idpcost.com
Memo
To: IT / Security buyer evaluating OneLogin
From
idpcost.com
Re
OneLogin end-to-end cost analysis
Source
https://www.onelogin.com/pricing

OneLogin

live verifiedOne Identity · Per-user tiered (Basic $3, Essentials $6, Business $10, Enterprise quote). No annual minimum stated on the page.

Now owned by One Identity. Unlimited SAML and OIDC SSO is included in every tier — even Basic at $3/user/mo — so there is no SAML tax; MFA is available across tiers but requires an SSO plan as a prerequisite. Cheaper than Okta at the entry point and supports passkeys (WebAuthn including device-bound, synced, and cross-device passkey flows).

1.Year-1 TCO breakdown

Representative buyer: 200 employees, 30 SaaS apps, full SAML + MFA + lifecycle automation, 90-day audit retention.

Licensing (200 seats)200 seats × $10/mo (Business — adds SmartFactor, advanced directory, lifecycle for 30 apps) × 12 = $24,000/yr. Basic at $3/mo covers SSO + MFA but caps identity lifecycle at 5 apps (≈$7,200/yr).
SAML taxNo SAML tax. Unlimited SAML and OIDC SSO is included in every tier, starting at Basic ($3/user/mo); MFA is available across tiers but requires an SSO plan as a prerequisite.
Audit retentionAudit logging available across tiers; included in Business.
MFAIncluded with SSO across tiers.
Year-1 TCO~$24K Year-1 TCO for 200 employees on Business; ~$7K on Basic if the 5-app lifecycle cap is acceptable.

2.The hidden cost category for this IdP

Hidden cost

Post-acquisition uncertainty is the structural risk. One Identity acquired OneLogin in 2021; OneLogin remains a distinct product but roadmap clarity has been thin. Some functionality has been deprioritised in favour of One Identity's broader IGA suite. The hidden cost: buyers committing to OneLogin in 2026 face roadmap risk that could force migration in 2027-2028.

3.Migration cost out of OneLogin

Among the simpler exits in this cohort. OneLogin's SAML and SCIM implementations are standards-based and it has no proprietary automation engine equivalent to Okta Workflows or Auth0 Actions, so what moves is app reconfiguration and provisioning rebuild rather than re-authored custom logic. Smart Hooks and custom REST connectors, if you use them on the Business tier, are the exception and do need rewriting. Scope by app count and connector count.

4.The negotiation lever

Term, and the tier cliff. The published ladder has a sharp step at lifecycle: Basic at $3 caps identity lifecycle at 5 apps, and clearing that cap means Essentials at $6 — a doubling driven by one limit rather than by breadth of need. Count the apps you actually need provisioned before accepting the step. On price itself, OneLogin publishes list rates but no discount schedule, so multi-year commitments are the lever and any percentage should be tied to a named tier and term in writing.

5.Vendor tier reference

TierPer-user (USD/mo)Features
Basic$3Unlimited SAML/OIDC SSO + MFA; identity lifecycle limited to 5 apps
Essentials$6Adds advanced directory + broader lifecycle automation
Business$10Adds SmartFactor auth, custom branding, advanced policies
EnterpriseQuoteQuote-only — Desktop MFA, threat-aware MFA, custom SLA

Source: https://www.onelogin.com/pricing · Verified 2026-09-30 · For vendor-published comparison view: idppricing.com/idp/onelogin/

Other IdPs: Okta Workforce Identity · Microsoft Entra ID · JumpCloud · Auth0 · Ping Identity · Duo (Cisco) · Authentik