same self-hosted OpenProject instance, so existing projects, work packages, users and attachments stay where they are. The trial is started under Administration and the Enterprise edition section of a Community install. Before you start it, back up the database and the file storage, and confirm with OpenProject that the token applies to your install method (Docker Compose, package or Helm chart), since the upgrade path is the same instance rather than a new deployment.
Falling back to Community removes Enterprise features, not records. An install that is not upgraded reverts to Community automatically when the trial ends, and the data remains. What changes is access to the functions the edition unlocks. Before a trial or a renewal lapses, list every Enterprise feature your users depend on, such as single sign-on through SAML, OpenID Connect, CAS or Kerberos, LDAP group synchronization, portfolio and resource management, and custom branding. Then test the Community login path, confirm which local accounts can still sign in, and tell project owners which reports, portfolio views or group-based permissions will stop working. Confirm the exact behavior of each feature after reversion with OpenProject before you rely on it.
Treat any move to another tool as a separate project. Returning to Community is a configuration change on the same platform. Exporting work packages, wiki content and users into a different product, such as a classic tracker or an agile tool, is a data migration with its own field mapping, attachment handling, user identity and validation steps. Scope that work in a separate written plan, with named owners and acceptance checks, before anyone starts a migration. If you are planning a move from Jira, note that the OpenProject Jira Migrator in the supplied documentation applies only to Jira Data Center and is in beta, so it is not a substitute for that plan.
Questions buyers ask before choosing an OpenProject edition
Is the free OpenProject Community edition enough for a regulated team?
Community can be enough for planning and tracking work, but regulated teams usually need identity and access features that sit in Enterprise plans. The pricing page lists single sign-on with SAML, OpenID Connect, CAS or Kerberos and LDAP group synchronization as Enterprise features, while Community includes work packages, Gantt charts, boards, time tracking, wiki and REST API access with community support. Map your access control, audit and provisioning requirements against the plan tables before deciding. Confirm current feature placement on the OpenProject pricing page, since plan contents can change between releases.
How much does OpenProject Enterprise cost per user?
Published on-premises list prices are per named user per month: Basic at 5.95 euros and Professional at 10.95 euros with a 25-user minimum, Premium at 15.95 euros with a 100-user minimum, and Corporate on request for 250 or more users. Multi-year on-premises subscriptions give 5 months free for 2 years, 8 months for 3 years, 11 months for 4 years and 15 months for 5 years, and the BIM add-on costs 1 euro per user. Your total depends on user count, plan and term length, so ask for a quote that states each line item. Those figures come from the OpenProject pricing page.
Does the 14-day Enterprise trial revert to Community automatically?
Yes. The trial is a 14-day Enterprise token you start under Administration and Enterprise edition on a self-hosted Community install. If you do not upgrade to a paid subscription, the installation reverts to Community automatically when the trial ends. Plan a test window that covers your SSO and LDAP configuration, because you want to validate those settings before any paid decision. Check the exact activation steps in the OpenProject documentation for your version.
How long does setup and identity integration take, and what drives that effort?
The effort depends less on the install itself than on your identity architecture and data preparation. Install paths include Docker-based installation (recommended), .deb and .rpm packages for supported 64-bit Linux distributions, and Kubernetes with Helm charts. Major drivers are the number of identity providers, whether you need LDAP group sync, how roles map to your groups, the PostgreSQL 16 or later database, and the sizing for your user count. Ask any implementation partner for a written, fixed-scope plan that lists identity tasks separately from installation. Timelines are not published here, so request them in the scope document.
Can our internal staff run OpenProject after go-live?
Often yes, provided someone owns upgrades, backups, database maintenance and identity changes. Releases ship roughly monthly, for example 17.9.0 on September 30, 2026 and 17.9.2 on October 15, 2026, so plan a recurring upgrade routine and a tested restore procedure. The skills needed are Linux administration, container or package management, PostgreSQL operations and identity administration. Teams without that capacity often choose a support retainer for ongoing upgrades and testing. Decide this before purchase, because the operational load is the largest recurring cost after licensing.
What should we ask for in a written quote?
Ask for a quote that separates each cost: Enterprise subscription by plan, user count and term, add-ons such as BIM, one-time implementation work, identity integration, data migration, and ongoing support or upgrades. Request the assumed user count, the plan that includes each required feature, the trial and go-live plan, and the exclusions. For migrations, confirm that Jira Migrator support is limited to Jira Data Center 10.x and 11.x, is not Jira Cloud, and is in beta. Ask who handles backups, restores and acceptance testing, and what happens to data if a subscription lapses.
Do we need Enterprise for SSO if we already run Nextcloud or Kerberos?
Single sign-on, including Kerberos, is listed among Enterprise features, so the existence of a Kerberos or Nextcloud environment does not by itself remove the licensing question. The Nextcloud integration is part of the Community feature list, but OpenID Connect for Nextcloud Hub is a Corporate feature. Confirm this mapping with OpenProject for your exact integration before you rely on it. Your identity team should also confirm how group membership will be read and enforced.
How DeployOpen scopes and supports OpenProject editions
DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted OpenProject inside your own infrastructure, whether you run Community or an Enterprise plan. Engagements are fixed-scope, so the edition decision, the identity setup and the trial-to-Community path are agreed in writing before any work starts.
How we scope
- We confirm which OpenProject features your teams need before choosing Community or an Enterprise plan.
- The written scope names the edition, plan tier, user count and identity provider in use.
- We record whether a 14-day Enterprise trial token is part of the plan or a short evaluation step.
- Scope covers hosting target, database version, backup approach and who operates the install afterwards.
How we build
- We install OpenProject in your cloud account, data center or air-gapped network using the method you choose.
- Single sign-on, LDAP group sync and custom branding are configured only if your chosen plan includes them.
- We set up PostgreSQL with the extensions OpenProject requires and size the hosts against your user count.
- Integrations such as Nextcloud are connected and tested against your own identity and file systems.
How we hand over
- Deliverables include install documentation, configuration records and the edition and license state of the instance.
- We document what happens if an Enterprise token expires, so the install reverts to Community as expected.
- Runbooks cover upgrade steps across OpenProject minor releases, backups and restore testing.
- Administrators receive a walkthrough of user, role and identity settings in your environment.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainer scope should state which OpenProject releases, plugins and integrations are covered.
- Ask for a written quote tied to scope, since DeployOpen does not publish a price list.
- License purchases and subscription terms are between you and OpenProject, and are confirmed with the vendor.
