What does SSO really cost: build, partner or SaaS?
The software license is often the smallest line in a workforce SSO budget. The total depends on how many applications need integration, how far the MFA rollout reaches, which directories must be federated, and who operates the identity provider day to day. The open-source editions of Keycloak and authentik are free to download and run, so the cost of a self-built deployment sits in infrastructure, a PostgreSQL database, integration engineering, testing, upgrades and staff time. The authentik pricing page lists an Open Source edition at no charge with community support only, while its Enterprise edition is priced at $5 per user per month billed annually plus $0.02 per external user per month, and the Enterprise tier unlocks features such as Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication and enhanced audit logging. Keycloak's paid route runs through a supported distribution such as Red Hat build of Keycloak, whose pricing you should request directly from Red Hat.
Commercial and SaaS options price in a different way. Okta sells Workforce Identity suites per user per month, billed annually, with a $1,500 annual contract minimum. Microsoft lists Entra ID P1 from $7.00 per user per month and P2 from $10.00 per user per month with annual commitment, and notes that P1 is included in Microsoft 365 E3 and Business Premium. ZITADEL Cloud is priced by daily active users rather than by headcount: its Pro plan lists US$100 per month including 25,000 daily active users, and its Enterprise plan is custom. Because per-user prices multiply across every employee and contractor, the figures scale with headcount, while a self-hosted deployment scales with infrastructure and staff effort. Before comparing, ask each vendor for a written quote that covers the same user count, the same MFA methods, the same directory connectors and the same support level, and confirm which of those items are sold as add-ons.
Build the cost model around four recurring items: the hosting and database, the people who patch and upgrade the platform, the application integrations and the MFA enrollment support for staff. Each one changes the answer. A partner-led rollout moves part of the integration and hardening work into a fixed-scope, written agreement, which makes the one-time cost easier to forecast, but the ongoing operation still needs an owner. Ask any partner to separate one-time work from retainer or support fees, to state who pays for upgrade testing, and to price what happens when a legacy application cannot use SAML or OIDC. DeployOpen does not publish a price list; a quote follows from the written scope.
Which cost components apply to each option
This table compares self-built Keycloak or authentik, a partner-led rollout and a per-user SaaS identity provider across the cost components that drive total spend. Read each row to see whether the cost is one-time or recurring and who pays for it. The main takeaway is that open-source software removes the licence line but not the integration, high availability, MFA rollout or upgrade work.
| Cost component | Self-built (in-house team) | Partner-led rollout | Per-user SaaS identity provider |
|---|---|---|---|
| Software licence | Keycloak (Apache-2.0) and authentik core (MIT) carry no licence fee; paid enterprise features need a subscription | Same open-source licence terms; partner fees cover the work, not the software | Recurring per-user subscription, for example Entra ID P1 from $7.00 per user per month with annual commitment (Microsoft pricing page) |
| Infrastructure and database | Recurring: servers or Kubernetes capacity and a supported database such as PostgreSQL, paid by the client | Often one-time setup plus recurring hosting in the client's own cloud or data center, billed to the client | Included in subscription; vendor hosts the service |
| High availability | Recurring staffing and infrastructure for clustering and a synchronously replicated database; in-house team pays | One-time design and testing; recurring run costs remain with the client | Vendor-operated; confirm availability terms and any higher-tier pricing |
| Application integration (SAML, OIDC, LDAP) | One-time build by internal staff for each application, then recurring maintenance when apps change | One-time fixed-scope work per application, agreed in writing before work starts | Vendor provides connectors; custom or legacy apps still need client or partner effort |
| Directory federation (AD, LDAP, HR source) | One-time configuration plus recurring sync troubleshooting, paid by internal staff | One-time integration and testing; quote follows the written scope | Entra ID and Google Workspace connectors may sit in a higher tier; confirm in the quote |
| MFA and passkey rollout | One-time policy design plus recurring help desk enrollment support | One-time enrollment campaign and training, often with recurring help desk handoff | Feature availability varies by plan; confirm passkey and MFA options included |
| Upgrades and patching | Recurring: staff time to test and apply minor and security releases, plus operator or chart updates | Optional retainer for upgrades and testing, billed as recurring support | Vendor applies updates; client pays for change windows and regression checks on its apps |
| Support and security fixes | Recurring internal on-call; community channels only for open-source editions | Retainer or ticketed support, agreed in writing; confirm response terms | Vendor support tiers; authentik Enterprise support is ticket-based for subscriptions over $1k |
| Paid open-source editions | Usually not needed for basic SSO; required only if enterprise features such as audit logging are wanted | Subscription passed through or quoted separately; confirm who holds the contract | Not applicable; the per-user rate is the subscription |
What moves the SSO cost up or down
Workforce SSO cost is set less by the software license than by how many applications, users, directories and upgrades your team must carry. Each driver below shifts the balance between building in-house, paying a partner, or buying a per-user identity service, so check them against your own environment before you request quotes.
Applications and protocols
Every application needs its own client configuration, claim mapping and test cycle. Applications that support OpenID Connect or SAML are mostly configuration work, while legacy applications that accept neither may need a proxy, a connector or custom code. Those adapters are usually the largest unplanned item in a build, and a partner will price them as separate work. Inventory each application by protocol and owner before you choose an option, and ask every bidder to price legacy integrations on their own line.
User count and external users
Per-user SaaS pricing scales with headcount, so a large workforce makes a subscription grow in step with every hire. Okta sells Workforce Identity suites per user per month with a $1,500 annual contract minimum, and Microsoft lists Entra ID P1 from $7.00 per user per month with annual commitment. A self-hosted Keycloak or authentik deployment has no per-user license, but its hosting and support cost grows with load. Separate staff from contractors and partners, since external users are often priced differently, for example under authentik's Enterprise edition.
Directory sources to federate
Each directory you connect, such as Active Directory, LDAP, FreeIPA or a second identity provider, adds a sync job, attribute mapping and failure mode to test. Keycloak supports LDAP and Active Directory user federation, and authentik lists LDAP and Entra ID providers, but some connectors sit behind enterprise terms. Ask the vendor or partner which connectors are included in the open-source edition and which need a paid subscription. A single authoritative source reduces both build hours and ongoing reconciliation work.
High availability and database choice
Production SSO needs a clustered deployment and a database that replicates synchronously, so the database is often the largest recurring infrastructure line. Keycloak lists supported production databases including PostgreSQL 14 to 18, MySQL, MariaDB, SQL Server and Oracle, and both of its supported high availability designs need synchronous replication. Managed database services change who runs backups and patching. Authentik's 2025.10 release removed Redis and moved its caching and sessions to PostgreSQL, and that release warned of roughly 50% more PostgreSQL connections after upgrading. Size the database for that load before you price the hosting.
MFA and passkey policy
The FTC Safeguards Rule at 16 CFR 314.4 requires covered financial institutions to use multi-factor authentication for any individual accessing an information system, so MFA scope is a compliance decision with a cost attached. Passkeys based on FIDO2 and WebAuthn are supported by ZITADEL and Keycloak, and they reduce help-desk resets but need enrollment support and device policy. Enrollment, recovery and hardware token purchases are one-time costs, while SMS or push fees recur. Ask partners to price MFA enrollment for every staff group as a separate phase.
Upgrade cadence and support
Upgrades are the recurring cost most often underestimated in a self-built SSO. Keycloak plans four minor releases a year, and its project says breaking changes in a minor release are opt-in, which still means a test cycle on every release. The Operator documentation recommends manual approval mode for updates, so someone must review each one. Ask whether the quote includes a fixed number of upgrades per year, staging tests, and security patch response, or whether those are billed as separate retainer work. Authentik's security policy also lists which versions receive fixes, so track the support window in your plan.
How per-user subscription prices scale with headcount
Per-user pricing grows in a straight line with every person and every external account you add, so the first model to build is a headcount band table. Start with workforce users, then add contractors, partners and other external identities separately, because they are often billed differently. authentik's Enterprise edition lists $5 per user per month billed annually plus $0.02 per external user per month, so a large partner population can change the math more than the employee count does. Okta's Workforce Identity suites are billed per user per month with a $1,500 annual contract minimum, which means small deployments pay a floor and large ones pay the per-seat rate. Microsoft's Entra ID P1 starts at $7.00 per user per month and P2 at $10.00 per user per month with annual commitment, and those figures should be rechecked against your agreement and currency.
Daily active user pricing works differently. Zitadel Cloud's Pro plan lists US$100 per month including 25,000 daily active users, and its Free plan covers 100 daily active users at US$0. Ask how daily active users are counted, how weekends and seasonal peaks are treated, and whether overage is billed. A workforce that logs in every day will use far more of that allowance than a population of occasional users with the same headcount. Also ask whether the SaaS vendor bills service accounts and machine identities as users.
Tier placement is the other driver. authentik keeps Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management and enhanced audit logging in the Enterprise edition, so a plan that needs any of these must be priced at that tier from day one. Confirm with each vendor which features sit in which tier, and get the answer in writing. Then model at least three headcount bands, including the external user count and the feature tier each band requires, and compare the results with the self-hosted cost of infrastructure, database and staff time over the same period.
How to build your own SSO cost estimate
This sequence turns vague SSO budget talk into a written, comparable scope that covers the build, partner and SaaS options on the same footing. Each step produces an input that the next one depends on.
Inventory applications and their login protocols
Your IT team lists every application that needs workforce login, noting whether each supports SAML 2.0, OpenID Connect, OAuth 2.0, LDAP or only local passwords. Count the applications that cannot do SSO at all, because each one adds integration work or a separate control. The output is a single register with one row per application, its protocol, its owner and its integration method. You know it is done when the application owners have signed off on their rows.
Count workforce and external users
HR and identity administrators count employees, contractors, partners and other external users who will sign in, and separate them by directory source and by how often they change. Ask each identity platform vendor or partner how it prices by internal user, external user and daily active user, since the models differ. The output is a headcount table with growth assumptions for the contract period. You know it is done when the counts match the HR system of record and the pricing basis for each category is written down.
Choose the database and high availability design
Your platform team selects a supported production database and decides how the identity provider will run across failure domains. For Keycloak, the supported databases and the high availability designs are documented in the project guides, and both supported designs need a synchronously replicated database. For authentik, the deployment uses PostgreSQL alongside server and worker containers. For ZITADEL, PostgreSQL 14 through 18 is supported. Ask for the database hosting, backup, replication and operator time as separate line items. You know it is done when a written architecture diagram exists and each component has an owner.
List directories and MFA methods
Identity engineers document which directories must be federated, such as Active Directory, LDAP, Entra ID or Google Workspace, and which MFA methods are required for each user group, including passkeys and privileged accounts. Note that some features, such as Google Workspace and Entra ID integrations in authentik's Enterprise edition, sit behind paid licenses, so the directory list directly affects the software cost. You know it is done when each directory and MFA method is mapped to a platform capability and any gap is recorded as a scope item.
Price the software licence options
Finance and security leads compare the licence models using only the supplied vendor prices and terms. Keycloak and the core of authentik are open source with no per-user licence fee, though authentik's enterprise directory carries a separate license. authentik's pricing page lists Enterprise at $5 per user per month billed annually plus $0.02 per external user per month, and Enterprise Plus from $20k annually. Okta lists Workforce Identity suites per user per month with a $1,500 annual contract minimum, Microsoft lists Entra ID P1 from $7.00 and P2 from $10.00 per user per month with annual commitment, and Zitadel Cloud lists a Free plan, a Pro plan at US$100 per month including 25,000 daily active users, and custom Enterprise pricing. Multiply each price by your headcount and external user counts to see how cost scales. You know it is done when each option has a yearly licence figure on the same user count.
Scope integration and rollout effort
Your partner or internal team estimates the work to integrate each application, configure MFA enrollment, migrate users, and test failover. Ask for effort as a scoped line per application type and per phase rather than a single lump sum. Include testing of upgrades, since Keycloak plans four minor releases a year and the operator documentation recommends manual approval for updates. Hypothetical example, for illustration only: 40 applications in three integration types would be priced as three rate lines plus a testing line. You know it is done when every application in the register maps to a scope line with an acceptance test.
Add annual upgrade, support and hosting costs
Plan the recurring costs that continue after go-live: infrastructure and database hosting, security patching, version upgrades, monitoring, on-call support, and any paid support or enterprise subscription. Ask partners to state whether support is a fixed retainer or billed by incident, and whether upgrade testing is included. Note that the authentik 2025.10 release removed Redis and warned of more PostgreSQL connections after upgrading, which is the kind of change that needs testing time. You know it is done when a twelve-month recurring cost table exists, separate from the one-time build cost.
Request written quotes and compare on the same scope
Send the same written scope, with the application register, user counts, database and high availability design, directory list and MFA requirements, to each partner and to each SaaS vendor. Ask every bidder to itemize one-time and recurring costs, assumptions, exclusions and the terms for changes. Compare the build, partner-led and SaaS options side by side using identical user counts and scope. DeployOpen works from a written, fixed scope, and quotes follow from that scope. You know it is done when all three options are costed against one scope document and the differences trace back to named assumptions.
When each delivery option makes sense
Building in-house means your own engineers install, configure, integrate and operate Keycloak or authentik inside your infrastructure. This fits organizations that already run identity, Kubernetes or database platforms with staff who understand OpenID Connect, SAML and directory federation, and that want full control over upgrades, data location and configuration history. The buyer carries the design, the build and every operational task afterward.
- Infrastructure and database: You provision the hosts or cluster, the production database (PostgreSQL, for example, which both Keycloak and authentik rely on in supported setups) and the backup and restore path.
- Application integration: Your team writes and tests each client configuration, including SAML metadata exchanges and claim mappings for every application.
- Upgrade testing: Keycloak plans four minor releases a year, and authentik publishes security fixes only for named version lines, so someone must schedule and test each upgrade in a non-production environment.
- Patching and on-call: Security fixes, database maintenance and identity outages become your incidents, which needs a rota and a documented fallback.
- Skills retention: Knowledge often sits with one or two people, so plan for cover and documentation.
Before choosing this option, confirm that the team has named owners for each of these tasks and that leadership accepts the on-call load.
A partner-led rollout keeps the platform inside your infrastructure while an implementation partner plans, deploys, integrates, hardens and documents it under a written scope. This fits organizations that want self-hosted control but lack identity engineers for the initial build, or that need a defined handover before taking operations in-house. DeployOpen works this way on fixed-scope engagements, and ongoing support or upgrades can be bought separately as retainers.
- Scope and deliverables: The written scope defines the applications, protocols, directories and high availability design, which is the main lever on the quote.
- Knowledge transfer: Ask what documentation, runbooks and admin training are delivered, and who owns each configuration export.
- Obligations that remain with you: Your organization still owns the accounts, the data, access decisions and the business sign-off on policies.
- Ongoing operations: Decide whether patching, upgrades and on-call stay with you or move to a retainer, because these recur after the project ends.
- Handover risk: Without a planned handover, the rollout can end with a system only the partner can operate.
Before signing, ask for the written handover plan and the upgrade process the partner will follow after go-live.
A per-user SaaS identity provider moves hosting, patching and most upgrade work to the vendor, and charges by user or by active user. This fits organizations that prefer to buy operations, have no appetite for running identity infrastructure, or accept the vendor's hosting regions and data terms. The trade-off is that subscription costs recur and scale with headcount, and some controls depend on the vendor's roadmap and tier.
- Pricing model: Okta bills Workforce Identity per user per month, annually, with a $1,500 annual contract minimum. Microsoft lists Entra ID P1 from $7.00 and P2 from $10.00 per user per month with annual commitment, and notes P1 is included in Microsoft 365 E3 and Business Premium.
- Feature tiers: Confirm which MFA, passkey, provisioning and audit features sit in the tier you price.
- Integration effort: Application integration still needs your engineers or a partner, even when the platform is managed.
- Data and region: Confirm where identity data is stored and what happens to it on exit.
- Lock-in: Ask how configurations and user data can be exported.
Before committing, model the per-user price against your actual headcount, including contractors and service accounts, and confirm the tier that includes your required controls.
SSO cost questions buyers ask before hiring help
How much effort does a self-built Keycloak or authentik deployment take?
Effort depends mostly on how many applications need login, which protocols they use, and how much of the identity stack your team will run after go-live. Basic setup of either product is quick to try, but production work adds a database, a highly available topology, backups, monitoring, certificates, and an upgrade process. The Keycloak database guide lists supported production databases such as PostgreSQL 14 to 18, and the high availability overview says both supported multi-cluster designs need a synchronously replicated database. Each application integration is a separate task with its own testing. Ask any partner to break the estimate into platform build, integrations, MFA rollout, and run support, so you can see where your own staff will spend time.
Is the open-source edition enough, or do we need an enterprise subscription?
For many workforce deployments, the open-source edition covers the core need. Keycloak is Apache-2.0 licensed and supports OpenID Connect, OAuth 2.0, SAML 2.0, user federation, and an admin console. authentik publishes most of its code under MIT, but its enterprise directory carries a separate license. The authentik pricing page lists Enterprise at $5 per user per month billed annually plus $0.02 per external user per month, and places Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history, and enhanced audit logging in the enterprise tier. Confirm whether your directory, audit, or privileged access needs fall in that list, and confirm the current terms with the vendor before budgeting.
How long does an SSO rollout take, and what changes the timeline?
The timeline follows scope, so no typical duration can be stated from the facts available here. The main drivers are the number of applications, how many of them support SAML or OIDC natively, how many directories must be federated, the MFA and passkey policy, and whether high availability is required from day one. Legacy applications without standard protocols often need extra work and extend the schedule. Ask a partner for a phased plan in which each phase lists the applications, the testing approach, and the cutover method, and confirm the duration in the written scope before work starts. DeployOpen engagements are typically fixed-scope, with scope, deliverables and timelines agreed in writing.
What does the work need from our own team?
Your team typically supplies decisions and access, not just time. Expect to provide directory owners, application owners who can test login and logout, a security approver for the MFA and session policy, and someone who can operate cloud or data center infrastructure. Your team also needs to own the business processes around the identity provider, such as joiner and leaver steps and account recovery. Ask the partner to list each role, the hours or meetings expected from it, and the points where work pauses until your team responds. Missing owners are one of the most common causes of schedule slippage, so agree on named people before kickoff.
Can our team run Keycloak or authentik ourselves after launch?
Yes, if you can staff the operating work, and the work is recurring. The Keycloak project plans four minor releases a year and says breaking changes in a minor release will be opt-in, but you still need a tested upgrade path. The Keycloak Operator documentation strongly recommends manual approval mode for operator updates to avoid unintended automatic upgrades. authentik supports only specific release lines for security fixes, such as 2026.5.x and 2026.8.x, and announces security releases at least 24 hours in advance, so someone must watch for them. Plan for monitoring, backups, certificate renewal, and patch testing. Ask a partner to separate one-time build costs from a run or retainer model, and to state what is included in each.
What should a partner quote for an SSO project include?
A useful quote lists the scope in writing, with each item tied to a deliverable. Ask for these parts separately:
- Architecture and environment setup, including the database, high availability design, and backups
- Application integrations, with a count and protocol for each application
- MFA and passkey rollout, including enrollment support for staff
- Directory federation, provisioning, and deprovisioning tests
- Upgrade and security patch process, with testing before production
- Documentation, configuration exports, and handover
- Support or retainer terms, including what happens when the identity provider is unavailable
Also ask which costs are one-time, which recur, and which third-party licenses or subscriptions sit outside the partner's fee. DeployOpen does not publish a price list, and a quote follows from the written scope.
How DeployOpen scopes and delivers a fixed-scope SSO implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted identity platforms inside your own cloud accounts, data centers or air-gapped networks. For SSO cost decisions, we help you put a written price basis around the infrastructure, integration, MFA and support work so the build, partner or SaaS comparison rests on the same scope.
How we scope
- Written scope lists the applications, protocols, directories and MFA methods that drive the cost comparison.
- We separate one-time build work from recurring infrastructure, database, upgrade and support costs in the scope.
- Quotes follow from the agreed written scope, so you can compare self-built, partner-led and SaaS options fairly.
How we build
- We deploy Keycloak, authentik or ZITADEL in your environment on the database and high availability design you choose.
- We integrate each application and document its protocol, claim mapping and fallback path as part of the build.
- We roll out MFA enrollment in phases and record any paid open-source edition features the design depends on.
How we hand over
- Handover includes configuration exports, runbooks for upgrades and backups, and a list of recurring cost drivers.
- We document the licence terms of each component, including where enterprise directories or features need a paid edition.
- Your staff receive working sessions so they can run identity operations after the engagement closes.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the build.
- Upgrade plans are tested in a non-production environment before a production change is approved.
- Confirm with us in writing which support hours, response commitments and escalation paths apply to your scope.
