What identity governance costs when midPoint has no license fee
midPoint has no license fee and no enterprise edition, so the cost of an open source identity governance build is labor, infrastructure and support rather than a per-user charge. Evolveum states that every line of midPoint code is published under open source licenses and that the project describes itself as open source, not open core. Evolveum funds development through subscriptions, training and professional services, so the vendor relationship is paid for by the services and support you choose, not by unlocking features. Compare that with a per-user suite such as Okta's Essentials tier, which bundles Lifecycle Management and Access Governance into a subscription, or Microsoft Entra Suite, listed from $12.00 per user per month and requiring an existing Entra ID P1 subscription. Those prices recur every year and scale with headcount. The midPoint comparison is different: the total depends on the number of target systems, the quality of your authoritative sources, the complexity of your role model and the support model you choose.
Four cost components drive most of the difference. The first is connector and integration work: each target system needs a ConnId connector, and the documented set (LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID, SCIM2 and SCIMv1) covers some systems but not all, so unsupported applications add build effort. The second is data cleanup, which is often the largest one-time item: orphaned accounts and inconsistent HR records must be resolved before go-live or the first certification campaign will be unreliable. The third is role modeling, which grows with the number of applications and exceptions. The fourth is infrastructure and operations, including a PostgreSQL database, usually on a separate server, plus Java and application hosting. Ask any implementation partner to price these four items separately in a written scope, and state which systems are on the supported connector list and which need custom work.
Support is the recurring decision. Evolveum offers Product Support subscriptions for resolving product bugs, with 8x5 next-business-day or 24x7 service levels, and Platform Subscriptions that add feature development and roadmap influence. The Evolveum support page lists no prices, so request current terms directly and compare them with the upgrade cadence: midPoint 4.8 (Curie) is a long-term support release supported until 17 October 2028, while 4.10 (Braille) is supported until 26 November 2027. Decide whether your organization will fund a long-term support line, how often it will move to a newer release, and who performs those upgrades. Your cost model should show one-time build spend, recurring infrastructure and support, and internal staff time, so that it can be compared line by line with a suite quote built on the same systems and user population.
Cost components: in-house, partner and SaaS
This table compares who pays for each identity governance cost component under a self-hosted midPoint build, a partner-delivered engagement and a per-user SaaS suite. Read each row for the payer and whether the cost is one-time or recurring, then ask each option for its written scope and current terms.
| Cost component | In-house build and partner-delivered midPoint | SaaS identity suite |
|---|---|---|
| Software license | No midPoint license fee. Evolveum states midPoint has no enterprise edition. Recurring cost only if you buy an Evolveum support or platform subscription. | Recurring, per user. Okta tiers bundle different modules (Essentials adds Lifecycle Management and Access Governance). Microsoft Entra Suite is listed from $12.00 per user per month and requires Entra ID P1 (Microsoft Entra pricing page). Confirm current terms with each vendor. |
| Connector development | One-time per target system, plus recurring maintenance when target systems change. Documented ConnId connectors cover LDAP, Active Directory, Entra ID, SCIM2 and others. Confirm which connectors are supported versus community or experimental. | Mostly included for vendor-listed applications. Custom or legacy targets may need vendor professional services or custom integration. Ask which connectors are included in your tier. |
| Role modeling | One-time design work from existing access, then recurring review as roles change. Usually the largest variable effort, paid as partner services or internal staff time. | Partly one-time, with recurring governance work. Role design still needs your team, whichever tool you choose. |
| Data cleanup | One-time effort to reconcile accounts, remove orphaned access and correct HR source data before go-live. Paid by you, either internally or to a partner. | Same one-time effort. A SaaS suite does not remove the need to fix authoritative data. |
| Infrastructure | Recurring. Hosting for midPoint, a PostgreSQL database (ideally on a separate server), load balancing and non-production environments. Confirm sizing against the midPoint system requirements. | Mostly vendor-hosted, so there is little infrastructure cost. Connector agents or on-premises gateways may still need hosting in your network. |
| Staffing and operations | Recurring. Internal administrators or a retained partner for upgrades, monitoring, backups and access requests. Confirm who holds on-call and change responsibility. | Recurring, lower operational load. Your team still runs policies, reviews and connector changes. |
| Support subscriptions | Optional recurring. Evolveum offers Product Support and Platform Subscriptions, with 8x5 next-business-day or 24x7 SLA options. The page lists no prices. Ask for quotes. | Recurring, included in the per-user subscription. Confirm support hours and SLA terms in your contract. |
| Upgrades and version planning | Recurring. midPoint 4.8 is a long-term support release supported until October 17, 2028 (midPoint releases page). Budget testing for each upgrade, and confirm Java and PostgreSQL requirements for your target version. | Vendor-managed release cadence. Confirm how breaking changes are announced and how much regression testing you still need to do. |
| Audit and evidence work | Recurring. Your team or partner produces campaign records, access change logs and reports for each assessment. Ask whether the partner includes evidence packs in fixed scope. | Partly included in suite reporting. Confirm whether the reports meet your auditor's population and sample requirements, which you still need to test. |
What moves identity governance cost up or down
With midPoint there is no license fee to pay, so the cost of identity governance sits in the work around the software: connecting systems, shaping roles, cleaning data and keeping the platform supported. The cards below cover the drivers that most often move the total up or down, and each one is worth checking before you ask for a quote.
Target systems and connector types
Each target system needs a connector, and the cost of each depends on the protocol behind it. LDAP, Active Directory, Microsoft Entra ID through the Graph API, SCIM2 and DatabaseTable are documented connector types, while many others in the catalog are community or experimental. A custom or community connector usually adds build, testing and ongoing maintenance effort. Ask your partner which connectors they have deployed in production and which would be new work.
Authoritative HR source quality
Joiner, mover and leaver automation is only as reliable as the HR record that drives it. If job codes, manager fields and termination dates are inconsistent or maintained by hand, someone must clean and map that data before provisioning can be trusted. Effort rises with the number of HR systems, contractor feeds and acquired workforces. Ask the partner to scope the source data review as a separate line item, and confirm who owns the HR data after go-live.
Role model complexity
Role design is where much of the effort in an implementation sits. A small set of business roles that maps cleanly to a few target systems costs far less to model than a role catalog built from years of direct grants and exceptions. Each role also adds approval rules, segregation of duties checks and review scope. Ask how the partner will derive roles from existing access, how many roles you should expect, and who signs off on role ownership.
Orphaned account cleanup before go-live
Accounts without an owner, shared accounts and access granted outside any process must be found and resolved before midPoint takes control of provisioning. Skipping this step moves the work into the first certification campaign, where reviewers face unexplained entitlements. The effort depends on how many directories and applications are in scope and how much history they hold. Ask for the cleanup approach, the decision authority for orphaned accounts and the evidence kept of each decision.
Upgrade cadence and LTS choice
The midPoint release you select sets how often you will upgrade and how much of that work recurs. The 4.8 Curie long-term support release is supported until 17 October 2028, which gives a longer planning window, while 4.10 Braille is supported until 26 November 2027. The 4.9 release reaches end of support on 18 October 2026. Ask the partner to state which release they will deploy, the upgrade plan for the period you need and whether upgrades are priced into a retainer.
Evolveum subscription tier and SLA
Evolveum sells Product Support subscriptions for resolving product bugs, with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. Neither tier is a license fee for midPoint itself, and the subscription page lists no prices. Choose the tier by how quickly you need bug fixes and whether you need features on your roadmap. Confirm the current terms and prices with Evolveum before you compare them with a partner quote.
When building in-house beats hiring a partner, and when it does not
Building in-house makes sense when the team already carries the skills midPoint demands day to day: Java 21 or Java 25 operations (midPoint recommends Java 25 for version 4.11 and later), PostgreSQL administration on a separate database server, Docker or virtual machine operations, ConnId connector development for systems without a published connector, and role engineering that turns messy existing entitlements into a model people can defend. Ask a plain question before committing: who on the team can own the upgrade path, including the move from one long-term support line to the next, and who will write and test connectors when a target application changes its API? If the answer is one person who is also on call for other platforms, the in-house option carries key-person risk that appears in the license-free line item but not in the budget.
A partner fits best when the scope is known and fixed in writing: a defined set of authoritative HR and directory sources, a bounded list of target systems, a role model to be derived from existing access, and an agreed cleanup of orphaned accounts before go-live. Fixed-scope delivery shifts the risk of an overrun onto the statement of work, which is the point for teams that need the first certification campaign on a deadline. A SaaS suite is often the better fit for a small estate on a single directory, where lifecycle rules are few, the target systems are already connectors in the vendor catalog, and the team has no appetite to operate an identity platform. Okta's Essentials tier, for example, lists Lifecycle Management and Access Governance per user, and Microsoft Entra Suite is listed from $12.00 per user per month and requires an existing Entra ID P1 subscription (the vendor pricing pages). Model both against your user count and connector list before deciding.
DeployOpen does not publish prices. A quote follows from the written scope, so the useful preparation is a scope document: the number of identity sources, target systems and connectors, the joiner, mover and leaver rules, the approval and certification cadence, and the hosting constraints in your cloud accounts or data centers. Ask each bidder, including your own team's estimate, to separate one-time work (design, connector build, cleanup, migration) from recurring work (platform upgrades, connector maintenance, support). Evolveum's paid Product Support and Platform Subscriptions are a separate purchase from any implementation and should be priced on their own line. Confirm these components before you compare totals.
How to build your own identity governance estimate
This sequence turns a vague budget question into a written scope that you can price, compare against suites and hand to any implementation partner. Each step produces a document your team owns.
Inventory target systems and entitlements
Your identity or IT team lists every system that should receive accounts from midPoint, such as Active Directory, LDAP directories, business applications and cloud tenants. For each system, record who administers it, which entitlements or roles exist, and whether any accounts are shared or service accounts. The step is done when every target has an owner and a count of entitlements, because that count drives connector and role-modeling effort more than any other input.
Classify each connector as supported or community
Check each target against the Evolveum connector documentation and mark it as supported, community or experimental. Supported connectors such as LDAP, Active Directory, Microsoft Entra ID and SCIM2 carry the lowest integration risk, while community or experimental connectors usually need testing time and possibly custom code written by your partner. The output is a connector register that shows which integrations are standard and which are custom work, and it becomes the first cost line in your estimate.
Score HR and directory data quality
Ask HR and directory owners to export a sample of identities and rate them for completeness, unique identifiers, manager relationships, department codes and termination dates. Count duplicate accounts, orphaned accounts and identities missing an authoritative source. Cleanup before go-live is usually a one-time cost that depends on the score, so record the findings in a table with a severity for each issue. The step is complete when you can state what share of records need manual correction, rather than assuming the data is clean.
Size the role model
Using the entitlement inventory, group access into candidate roles with business owners, then count how many roles, role exceptions and approval paths the design needs. Business roles are typically designed once and then maintained, so note which roles change with reorganizations and which are stable. Your output is a draft role catalog with an owner for each role and a list of open questions for the business. Partners often quote role modeling separately from connector work, so keep the two counts apart in your notes.
Price the infrastructure for midPoint
Read the midPoint system requirements to confirm the supported Java version for the release you plan to run, the PostgreSQL requirement and the recommended separate database server. Decide whether midPoint runs on a Linux virtual machine or from Docker images, and whether you need a sticky HTTP load balancer, a shared central database and Quartz-based task scheduling for multi-node operation. Ask your infrastructure team to quote compute, storage, backup, monitoring and network for each environment, including test and disaster recovery. Infrastructure is usually a recurring cost, so separate it from one-time build work in the estimate.
Set the support tier
Review the Evolveum support subscription options and decide whether you need product support for resolving product bugs, a platform subscription for feature development and roadmap influence, or internal staff with a partner on call. Compare the response models offered (8x5 next-business-day or 24x7) against your operational hours and incident obligations. Support is a recurring cost that you can scope, so write down which environments and severity levels it must cover before requesting prices. The step is complete when the support model is documented next to the infrastructure line.
Plan the upgrade path and release line
Compare the long-term support and feature release lines listed on the midPoint releases page, and decide which release your organization will run and for how long. Confirm the end-of-support dates for the release you select and estimate how often your team or partner will test and apply upgrades in non-production environments. Upgrade work recurs, so record its frequency, testing scope and who signs off on each change. Keep the plan in the estimate so that the recurring cost reflects the actual lifecycle of the platform.
Request a written scope and quote
Send your inventory, connector register, data-quality findings, role draft, infrastructure requirements and support model to two or three providers, including the commercial suites you are comparing, and ask each for a written scope with deliverables, assumptions, exclusions and acceptance criteria. Ask each provider to separate one-time costs (connector build, data cleanup, role design, training, cutover) from recurring costs (infrastructure, support, upgrades, role maintenance). The estimate is ready when every quote maps to the same scope, so the figures are comparable rather than optimistic.
Which identity governance costs recur after go-live
The recurring cost of a midPoint deployment is mostly operations, not licensing, because midPoint has no license fee or enterprise edition. After go-live, the budget that repeats each year covers four things: the infrastructure and database that run midPoint, the connector work that keeps each target system in step, the people who administer roles and certification campaigns, and the upgrades that keep the platform inside a supported window. Ask each partner to price these as separate line items, so you can see which ones scale with your user count and which stay flat.
Start with infrastructure and database operations. midPoint uses PostgreSQL as its native repository, ideally on a separate database server, and multi-node deployments need a sticky HTTP load balancer and a shared central database. Those components carry backup, patching, monitoring and failover duties every month. Connector maintenance is the less visible cost: when an HR system, Active Directory domain, SaaS application or database schema changes, the matching ConnId connector may need configuration or code changes and retesting. Count the number of target systems you plan to connect, and ask who owns each connector after handover.
Role and certification administration is the cost that grows fastest with the business. Each reorganization, new application or policy change means reviewing role definitions, and each certification campaign means managers and application owners must decide on access in a defined cadence, with the decisions kept as evidence. Upgrades are the last recurring item. Evolveum documents support windows for each release, and midPoint 4.8 (Curie) is the long-term support release supported until October 17, 2028. Support subscriptions from Evolveum, which cover product bugs under an 8x5 or 24x7 SLA, are priced only on request, so confirm the tier and the price before you budget. Keycloak, if it sits alongside midPoint for single sign-on, follows its own cadence of four minor releases a year, so check both vendor release pages before setting a budget.
Questions buyers ask about identity governance cost and effort
How much effort does a midPoint rollout usually take?
The effort depends on how many authoritative sources, target systems and roles the estate has, not on a license fee, because midPoint has no enterprise edition and Evolveum states that every line of its code is published under open source licenses. The main work is connector configuration, role modeling, data cleanup and testing of joiner, mover and leaver rules. Ask any partner to size the work by counting systems, connectors and roles in writing before quoting. Sizing this way gives a basis for comparing proposals, since the same estate can need very different effort depending on how clean its source data is.
Can an internal team run a midPoint project without a partner?
An internal team can run a midPoint project alone if it already has Java, PostgreSQL and directory skills, time to model roles, and someone who owns the access policy. Evolveum funds development through subscriptions, training and professional services, so training and product support are available to teams that choose to build in-house. Most teams still underestimate the connector work and the role model review, which need people who know both the identity data and the target applications. Ask whether the internal team has run a certification campaign before, because that is often the first place gaps appear.
What does the work need from HR and application owners?
HR must confirm which system is authoritative for employment status, start and end dates, and job codes, because midPoint acts on those attributes for joiners, movers and leavers. Application owners must confirm which accounts and entitlements exist in their systems, who approves access, and which roles they accept as a model. Plan for these owners to review role definitions and certification scope before go-live, since their sign-off determines whether evidence is accepted later. Set their time commitments and named contacts in the statement of work so that delays are visible early.
How long does a midPoint go-live take?
Go-live duration depends on scope, including the number of authoritative sources, target systems, roles and approval flows, and on how clean the existing account data is. No fixed duration is supplied for this work, so ask for a timeline tied to named milestones and agree it in writing before work starts. Most engagements are fixed-scope, which lets the scope, deliverables and timeline be fixed in the same document. A partner who cannot explain which milestones drive the timeline is a warning sign.
Is a SaaS identity suite cheaper for a small estate?
A SaaS suite can be cheaper for a small estate when the buyer needs only standard connectors and no custom role model, because the per-user price is the main cost. Okta lists Lifecycle Management and Access Governance in its Essentials tier, and Microsoft Entra Suite is listed from $12.00 per user per month and requires an existing Entra ID P1 subscription. Compare those per-user prices with the one-time build cost and the recurring support and hosting cost of midPoint at your user count. Also check whether the suite covers your target systems, since unsupported connectors add cost on either path.
What should a quote for midPoint identity governance include?
A quote should list the systems and connectors in scope, the role modeling and cleanup work, the joiner, mover and leaver rules, the certification campaigns, and the testing and documentation deliverables. It should also name who is paid for what, including the partner, any Evolveum subscription, infrastructure and the internal staff time that you must provide. Ask which costs are one-time and which recur, such as support, upgrades and retainers, and what the upgrade plan is for midPoint releases. Require the scope, exclusions and timeline in writing, since DeployOpen issues quotes only from a written scope and does not publish a price list.
How DeployOpen scopes and delivers a fixed-scope identity governance implementation
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For identity governance cost, we turn the build, partner and SaaS options into a written scope with defined connectors, role work and cleanup, so the quote follows from the agreed work.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We list the authoritative HR sources, target systems and connectors that the midPoint cost estimate depends on.
- We separate one-time build work from recurring support, upgrades and infrastructure so the quote is comparable to SaaS per-user pricing.
How we build
- We model roles from existing access and document which entitlements each connector reads and writes.
- We run orphaned and excess account cleanup in a staging copy before any joiner, mover or leaver rules go live.
- We test provisioning, deprovisioning and certification campaigns against your directories and record the results.
How we hand over
- We deliver configuration, connector documentation, runbooks and the upgrade plan for the midPoint release line you choose.
- We prepare the evidence that identity reviews produce, so your team and auditors can re-perform sample checks.
- We train your administrators on role changes, connector maintenance and how to run a certification campaign.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- We can plan midPoint upgrades around the Long-term support end date and the feature release cadence.
- Support retainers let you compare recurring internal staffing costs with an external support agreement in a single quote.
