3-year IdP TCO.
IdP procurement decisions are typically 3-year commitments — integration cost amortises over multiple years, enterprise contracts run 24-36 months, and migration cost on exit is meaningful. Year-1 licensing is the floor of what you commit to, not the total.
The tables below are arithmetic, not a forecast. Each figure is the vendor's published rate multiplied by seats and months, and nothing else: no assumed escalation, no assumed tier upgrade, no padding. Every published rate here was re-fetched from the vendor's own pricing page on 30 September 2026. What actually moves a real 3-year bill is listed in section 2, unpriced, because none of it is predictable from list rates and we are not going to invent a multiplier for it.
1.3-year cost at published rates
Three buyer profiles. All figures USD, all at annual-billing rates, all computed as seats × rate × 36 months. Treat them as the baseline you would pay if nothing changed for three years, which it will.
SMB profile · 50 employees · 15 apps
| IdP | Year-1 | 3-year cumulative | Notes |
|---|---|---|---|
| Entra ID Free (M365 already held) | $0 | $0 | SSO to SaaS apps is included with any M365 subscription |
| JumpCloud SSO package | $6,600 | $19,800 | $11 × 50 × 12. SSO + MFA + password manager |
| JumpCloud 4-module stack | $7,200 | $21,600 | $12 × 50 × 12. SSO + MFA + Cloud Directory + Lifecycle, $3 each |
| Okta Core Essentials | $8,400 | $25,200 | $14 × 50 × 12, comfortably clear of the $1,500/yr minimum |
| Authentik Open Source | $0 | $0 | Licensing only. You carry the hosting and the operational load |
Mid-market profile · 200 employees · 30 apps
| IdP | Year-1 | 3-year cumulative | Notes |
|---|---|---|---|
| Entra ID P1 (added on) | $16,800 | $50,400 | $7 × 200 × 12. $0 if already on M365 E3 or Business Premium |
| Entra ID P2 (added on) | $24,000 | $72,000 | $10 × 200 × 12. $0 if already on M365 E5 |
| JumpCloud SSO package | $26,400 | $79,200 | $11 × 200 × 12 |
| Okta Core Essentials | $33,600 | $100,800 | $14 × 200 × 12 |
| Okta Essentials | $40,800 | $122,400 | $17 × 200 × 12. Shown so the tier step is visible rather than assumed |
| Auth0 B2B Essentials | $1,800+ | $5,400+ | $150/mo floor at 500 MAU. Not seat-priced, so this is a floor and not comparable to the rows above |
Enterprise profile · 1,500 employees · 60 apps
| IdP | Year-1 | 3-year cumulative | Notes |
|---|---|---|---|
| Entra ID P2 (M365 E5 already held) | $0 | $0 | If E5 is already the standard, P2 is paid for |
| Entra ID P2 standalone | $180,000 | $540,000 | $10 × 1,500 × 12 |
| Okta Core Essentials | $252,000 | $756,000 | $14 × 1,500 × 12 |
| Okta Essentials | $306,000 | $918,000 | $17 × 1,500 × 12. Okta's Professional and Enterprise tiers are quote-only, so we do not price them |
| PingOne for Workforce Essential | $180,000 | $540,000 | The 5,000-user minimum binds: 5,000 × $3 × 12, not 1,500 × $3 × 12 |
| PingOne for Workforce Plus | $360,000 | $1,080,000 | Same minimum at the $6 rate |
2.What moves the number, and what it costs
These are the things that make year 3 cost more than year 1. Where a vendor publishes a price for one, it is below. Where no vendor publishes a price, there is no price below, because the honest answer is that it depends on your contract and we would be inventing it.
Tier upgrades — priced, and you can model them. Buyers start at the lowest tier that does the job, and a compliance requirement or feature ask later pushes them up. This is the one driver you can put a real number on, because both tiers are published. At 200 seats, Okta Core Essentials to Essentials is $33,600 to $40,800, a $7,200/yr step. Entra P1 to P2 is $16,800 to $24,000. Model the upgrade you think is likely and add it explicitly rather than applying a blanket percentage.
Seat and MAU growth — priced, from your own headcount plan. Multiply your projected headcount by the same published rate. For Auth0 the axis is monthly active users rather than seats, so growth in traffic moves the bill even with flat headcount.
Log retention — usually not a tier upgrade at all. This is the driver most often modelled wrongly, because the intuitive fix is to buy a bigger plan and for the largest IdP in the cohort that option does not exist. Okta's System Log is fixed at 90 days on every tier and Okta sells no extension — its own guidance is to export via the UI or API, or stream to a third-party SIEM. Auth0 is tighter still: 5 days on B2B Essentials, 10 on Professional, 30 only on Enterprise. Entra is 7 days on Free and 30 on P1 and P2, with longer retention via a Log Analytics workspace billed as Azure consumption. JumpCloud sells audit logging as the Directory Insights module at $3/user/mo. So for most of this cohort, multi-year retention is not a line on the vendor quote — it is a log pipeline and a storage bill on your side, sized by your event volume.
Module additions — priced where JumpCloud publishes them. Modular pricing means modules accumulate, and JumpCloud publishes the per-module annual rates: MDM/Device Management $5/user/mo, Passwordless $5, Access Requests $5, and $3 each for Cloud Directory, MFA, User Lifecycle Management, Directory Insights, Cloud LDAP, Cloud RADIUS, Conditional Access, Patch Management and several others. Add the modules you expect to need at their real rates. Note that privileged access management is not on that rate card — JumpCloud sells PAM through Contact Sales and publishes no per-user price for it, so it cannot be modelled from list.
Renewal escalation — real, and not publishable. Multi-year IdP contracts commonly carry an annual uplift, and it is worth treating as a live negotiating point rather than a background assumption. No vendor in this cohort publishes its uplift terms, and what a given customer pays turns on term length, commit size and how the clause was drafted. Ask for the escalation clause and any cap in writing before signing; we are not going to publish a typical percentage, because there is no public source for one.
3.How to budget more accurately
- Start from seats × published rate × 36, at the tier that actually does the job rather than the cheapest one on the page.
- Add named, priced line items on top: the specific tier upgrade you think is coming, the specific modules you expect to add, your headcount plan. Each of those has a published rate behind it.
- Size log retention separately as your own infrastructure cost, not as a vendor upgrade. For Okta and Auth0 in particular there is no retention SKU to buy.
- Check whether a minimum binds before comparing rates. PingOne for Workforce publishes $3/user/mo and a 5,000-user minimum; below 5,000 seats only the minimum matters.
- Get the escalation clause and its cap in writing at signing, and put the number you negotiated into your own model.
- Budget migration cost on exit as a fourth-year line even if you do not plan to migrate — it is real option value. The migration cost page sets out the drivers to size it against.