Migration cost out of an IdP.
Switching identity providers is one of the most expensive change-management projects in enterprise IT. It is also one of the least publishable: nobody discloses what they paid to leave Okta, integrator rates vary several-fold by market and firm, and two deployments of identical size can differ by an order of magnitude depending on how much custom logic sits in the authentication path.
So this page gives you the drivers and the units, not a price. Put your own blended day rate against the effort below and you get a number you can defend in a business case. A category average would be easier to read and would not survive contact with your actual estate.
Whatever the total, it is rarely modelled at procurement time. Most IdP RFPs focus on per-user pricing and feature parity; exit cost surfaces at renewal, which is exactly when the buyer's leverage is gone. Sizing it up front changes the evaluation.
1.What you are actually paying for
Six work items. Count the units in your own estate, apply your own rate.
Per-app SAML reconfiguration — count your apps, split by type. Every application integrated with the old IdP is reconfigured against the new one. A catalogue SaaS app (Salesforce, ServiceNow, GitHub) is a short, well-trodden task measured in hours. A custom or legacy app with bespoke attribute mapping, signing requirements or a hand-rolled SAML implementation is measured in days. The split between those two categories drives this line far more than the total app count does, so count them separately rather than multiplying everything by an average.
SCIM connector rebuilds — count your connectors. Provisioning automation is rebuilt against the new IdP. Connectors that exist in the target's catalogue are configuration. Connectors that do not, typically for older or in-house applications, are engineering work with test cycles attached.
MFA re-enrolment — headcount, not engineering. Most factor enrolments do not transfer between IdPs, so users re-enrol. The cost is communication, a helpdesk surge concentrated in the cutover window, and the long tail of edge cases: people on leave, shared accounts, contractors, anyone whose factor is tied to a device they no longer have. Size it from headcount and your helpdesk cost per contact.
Custom automation rebuild — the swing factor. Okta Workflows, Auth0 Rules and Actions, and Entra Conditional Access policies do not port. They are re-authored from intent in the target's framework, then tested against the paths they guard. This is the line that separates a routine migration from an expensive one, and it does not correlate with company size — a 200-person company with fifty Actions is a harder migration than a 2,000-person company running stock SAML. Audit how much logic lives in the authentication path before you scope anything else.
Historical log export — volume, retention, destination. Compliance frameworks commonly require retaining identity audit logs for years after the event. The old IdP's logs have to come out before the tenant is decommissioned, and land somewhere queryable. Size from your event volume and retention obligation. Note the constraint this runs into: several IdPs cap retention short (Okta 90 days, Auth0 5 days on B2B Essentials), so if you have not already been streaming logs out, the history you are obliged to keep may simply not exist to export.
Internal change management — the line that gets left out. Security review, vendor SOW, project management, internal comms, and the productivity cost of the cutover itself. It is routinely omitted from business cases and routinely material.
2.Relative difficulty by source IdP
What makes one exit harder than another is how much of your identity logic is expressed in something proprietary. The column that matters is the third one: count those units in your estate and you have your scope. We give no dollar ranges here because no vendor, integrator or analyst publishes them, and a made-up range would look like research.
| From | Relative difficulty | What to count before you scope |
|---|---|---|
| Auth0 | Hardest | Rules and Actions in the auth pipeline; custom B2C login, signup and consent flows |
| Ping Identity | Hardest if on-prem | PingFederate adapters, custom token mappings, on-prem directory integrations. Cloud-only PingOne is ordinary |
| Okta | Hard | Workflows automations, custom SAML app integrations, SCIM connectors outside the target catalogue |
| Entra ID | Moderate | Conditional Access policies (no one-to-one equivalent elsewhere) and Microsoft-catalogue app provisioning |
| JumpCloud | Moderate | MDM policies, device-bound identity, Go passwordless enrolments. The app layer is standards-based and easy |
| OneLogin | Simpler | App count and connector count. Smart Hooks and custom REST connectors are the only bespoke parts |
| Duo | Simpler | Headcount for MFA re-enrolment; any device-health posture policies |
| Authentik | Simplest | Custom flows built in Authentik's flow engine. Stock flows make this close to pure reconfiguration |
3.How to reduce migration cost on exit
- Use standards-based protocols (SAML, OIDC, SCIM) where possible. Avoid IdP-proprietary automation frameworks for production critical paths.
- Document custom Workflows / Rules / Actions thoroughly. Migration cost compounds when nobody on the team can explain what the custom automation does.
- For audit retention, export logs to your own SIEM / data warehouse (Splunk, Datadog, Snowflake) rather than relying solely on IdP retention. This decouples audit retention from IdP choice.
- Negotiate contract length deliberately. A one-year term lets you leave without penalty; a multi-year term is where discounts live but it fixes your exit window. No IdP in this cohort publishes a discount schedule, so treat the trade between term and price as something to quote explicitly rather than assume.
4.Log retention, and why it is usually not a tier upgrade
Default identity log retention is short, and shorter than most buyers assume. Auth0 is 5 days on B2B Essentials, 10 on Professional and 30 only on Enterprise. Entra ID is 7 days on Free and 30 on P1 and P2. Okta is 90 days on every tier. JumpCloud sells audit logging as a separate Directory Insights module at $3/user/mo. Compliance frameworks routinely expect years.
The intuitive fix is to buy a bigger plan, and for the two largest IdPs here that option does not exist. Okta does not sell a retention extension at any tier: its own guidance is to export from the System Log via the UI or API, or stream events to a third-party SIEM. Auth0 likewise points to log streaming once you exceed your plan's window. Entra can hold logs longer, but by routing them into a Log Analytics workspace that bills as Azure consumption rather than as an identity licence.
So for most of this cohort there are two real options, not three. Build a log pipeline into your own SIEM or warehouse and carry the engineering and storage cost yourself, sized by your event volume and retention obligation. Or accept the gap, which is the most common choice and the one that surfaces at the worst possible moment. Two consequences worth planning for: retention has to be solved on day one rather than at first audit, because logs already aged out cannot be recovered, and any historical logs you are obliged to keep must be exported before you decommission an old tenant.