Okta Pricing in 2026: Real Costs and a Flat-Rate Way Out
You came here for a number, so here it is up front: Okta’s workforce identity plans start at roughly $6 USD per user per month and run to roughly $17 USD per user per month for the fuller suite, with a $1,500 USD annual contract minimum. All figures are list pricing as published at the time of writing — confirm against your renewal quote, because negotiated rates run lower while the structure stays the same.
| Plan | List price (published list) | What it covers |
|---|---|---|
| Okta Workforce Starter | ~$6 USD/user/month | SSO and core workforce identity |
| Okta Workforce Essentials | ~$17 USD/user/month | Adds adaptive MFA, lifecycle management, and the broader suite |
| Contract minimum | $1,500 USD/year | Applies regardless of headcount |
| Microsoft Entra ID P1 / P2 (for comparison) | $6 / $9 USD/user/month | The main bundled-suite alternative if you’re already on Microsoft 365 |
List pricing as published at the time of writing — confirm against your renewal quote.
Three things follow from that table. The per-user meter never stops. The features most security teams actually need — adaptive MFA, lifecycle automation — sit in the higher tier. And the $1,500 minimum means even a ten-person company can’t pay less than $1,500 a year.
How much does Okta actually cost in 2026?
The headline tier numbers above are bundle prices. The way Okta’s published pricing actually composes — and the way your renewal quote reads once you’ve added MFA and lifecycle — is module by module. List price as of June 2026 per Okta’s pricing page:
| Okta add-on | List price (USD/user/mo) | What it does |
|---|---|---|
| Single Sign-On | $2 | SAML / OIDC federation across your SaaS estate |
| Adaptive MFA | $3 | Risk-based step-up authentication |
| Lifecycle Management | $4 | Provisioning and de-provisioning automation |
| Identity Governance | $9 | Access reviews, certifications, SoD policies |
A 500-employee company that wants what a 2026 security team actually needs — SSO plus Adaptive MFA plus Lifecycle Management plus Identity Governance — is at $2 + $3 + $4 + $9 = $18 USD/user/month. The math: 500 users × $18 × 12 months = $108,000 USD per year at list. Add Universal Directory or API Access Management and the line creeps higher. Negotiated rates pull this down; the structure does not change.
The Okta cost per user that ranks in search — “okta cost per user”, “okta enterprise pricing”, “how much does okta cost” — is almost always quoted as the entry SSO figure ($2/user/mo or the ~$6/user/mo Workforce Starter bundle). That number is real, but it’s not the number that lands on your renewal quote once governance and MFA are in scope. Okta enterprise pricing in practice is the add-on stack — and it’s the add-on stack that pushes past $100K/yr at mid-market headcount.
How Okta costs scale
The per-user model is easy to underestimate because the entry price looks small. Here’s a 300-employee company on the Starter list figure (~$6 USD/user/month), growing a typical 10% a year:
| Year | Employees | Okta cost at list (USD/yr) |
|---|---|---|
| 1 | 300 | $21,600 |
| 2 | 330 | $23,760 |
| 3 | 363 | $26,136 |
| 4 | 399 | $28,728 |
| 5 | 439 | $31,608 |
| Five-year total | $131,832 |
That’s the cheapest tier. On the Essentials figure (~$17 USD/user/month), year one alone is about $61,200, and the five-year total approaches $375,000 — for single sign-on and identity plumbing. Every dollar of the increase is driven by hiring, not by new capability. The managed Keycloak comparison table shows the same math at 1,000 users, next to Auth0 and Entra ID. A feature-by-feature Keycloak vs Okta comparison walks through the same tradeoff for teams still weighing the two platforms.
What is the SSO tax?
“SSO tax” is the industry’s name for two pricing behaviours that compound each other. First, identity is priced per user, so the bill scales with headcount even though the marginal cost of one more login is effectively zero. Second — and this is the part that earned the name — many SaaS vendors gate SAML/SSO support behind their most expensive plans, sometimes at several times the base price, even though SSO is a baseline security control rather than a premium feature.
The practice is well documented: the community-maintained sso.tax “wall of shame” catalogues vendors whose SSO-enabled tiers cost multiples of their standard plans. The result is that doing the secure thing — centralising authentication — costs you twice: once for the identity provider’s per-user fee, and again in upgraded SaaS plans across your stack. Switching identity providers fixes the first cost, not the second; but the first is usually the larger line.
Does Okta have a free tier?
Not for workforce SSO. Okta and its Auth0 arm offer developer-oriented free tiers, but they come with hard caps on monthly active users and are designed for building login into your own application — not for running single sign-on across a company’s SaaS estate. For workforce identity, the $1,500 annual contract minimum is the effective floor. If you’ve seen “free Okta” mentioned, it was almost certainly a developer plan.
The renewal-notice pattern
We won’t dress this up as client case studies — these are composite scenarios, a pattern we hear constantly in first calls.
A startup signs up for Okta at 25 employees, when the bill is small enough that nobody scrutinises it. Eighteen months and two hiring waves later, the renewal arrives at three times the original figure — same product, same configuration, more seats. The finance team asks what changed. The honest answer is: nothing except headcount.
The second version happens at mid-size companies: someone new inherits the IT budget, reads the line items for the first time, and discovers the SSO subscription has quietly grown into one of the largest software lines in the company — comparable to core infrastructure spend. Nobody decided to spend that much on login; the meter just ran.
Neither scenario involves a villain. Per-user pricing is simply a model designed so that your growth becomes the vendor’s revenue, automatically and forever.
Anatomy of a Keycloak migration
The flat-rate alternative is Keycloak — the open-source identity platform behind many commercial offerings — run as a managed service so you get the economics without taking on the operations. Here’s how a typical migration runs for a 200-employee company with 20–30 SSO-enabled apps.
Phase 1: Assessment (Week 1)
- Kickoff call to understand your Okta configuration
- Document all SSO-enabled applications
- Identify custom authentication flows
- Create a migration plan with timeline
Phase 2: Environment setup (Week 2)
- Deploy managed Keycloak in your cloud
- Configure authentication flows
- Set up identity federation (LDAP/AD)
- Prepare user migration
Phase 3: Pilot integration (Week 3)
- Select 3–5 pilot applications
- Integrate with Keycloak (typically under an hour for spec-compliant apps, longer for the quirky ones)
- Test with a pilot user group of 10–20 volunteers
- Iterate and fix issues
Phase 4: Phased migration (Weeks 4–6)
- Week 4: low-risk applications
- Week 5: medium-risk applications
- Week 6: mission-critical applications
Phases 5–6: Cutover and cleanup (Weeks 7–8)
- Final cutover of remaining applications
- Decommission Okta
- Performance tuning, documentation, and training
Total timeline: 7–8 weeks for a typical estate. Throughout, migrations follow a parallel-run model: Okta stays live until every application is verified working on Keycloak, so cutover risk stays near zero and there’s no leap-of-faith moment. Honest variables that stretch the timeline: custom auth flows, non-standard apps, and your own change-management process.
What you’d actually save
We’re deliberately not publishing a savings calculator or a tier table, because both invite false precision. The honest framing is structural: on the hedged list figures above, a 300-person company is paying roughly $21,600–$61,200 USD a year depending on tier, and that number rises with every hire. Managed Keycloak replaces it with flat annual pricing scoped to your environment — applications, federation complexity, compliance requirements — that stays put as you grow. Request a quote and we’ll model the comparison against your actual renewal and hiring plan rather than a brochure example.
For the broader product comparison — features, protocols, where Okta genuinely wins — read Keycloak vs Okta: identity management without per-user fees. And if you’re wondering whether the open-source route holds up elsewhere in the stack, the pattern repeats: open source is eating enterprise security.
Managed Keycloak vs Okta pricing 2026
The structural difference between managed Keycloak and Okta pricing is not the headline number — it’s the multiplier. Okta multiplies per user, per add-on, every year. Managed Keycloak is a flat retainer plus your own cloud infrastructure. Same identity surface; opposite curve.
| Cost driver | Okta Workforce (list) | ThinSky managed Keycloak |
|---|---|---|
| Pricing model | Per user × per add-on, $1,500/yr min | Flat annual retainer + your cloud infra |
| 500 users, full suite (SSO + MFA + Lifecycle + IGA) | ~$108,000 USD/yr at list | Scoped to environment — flat |
| Growth from 500 → 750 users | +50% on the platform line | No change to the retainer |
| Per-app SSO surcharge from your SaaS vendors | Same (downstream of IdP) | Same (downstream of IdP) |
| Audit-evidence pipeline | Built in, sold per tier | Operated by ThinSky, part of the retainer |
The total-cost-of-ownership question most CISOs actually ask is “how does this look in three years.” On Okta at list, a company hiring from 500 to 750 over three years pays roughly $108K → $135K → $162K — over $400K cumulative on the platform line alone. On flat-rate ThinSky managed Keycloak, the retainer holds. Whether Keycloak is cheaper than Okta at your shape comes down to how aggressively your headcount is growing and how many add-ons you actually need — at the full suite past a few hundred users, the flat model wins decisively.
What managed Keycloak hosting includes
Managed Keycloak hosting is the open-source Keycloak platform plus the operational layer it needs to run as production-grade identity infrastructure — in your cloud, with your audit data inside your boundary. The managed Keycloak service from ThinSky covers:
- SSO across OIDC, OAuth 2.0, and SAML 2.0 — spec-compliant tokens, single-sign-out, protocol mappers for every claim shape your apps demand
- MFA in the base distribution — TOTP, WebAuthn / FIDO2, passkeys with conditional UI, recovery codes, step-up auth via ACR-to-LoA, not gated behind an enterprise tier
- LDAP and Active Directory federation — bidirectional sync, attribute mapping, scheduled re-sync, SSL-bound connections
- Identity brokering — Microsoft Entra ID, Google Workspace, GitHub, and arbitrary OIDC / SAML upstreams configured from the admin console
- Lifecycle automation — SCIM connectors to your HRIS so joiners, movers, and leavers happen without a ticket queue
- Audit-evidence pipeline — immutable audit logs, quarterly access reviews, restore drills, evidence mapped to SOC 2 Trust Services Criteria and ISO 27001 Annex A
- HA deployment — three-node cluster in your cloud, Postgres Multi-AZ, Infinispan caches, JGroups discovery, health-gated load balancer
- Senior on-call + monthly posture report — a senior identity engineer on the pager (not a tier-1 queue), with a monthly report on access requests, standing roles, and policy drift
Excluded by default and quoted separately: very large custom RBAC modelling, B2C consumer flows over 100K MAU, and FedRAMP-bounded environment hardening.
When Okta still wins
We’re not pretending Okta is the wrong answer for every shape. It isn’t. The honest read on when Okta enterprise pricing is worth what it costs:
- Very large workforces (10,000+) with deep SaaS sprawl. Okta’s OIN catalogue covers 7,000+ pre-built integrations. If your estate carries 200+ niche SaaS tools with quirky federation, the OIN earns its line item — engineering time to debug spec-compliant integrations one by one is a real cost.
- Regulated industries needing Okta’s specific certifications. Okta carries FedRAMP Moderate authorization on its specific cloud-hosted offering and IRAP at the SaaS layer. If your auditor or examiner guidance names Okta by product, that’s the conversation.
- Workforces already on Okta where lifecycle automation is deeply customised. Migration cost is real. If you’ve built dozens of Workflows orchestrations against the Okta API, switching IdPs is a multi-quarter engineering project — sometimes the renewal cheque is the cheaper line.
- Companies that genuinely don’t notice the per-user bill. If finance treats identity as plumbing and the per-user invoice sits below the noise floor of other spend, the operational simplicity of SaaS-as-a-service is worth the markup.
Where Okta does not win: mid-market companies (200–2,000 employees) where identity is one of the top-five software line items, growth is roughly linear, and the add-on stack has crossed past simple SSO into MFA + lifecycle + governance. That’s the shape that pays back on Okta to Keycloak migration.
Frequently asked questions
How much does Okta cost per user in 2026?
At list pricing as of June 2026 per Okta’s pricing page, Single Sign-On is $2 USD/user/month, Adaptive MFA is $3, Lifecycle Management is $4, and Identity Governance is $9. A 500-user company on the full SSO + MFA + Lifecycle + IGA stack lands at roughly $108,000 USD per year at list, with a $1,500 annual contract minimum that applies regardless of headcount. Negotiated rates run lower; the per-user × per-add-on structure does not change.
Is there a cheaper alternative to Okta enterprise pricing?
Yes — at mid-market headcount with the full add-on stack, flat-rate managed Keycloak is typically cheaper than Okta enterprise pricing by a wide margin. Keycloak has no per-user licence and ships MFA, SAML/OIDC, LDAP federation, and audit logging in the base distribution. The trade-off is operational: someone has to run the JVM, Postgres, and patch cadence. Managed Keycloak from ThinSky covers that operations layer at a flat retainer, so identity stops scaling with hiring.
What is managed Keycloak hosting?
Managed Keycloak hosting is the open-source Keycloak identity platform deployed, tuned, and operated for you in your own cloud account (AWS, Azure, or GCP). The provider runs the HA cluster, patches the platform, rotates certificates, ships audit logs to your SIEM, and holds the on-call pager. You keep the platform in your boundary and own the data; the managed Keycloak service is the labour around it. ThinSky runs this as a flat annual retainer instead of a per-user invoice.
Does the managed Keycloak service include MFA and SAML?
Yes. The managed Keycloak service includes MFA (TOTP, WebAuthn / FIDO2, passkeys with conditional UI, recovery codes, and step-up authentication via ACR-to-LoA mapping) and SAML 2.0 federation in the base distribution — not gated behind an enterprise tier. OIDC and OAuth 2.0 are also first-class, with protocol mappers for every claim shape your apps demand. LDAP and Active Directory federation, identity brokering, and SCIM lifecycle connectors are included alongside.
Can I migrate from Okta to Keycloak without downtime?
Yes — every migration we run is parallel-run, not big-bang. Okta stays live while applications are integrated with Keycloak one at a time, validated by a pilot user group, and cut over per app. There’s no leap-of-faith moment where authentication breaks across the company. A typical 200-employee estate with 20–30 SSO-enabled apps cuts over in 7–8 weeks with zero authentication outages. Honest variables that stretch the timeline: custom auth flows, non-standard apps, and your own change-management process.
How much does Okta cost per user?
At list pricing as published at the time of writing, Okta Workforce Starter runs around $6 USD per user per month and Workforce Essentials around $17 USD per user per month. Negotiated and bundled rates are commonly lower — confirm against your renewal quote. The structural point stands at any discount: the cost scales linearly with headcount.
What is the minimum Okta contract?
Okta’s published terms carry a $1,500 USD annual contract minimum. Even a very small team can’t pay less than that, which makes Okta comparatively expensive at the low end of the headcount curve.
Does Okta have a free tier?
There are developer-oriented free tiers (including via Auth0) with hard caps on monthly active users, intended for building authentication into your own product. There is no free workforce SSO plan — the $1,500 annual minimum is the practical floor for company-wide single sign-on.
What is the SSO tax?
The combined cost of per-user identity pricing plus SaaS vendors gating SSO support behind their most expensive plans. The community-run sso.tax list documents vendors charging large multiples for SSO-enabled tiers. It means centralising authentication — a baseline security control — is priced like a luxury.
How much does managed Keycloak cost compared to Okta?
Keycloak has no per-user licence at all; with ThinSky the cost is flat annual pricing scoped to your environment, so it doesn’t rise as you hire. Whether that beats your Okta number depends on your headcount and tier — at a few hundred users and up, the flat model usually wins decisively. Request a quote for a like-for-like comparison against your renewal.
If you want the comparison grounded in your own numbers, request a quote or email sales@thinsky.com and we’ll model your five-year identity spend at list against a flat-rate managed Keycloak deployment. Not sure what your external identity surface even looks like right now? Start with the free external security audit — it maps what’s exposed before you change anything.