What does MFA cost when you choose open source, a partner or SaaS?
A CISO or IT lead comparing a self-hosted MFA platform, a partner-run deployment and a per-user SaaS quote should expect the license line to be the smallest and least comparable part of the bill. Most open source MFA platforms have no license fee to pay, including privacyIDEA (AGPLv3) and Keycloak (Apache 2.0). Cost therefore sits in people, infrastructure, hardware tokens, integration work per system and support. SaaS is a different shape: a recurring per-user subscription whose rate must come from the vendor in writing, and which usually recurs for the life of the contract.
For self-hosted MFA, the one-time costs are the design, the deployment, the integration of each system (VPN, Windows logon, Linux PAM, SAML or OIDC applications) and the enrollment of users. The recurring costs are the servers and high availability replicas, the database, backups, monitoring, upgrades and an internal or external support arrangement. Hardware keys are a per-user purchase that repeats with every new hire and every lost key. Ask each option for its unit rates, what is included in the rate and what is excluded, such as enterprise editions, premium support or additional integrations.
The final figure depends on three inputs: the number of users, the systems to cover and the availability design. A single VPN in one site costs far less to protect than a multi-site estate with a highly available identity provider and offline logon requirements. DeployOpen plans and implements these platforms inside the client's own infrastructure and issues a quote from a written, fixed scope. It does not publish a price list. Before requesting quotes, write down the user counts by group, the systems in the first wave and the outage tolerance, then ask every bidder to price against the same list.
Which cost components apply to each option?
This table compares who pays for each MFA cost component under in-house self-hosting, a partner-run deployment and per-user SaaS, and whether each cost is one-time or recurring. Read each row as a question to put to vendors and partners, since the size of each cost depends on your user count, systems and availability targets. The main takeaway is that self-hosting moves cost from the subscription line into staff time and infrastructure, so the recurring work is easy to underestimate.
| Cost component | In-house (self-hosted) | Partner-run | Per-user SaaS |
|---|---|---|---|
| Servers and high availability | Your team pays for virtual or physical servers, load balancers and a second site if required. Recurring, scaled by peak authentication load and availability targets. | Usually billed to you as infrastructure you own, with the partner's effort as a fixed or time-based fee. Confirm who holds the cloud or data center account. | Included in the subscription. Availability design is the vendor's responsibility, so ask for its published service terms. |
| Database | Your team pays for database licensing, if any, plus backup storage and replication. Supported databases are listed in the Keycloak database guide, so confirm the one you choose. | Partner builds and tunes the database, and you pay for its licensing and hosting. Recurring for hosting, one-time for setup. | Not visible to you. Ask how data is stored and where the vendor's regions are. |
| Hardware keys | One-time purchase of FIDO2 keys or hardware OTP tokens, plus spares and replacement stock. Recurring when staff leave or keys are lost. | Often procured by you and shipped or staged by the partner. Ask whether logistics and inventory tracking are in scope. | Usually sold by the vendor or a reseller at an extra cost per key. Confirm whether the price is one-time or recurring. |
| Software tokens and push apps | Low direct cost for TOTP and HOTP apps. Push requires a vendor-supplied mobile app, so confirm its distribution and maintenance cost. | Partner configures and supports the apps. Your cost is mainly the enrollment support described in the next row. | Push and mobile apps are typically included in the per-user price. Check whether passkeys or additional factor types cost extra. |
| Enrollment and help desk effort | Your staff pays for enrollment campaigns, token issuance, lost-device resets and recovery procedures. Recurring, and it grows with headcount and turnover. | Partner may run enrollment projects for a one-time fee, but your help desk still handles daily resets unless a support retainer covers it. | Vendor offers self-service portals and support tiers. Your help desk effort still recurs, so ask what the vendor's support tiers include. |
| Integration work per system | Your team pays for each connection: VPN through RADIUS, Windows, Linux PAM, SAML and OIDC applications. One-time per system, plus upkeep when systems change. | Partner estimates and delivers each integration in a fixed-scope project. Ask for a per-system breakdown in the written scope. | Pre-built connectors reduce effort for common apps. Custom or legacy systems usually need your own or partner work, so confirm connector coverage. |
| Testing and migration | Your team pays for test environments, pilot groups, token seed imports and migration from the current MFA product. One-time, with some repeat testing for each change. | Partner plans and runs testing and migration as part of the fixed scope. Confirm what migration of existing tokens is included. | Vendor often offers migration tooling, but you pay for your own testing and cutover planning. Ask about token import formats. |
| Upgrades and patching | Your team pays for staff time to test, schedule and apply releases, including database schema changes. Recurring, and it scales with the number of components. | Covered by an ongoing retainer if you buy one. Without a retainer, each upgrade is a new project. Confirm the release cadence and patch windows in the contract. | Vendor applies updates to its hosted service. You still pay for testing changes to your own integrations and policies. |
| Vendor support subscriptions | Optional commercial support from a vendor distribution or support contract. Recurring, and priced by the vendor. Community support is free but has no response commitment. | Support is part of the partner's retainer, if you buy one. Ask what response times the contract commits to. | Support is typically priced into the per-user tier. Ask what support hours and response commitments are included at each tier. |
Which MFA costs are one-time and which recur every year?
The one-time costs of self-hosted MFA are the work that gets the platform live: design, installation, and integration with each VPN, Windows logon, Linux PAM and SSH path, and each web application. Token procurement, user migration from any existing product, and cutover testing also land here. For each system, ask the implementer to price the integration separately, because a RADIUS VPN, a credential provider for Windows and a PAM module for a Linux fleet each have different test effort and rollback steps. Ask whether token seed import (for hardware OTP tokens) is in scope, since that work depends on the seed file formats your vendor supplies and on how many tokens you hold.
The recurring costs are the ones that keep running after cutover. They include server and database running costs, staff time for upgrades, enrollment work, help desk time for lost or replaced tokens, certificates, monitoring, and any support subscription. Upgrades recur by design: Keycloak has planned four minor releases a year since version 26.0, and its Operator documentation recommends manual approval for operator updates, so someone must test and approve each one. High availability also recurs. FreeIPA's deployment guidance calls for at least two to three replicas in each datacenter, and both Keycloak high availability designs need a synchronously replicated database, so you pay for standby capacity and for the people who test failover. A SaaS subscription is recurring by design, and its per-user fee usually continues whether or not the platform changes. Ask each bidder to show the annual cost at your user count, plus what the contract charges for extra users, tokens and integrations.
What moves the MFA cost up or down?
Most of the cost of self-hosted MFA is set by a few decisions made before any software is installed. The number of systems, the directory behind them, the token mix, the availability targets, the deployment constraints and the support commitments interact, so a change in one usually moves the others. Ask each vendor or partner to price these drivers separately so you can compare build, partner and SaaS options on the same basis.
Number of systems to integrate
Each system that asks for a second factor is a separate integration with its own configuration, testing and change control. VPNs usually connect through RADIUS, Windows logon through a credential provider, Linux through a PAM module and web applications through SAML, OIDC or the REST API. A small set of web applications behind one identity provider costs far less than the same count spread across four protocols. Ask whether the quote lists integration work per system and what counts as one integration.
User store and directory
Where users already live sets how much identity work is needed before MFA can start. An existing Active Directory or LDAP directory can be read by privacyIDEA through a user ID resolver, so the MFA layer mostly adds token enrollment. A design that adds FreeIPA as a new directory means migrating users, groups and policies, which adds project time and a second system to run. Ask which directory the quote assumes and who owns the migration effort.
Token mix and hardware logistics
Software TOTP and push tokens cost little per user but need an app, enrollment and help desk support. Hardware keys, smartcards and imported OTP seed tokens add purchasing, shipping, inventory, replacement and secure disposal costs that recur as staff turn over. Phishing-resistant FIDO2 keys raise the hardware cost but reduce the number of reset tickets from phished accounts. Ask who buys and stocks the tokens, what the replacement rate assumption is and whether seed import is in scope.
High availability and disaster recovery targets
A single MFA server is cheap but becomes a lockout risk for every protected system. High availability needs at least two nodes, a shared and synchronously replicated database for Keycloak, FreeIPA replicas in each datacenter and tested backups. Each extra node, database cluster, load balancer and recovery drill adds infrastructure and staff hours that recur. Ask for the availability design in the quote, the failover test schedule and what happens to logins when the MFA service is unreachable.
Air-gapped networks and data residency
Air-gapped enclaves and strict data residency rules rule out cloud-hosted MFA and push services that depend on external servers. Self-hosting inside the enclave means the operator must handle offline updates, package mirrors, certificate authorities and on-premises monitoring. Those tasks usually raise build and partner effort more than they raise licence cost, and they can narrow which token types remain usable. Ask which features need outbound connectivity, how updates reach the enclave and who is responsible for offline patching.
Support and upgrade commitments
Open-source MFA carries no licence fee, but the operator pays for patching, version upgrades and security response. Keycloak ships four minor releases a year, and FreeIPA publishes security fixes such as the 4.13.4 release. A support subscription, a partner retainer or an in-house on-call rota each covers a different share of that work. Ask what response times are committed in writing, how upgrades are tested before production, and whether the quote covers the full year or only the initial rollout.
How the cost looks under build, partner and SaaS
Your own staff select, install, integrate and operate the MFA platform, such as privacyIDEA, Keycloak or FreeIPA, on servers you run. No outside firm is paid for delivery, so the spend shows up as internal time, hardware or cloud capacity, and software support if you buy it. The main cost is skilled labor that stays on the payroll after go-live.
- Staff time: Engineers must learn the chosen platform, build the high availability design, write integration configuration for each VPN, Windows, Linux and web system, and maintain it through upgrades.
- Infrastructure: Servers or cloud instances, load balancing, database high availability and backups are recurring costs that you size and pay for yourself.
- Hardware keys and tokens: Purchase, inventory, replacement and recovery logistics fall on your team.
- Support subscriptions: Optional vendor or distribution support, such as a commercial Keycloak distribution, is a separate line item you must choose.
- Main budget risk: Key-person dependence. Turnover or delayed upgrades can leave MFA on an unsupported version.
Ask your team to write down every recurring role, then confirm the hours each one needs per month before comparing with a quote.
A partner plans, implements, integrates and documents the MFA platform inside your cloud accounts, data center or air-gapped network, and your staff keep ownership of the systems and data. The partner is paid for defined work under a written, fixed-scope agreement, plus any retainer for ongoing support, upgrades and testing. Infrastructure and licenses stay on your bill.
- Implementation fee: Covers design, deployment, integration per system, testing and handover documentation. It is usually one-time and set by the agreed scope.
- Per-system integration: Each VPN, Windows logon, Linux PAM target and web application is a line item, so the count of systems is the biggest driver.
- Ongoing retainer: Upgrades, monitoring response and continuous testing recur and are priced separately from the build.
- Your infrastructure: Servers, hardware keys and any database licenses remain your costs and your assets.
- Main budget risk: Scope creep. Systems discovered after kickoff, or changes to token types, can alter the quote.
Ask for the written quote to list each integration, each assumption about your environment and which items recur, so you can check that nothing is left out.
A vendor hosts the MFA service and bills per user, device or feature tier under its subscription terms. Your staff configure policies, enroll users and connect applications through the vendor's console and supported connectors. Authentication data and the service itself sit with the vendor, which changes what you control and what evidence you can produce on your own.
- Subscription fees: Recurring charges scale with user count and may vary by tier, add-ons or contract length. Read the vendor's current price list and any minimums.
- Integration effort: Connectors for supported applications are usually quicker to use, but unsupported systems may need custom work or a gateway you run.
- Data and hosting: Confirm where authentication logs and personal data are stored, which regions and subprocessors are involved, and whether you can export logs for your own retention.
- Control: Upgrade timing, feature availability and outage handling follow the vendor's roadmap and service terms.
- Main budget risk: Growth and lock-in. Costs rise with headcount and contractors, and moving tokens or enrollment records to another product can be expensive.
Before signing, ask the vendor for its current price list, its data residency statement and the export format for enrollment and audit records.
Why the license line is rarely the largest MFA cost
The license line is usually the smallest number in a self-hosted MFA budget, because privacyIDEA is licensed under AGPLv3, Keycloak under Apache 2.0 and FreeIPA under GPL-3.0-or-later, and none of these licenses charges per user. FreeIPA is a community project with no paid edition of its own, so a FreeIPA-based design carries no software fee at all. The costs that matter sit elsewhere: servers and a highly available topology, hardware keys, enrollment and help desk time, and the work to connect each VPN, Windows host, Linux fleet and web application to the MFA service. Those costs are the same whether the software is free or not, which is why the license question should come after the scope is written down.
Free licenses do not mean every feature is free. Some vendors keep capabilities in a separate paid tier. The privacyIDEA project states that its Enterprise Edition is available from NetKnights, so confirm which features you need, such as support terms or capabilities outside the community edition, and whether they sit behind that tier. Keycloak is available as the Red Hat build of Keycloak, which Red Hat supports through a subscription, so the question for a regulated buyer becomes whether a supported distribution is worth its recurring cost compared with running the community release under your own patching process. In authentik, code in the authentik/enterprise directory carries a separate enterprise license, so check that the MFA features you plan to use are not in that directory before you assume they are free.
Before you compare totals, ask each vendor or partner to list, in writing, which MFA features, integrations and support levels sit behind each paid tier, and which license applies to each component you will deploy. Ask for the subscription term, what renews each year and what the price covers, such as patches, vulnerability response or named support hours. Then price those lines next to the infrastructure and integration work so the comparison reflects the full cost of ownership, not the license alone.
How to build your own MFA cost estimate
This sequence turns a vague budget question into a costed comparison. Each step produces a written artifact, so a self-hosted build, a partner-run deployment and a per-user SaaS quote can be compared on the same scope.
Inventory systems and user populations
List every system that needs a second factor: VPN concentrators, Windows and Linux logons, SSH and sudo, administrative consoles, and web applications. For each, record how many users reach it, which groups they belong to, and whether it is privileged access. Your security team and application owners do this together. The output is a coverage register with one row per system, and you know it is done when every row names an owner and a user count.
Choose the user store and token mix
Decide where users are authoritative, such as Active Directory, an existing LDAP directory, or FreeIPA, and which token types each group will use: FIDO2 keys or passkeys, TOTP, push, or smartcards. Each token type carries a different hardware and support cost, so this choice drives the rest of the estimate. Ask the platform vendor or implementation partner which user ID resolvers and token types they have tested against your directory. The output is a written decision record listing store, token types and the groups assigned to each.
Size the servers and database for two sites
Estimate the compute, database and load balancing needed for high availability, including a second site if you require one. Keycloak documents that its supported high availability designs require a synchronously replicated database, and FreeIPA recommends at least two to three replicas in each datacenter, so both the server count and the database licensing or hosting model shape the bill. Your infrastructure team prices these from its own rates. The output is a bill of materials with one line per server, database and load balancer, and you know it is done when each line has a recurring cost owner.
List each integration and its test effort
Enumerate every integration point from the inventory: RADIUS for VPNs, the PAM module for Linux, the credential provider for Windows, SAML or OpenID Connect for web applications, and any API calls. Estimate build and test effort per system, and record which integrations need a vendor-specific configuration or a change request to the application owner. Ask the partner to name the integrations it has delivered before and to state which ones it would treat as out of scope. The output is an integration register with one row per system, a test plan reference and an effort estimate in person-days from your own team or the partner's written scope.
Price hardware keys and enrollment support
Count the hardware tokens or security keys required, including spares for lost devices and onboarding of contractors and new hires. Add the enrollment effort: who issues tokens, who verifies identity, who helps users register devices, and how many help desk contacts a typical enrollment will generate. Hardware keys are a one-time purchase per user, but replacement and help desk time recur. Ask suppliers for unit pricing with volume tiers and ask the partner how it handles enrollment at scale. The output is a token and enrollment budget split into one-time and recurring lines.
Add upgrade, support and subscription time
Account for recurring work: platform upgrades, security patches, monitoring, backup testing, and access to vendor or enterprise support if you choose it. Keycloak's release cadence and FreeIPA's security releases mean this work repeats every year, so budget it as a recurring line. Confirm with your platform vendor which support subscriptions are optional and which are needed for production. The output is an annual run-cost schedule that separates staff time from third-party subscriptions.
Compare against partner scope and SaaS quote
Put your self-hosted estimate beside a written partner scope and a per-user SaaS quote, using the same systems, user counts, token mix and years of operation as inputs. Ask the partner for a fixed-scope proposal that lists deliverables, exclusions and handover items, and ask the SaaS vendor for per-user pricing tiers, data residency terms, and charges for each integration. Note what each option leaves with you, such as configuration evidence and exit terms. The output is a side-by-side comparison that you can present to the steering group, and it is done when every line has an identified source.
What do buyers ask about MFA cost, effort and time?
How much does open source MFA cost to run?
The software license is free for the platforms covered here, so the cost is the work and infrastructure around it. The main components are servers and high availability, hardware keys, integration work for each VPN, Windows, Linux and web system, enrollment and help desk effort, and any paid support subscription. Only some of these are one-time. Servers, hosting, staff time for upkeep and support subscriptions recur every year. The privacyIDEA project lists its licensing as AGPLv3 and offers an Enterprise Edition from NetKnights, so ask whether a support subscription is part of the quote. Ask any partner for a line-item quote that separates one-time build, recurring operations and hardware, and state the assumed user count and number of integrated systems.
Can our internal team run open source MFA without outside help?
Often yes, if the team already runs Linux, directory services and certificates, but the answer depends on skills and on-call coverage rather than on the license. An MFA server sits on the login path, so it needs monitoring, backups, patching and a tested failover. For Keycloak, the project plans four minor releases a year and documents a database migration step that administrators must plan around, and the Keycloak Operator documentation recommends manual approval for operator updates. Assess your team against each integration you need, such as RADIUS for VPNs, the Windows credential provider or the Linux PAM module. Partners can cover the first build, the runbooks or ongoing upgrades under a written scope, so ask which parts of the run book stay with your staff.
How long does an open source MFA deployment take?
No duration is fixed by the platform itself. Timing depends on how many systems need a second factor, how many user stores must be connected, how many token types you enable and how much enrollment work your users need. Starting with one or two high-risk paths, such as administrator logons and VPN access, is usually easier to scope than a full estate rollout. Ask any implementation partner for a phased plan with milestones, a list of systems in each phase and the acceptance tests for each. Confirm the timeline in writing against your own change windows, approval cycles and hardware key delivery times, because those often set the pace more than the software.
What does an MFA project need from our internal staff?
Expect demands on identity, network, endpoint and help desk staff, plus a business owner who can approve the user communication plan. Identity staff own the user stores, for example LDAP or Active Directory connections through privacyIDEA's user ID resolvers or FreeIPA. Network staff configure RADIUS for VPNs or the web application integration. Endpoint staff deploy the Windows credential provider or Linux PAM module, and help desk staff take enrollment and lost-token calls. Name a single owner for each system, and ask the partner to list the internal tasks in the scope so these hours are visible before you sign.
Why is SaaS MFA priced per user?
Per-user pricing lets the vendor charge in line with its own cost of running accounts, authentication requests and support for each identity. It also means your total depends on headcount, contractors and service accounts that you may or may not count. Self-hosted open source has no per-user license fee, so cost grows with servers, integrations and support instead of seat count. Compare both models over the same period, using the same user count and the same set of systems. Ask a SaaS vendor how it counts users, whether hardware keys and service accounts are included, and what happens to cost when you add integrations or regions.
What changes the cost of hardware security keys?
The main drivers are the number of users who need a key, the token type you choose and the replacement rate. FIDO2 and WebAuthn keys, PIV smartcards and OATH hardware tokens all work with privacyIDEA, while FreeIPA supports HOTP and TOTP hardware tokens such as YubiKeys. Software tokens and push can lower the initial spend but do not match every phishing-resistance goal, so the choice affects both price and security. Recurring costs include replacements for lost or damaged keys, plus enrollment and help desk time. Ask suppliers for unit prices, volume discounts, shipping times and warranty terms in writing, and ask your partner to show how keys are issued and recovered.
How much does each integration add to the MFA budget?
Each integration adds configuration, testing and change control work, and the effort differs by system type. A VPN through RADIUS, a Windows logon through the credential provider, a Linux PAM setup and a web application through the REST API each need separate test cases and rollback steps. privacyIDEA lists integrations for Linux, Windows, Keycloak, AD FS, Shibboleth, SimpleSAMLphp, OpenVPN, Fortinet, Palo Alto and web applications. Build a register of systems with the integration type, owner, change window and test plan, then ask for a per-system estimate in the quote. Ask whether custom integrations, such as legacy applications without standard protocols, are excluded from the fixed scope.
What support and upgrade costs should we plan for?
Plan for recurring support, patching and upgrade work for every component in the MFA stack, including the database, the reverse proxy and the directory connections. Open source projects release often, so upgrades need testing against your integrations before production. Keycloak, for example, has a release cadence of four minor releases a year, and FreeIPA publishes stabilization releases with security fixes. Decide whether you want a retainer for ongoing upgrades, testing and support, or internal staff to handle these. Ask any partner for the scope of support, response expectations, upgrade testing and how security patches are handled. Retainers are priced from the written scope, so confirm that in the quote.
How DeployOpen scopes and delivers a fixed-scope MFA implementation
DeployOpen works through the cost of self-hosted MFA as a written, fixed scope: which token types, integrations and systems are in, what runs on your infrastructure, and what recurs after go-live. The same scope is used to compare build, partner and SaaS options on a like-for-like basis before any commitment is made.
How we scope
- We list every system, VPN, server group and web app that needs a second factor, so the cost model reflects real integration counts.
- We agree in writing which token types, user stores and high availability design are in scope before work starts.
- Engagements are fixed-scope, so the written scope sets deliverables and timelines, and any change is priced through the same written process.
How we build
- We install and configure the chosen self-hosted MFA platform in your cloud account, data center or air-gapped network.
- We build and test each integration, such as RADIUS, PAM, Windows logon or SAML and OIDC, and record the effort per system.
- We test failure paths, including MFA server outage and help desk recovery, so the cost of resilience is visible before go-live.
How we hand over
- We document the architecture, integration inventory, token enrollment process and recovery runbooks in a form your team can maintain.
- We give you a recurring cost sheet covering infrastructure, hardware tokens, subscriptions and support tiers, so budget owners see what continues after launch.
- We confirm with you which configuration evidence to retain for auditors, including MFA policy settings and enrollment logs.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped separately from the initial implementation.
- We can plan upgrade cycles for the chosen platform and review version changes before they reach production.
- Support terms, response expectations and service levels are written into the retainer, so you can compare them against SaaS contracts.
