The Okta Bill Shock Phenomenon
There's a special kind of panic that happens in finance departments across North America every year. It's called "the Okta renewal notice."
Story 1: The Series A Startup
Company: Fintech startup, 18 months post-Series A
Size at Okta signup: 25 employees
Size at renewal: 85 employees
Original annual cost: $1,500
Renewal cost: $5,100
"We signed up for Okta when we were tiny," their CTO explained. "$1,500 for 25 people? Fine.
Fast forward 18 months. We get the renewal notice: $5,100 for next year.
I calculated it out. At our current growth rate, in four years we'll have 800 employees. That's $48,000 per year. For login."
Story 2: The Accidental Enterprise
Company: B2B SaaS, content management platform
Size: 420 employees
Annual Okta cost: $35,280
Annual SSO cost for 420 employees — more than entire Atlassian suite
The Email: "I just got promoted to head of IT. I just found out: $35,280 per year for SSO.
That's more than our entire Atlassian suite, all our cloud infrastructure, and my salary.
This can't be right. Please tell me this isn't normal."
Anatomy of a Keycloak Migration
Let's walk through exactly how a typical Okta-to-Keycloak migration works. This represents a "typical" 200-employee company with 20-30 SSO-enabled apps.
Phase 1: Assessment (Week 1)
- Kickoff call to understand Okta configuration
- Document all SSO-enabled applications
- Identify custom authentication flows
- Create migration plan with timeline
Phase 2: Environment Setup (Week 2)
- Deploy Managed Keycloak in your cloud
- Configure authentication flows
- Set up identity federation
- Prepare user migration
Phase 3: Pilot Integration (Week 3)
- Select 3-5 pilot applications
- Integrate with Keycloak (1-2 hours each)
- Test with pilot user group (10-20 volunteers)
- Iterate and fix any issues
Phase 4: Phased Migration (Weeks 4-6)
- Week 4: Low-risk applications (10-15 apps)
- Week 5: Medium-risk applications (10-15 apps)
- Week 6: Mission-critical applications (5-10 apps)
Phase 5-6: Cutover and Cleanup (Weeks 7-8)
- Final cutover of remaining applications
- Decommission Okta
- Performance tuning and optimization
- Documentation and training
The 70% Savings Breakdown
Let's do detailed math on where the 70% savings comes from.
Example: 300-Employee Company
Current Okta Setup:
- Tier: Workforce Identity (standard tier)
- Price: $5 USD/user/month = $60 USD/user/year
- Users: 300
- Annual Cost: $18,000 USD ($24,300 CAD)
ThinSky Managed Keycloak:
- Tier: Professional
- Price: $6,000 CAD/year (flat, unlimited users)
Savings for 300-employee company: $18,300 CAD annually
Five-Year Total Cost of Ownership
Assuming 10% annual growth in employees:
| Year | Employees | Okta Cost | Keycloak Cost | Savings |
|---|---|---|---|---|
| 1 | 300 | $24,300 | $6,000 | $18,300 |
| 2 | 330 | $26,730 | $6,000 | $20,730 |
| 3 | 363 | $29,403 | $6,000 | $23,403 |
| 4 | 399 | $32,343 | $8,000 | $24,343 |
| 5 | 439 | $35,577 | $8,000 | $27,577 |
| Total | $148,353 | $34,000 | $114,353 |
Five-year savings with ThinSky Managed Keycloak
Enterprise Features Without Enterprise Costs
"But what about advanced features? Surely Keycloak can't match Okta's Enterprise tier?"
Surprise: It can. And in some areas, it exceeds it.
Feature Comparison
- Multi-Factor Authentication: Keycloak includes all MFA types at all tiers (hardware tokens, biometric, etc.)
- Adaptive Authentication: Keycloak has conditional authentication flows built-in, Okta requires Enterprise tier
- API Rate Limits: Keycloak has unlimited API calls, Okta limits by tier
- Custom Branding: Keycloak offers full HTML/CSS control, Okta is limited even at Enterprise
- Fine-Grained Authorization: Keycloak has User-Managed Access (UMA) built-in
Your Personal Savings Calculator
ThinSky Managed Keycloak Pricing:
- 1-200 users: $2,500 CAD/year
- 201-500 users: $6,000 CAD/year
- 501-1,000 users: $10,000 CAD/year
- 1,001-2,000 users: $15,000 CAD/year
Conclusion
Okta is a fine product. But you're not paying for the product; you're paying for their business model. And their business model is designed to extract maximum value from your growth.
The Numbers Don't Lie
- 70-90% cost savings depending on your size
- Zero per-user fees — grow freely
- Enterprise features at small business prices
- Better customization than commercial alternatives
- No vendor lock-in
Calculate Your SSO Savings
Let's calculate your exact savings and create a personalized migration roadmap. No sales pressure. No commitment. Just math.