Identity and access management software, beyond SSO alone

What to look for, and what to ignore

What Identity & Access Management Systems actually costs

IAM pricing is among the most opaque in enterprise software. Vendors segment by use case (workforce vs. customer identity), by capability (SSO-only vs. full platform), and by volume (per-user tiers with steep discounts at scale). The market broadly splits into per-user-per-month subscription models and enterprise annual contracts that require sales conversations. What follows comes from the published pricing pages of the leading IAM platforms.

For a mid-market organization with 500 employees and 30 to 50 SaaS applications, expect to spend $30,000 to $120,000 per year on IAM software depending on your requirements. If you are already on Microsoft 365 E3, Entra ID P1 is included. Start there for SSO, conditional access, and basic MFA. If you need deeper provisioning, adaptive MFA, or governance capabilities, Okta Essentials ($17/user/month, ~$102,000/year for 500 users) or JumpCloud Platform ($19/user/month, ~$114,000/year) are the primary alternatives. OneLogin ($4–$8/user/month) and Ping Identity PingOne ($3–$6/user/month) offer the best value for organizations that need SSO and MFA without full governance. For identity governance specifically, budget an additional $40,000 to $150,000/year for SailPoint or the Okta Governance module. Privileged access management (CyberArk, BeyondTrust) adds another $30,000 to $100,000+ per year for enterprise deployments.

How to compare them

Authentication breadth and phishing resistance

Every IAM vendor supports basic SSO and MFA. The differentiator is the depth of authentication options (FIDO2/WebAuthn, device trust, certificate-based auth, passwordless) and whether adaptive policies can adjust MFA requirements based on real-time risk signals.

Ask: Does the platform support FIDO2/WebAuthn hardware keys natively? Can I configure device trust policies that only allow managed devices? Does adaptive MFA consider device compliance state from my endpoint management platform? What is the user experience for passwordless login on mobile?

Provisioning depth for your specific application stack

SSO connectors are table stakes. The real differentiator is whether the platform provides deep SCIM provisioning (automatic account creation, attribute mapping, group-to-role assignment, and deprovisioning) for the specific applications you use. A connector that only supports SAML SSO without provisioning leaves you manually managing accounts.

Ask: For each of our top 10 applications, does the platform support SCIM provisioning? What attributes can be mapped? Can provisioning be triggered by HR system events (hire, termination, department change)? What happens when an application does not support SCIM? Is there an API connector framework or workflow builder?

Identity governance maturity

If you face SOC 2, SOX, HIPAA, or NIST audits, you need access certification campaigns, entitlement reviews, separation-of-duties policies, and audit-ready reports. Some IAM platforms (Okta, JumpCloud) offer basic governance; dedicated IGA platforms (SailPoint, Saviynt) go much deeper but at significantly higher cost and complexity.

Ask: Can the platform run automated access certification campaigns with manager approval workflows? Does it detect and flag excessive permissions or separation-of-duties violations? Can governance reports be mapped to specific compliance framework controls? Is governance a native capability or an add-on module with separate licensing?

Hybrid identity and on-premises directory support

Most enterprises still run on-premises Active Directory alongside cloud identity. Your IAM platform must synchronize cleanly with AD, support hybrid authentication scenarios (kerberos for on-prem, OIDC for cloud), and handle the edge cases that arise when identities exist in multiple directories.

Ask: What is the architecture for Active Directory synchronization? Is it agent-based or agentless? How does the platform handle conflicts when a user exists in both AD and the cloud directory? Can conditional access policies differentiate between on-premises and cloud authentication events?

Total cost of ownership including implementation, add-ons, and scaling

IAM pricing structures are designed to look affordable at the entry tier and become expensive as you add the capabilities you actually need. The jump from SSO-only to full IAM with governance can be 3-5x the initial per-user cost. Professional services for SailPoint and CyberArk routinely exceed the software licensing cost in year one.

Ask: What is the all-in per-user cost for SSO + MFA + provisioning + basic governance? How much do governance and PAM modules add? What percentage of your customers require professional services? What is the typical year-one total cost for an organization of our size?

Developer experience and API completeness

IAM platforms are integration hubs: they connect to every application in your environment. A platform with incomplete APIs, poor documentation, or limited extensibility will bottleneck your team as you scale beyond pre-built connectors.

Ask: Is there a documented REST API covering all platform functions: user management, policy configuration, reporting, and audit logs? Are there SDKs for our development languages? Can we use webhooks to trigger external workflows on authentication events? Is there a Terraform provider for infrastructure-as-code deployments?

Before you buy

1. 1Take stock of your SaaS applications: list every application your organization uses, categorized by sensitivity level (critical/high/medium/low), authentication method (SAML, OIDC, password-only, none), and current provisioning method (manual, SCIM, API, none). This is the single most important input to your IAM evaluation.
2. 2Count your identity population: employees, contractors, partners, machine/service accounts. Your per-user licensing cost depends on which identities you need to manage and whether contractors and partners count as full users.
3. 3Document your compliance requirements: which frameworks (SOC 2, SOX, HIPAA, PCI-DSS, NIST, CMMC) and which specific controls require identity evidence. This determines whether you need basic SSO/MFA or full identity governance.
4. 4Assess your directory setup: are you on-premises Active Directory, Azure AD-only, Google Workspace, or a hybrid? This heavily influences vendor fit: Microsoft Entra ID for AD-heavy environments, Okta or JumpCloud for cloud-native.
5. 5Define your MFA requirements: which authentication methods are acceptable (SMS, TOTP, push, FIDO2, biometrics)? Does your security policy require phishing-resistant MFA? Budget for hardware keys if FIDO2 is required.
6. 6Identify your top 10 applications for SSO and provisioning integration, and verify that each candidate IAM vendor supports both SAML SSO and SCIM provisioning for those specific applications.
7. 7Check whether you already have Microsoft 365 E3 or E5 licenses. If so, you have Entra ID P1 or P2 included and should evaluate whether it meets your needs before buying a separate IAM platform.
8. 8Define your budget range including implementation, MFA hardware, training, and first-year professional services. Compare on a total-cost-of-ownership basis; per-user license price is only part of it.
9. 9Evaluate each candidate vendor through a 30-day proof of concept that covers the full identity lifecycle: provision a user from HR data, assign SSO access to 5 applications, enforce MFA, change the user's role, and terminate the user (verifying deprovisioning).
10. 10Test the end-user experience: have non-technical employees complete SSO login, MFA enrollment, password reset, and application access. Measure time and collect friction feedback.
11. 11Assess the vendor's roadmap for non-human identity management, passwordless authentication, and AI agent identity: these are the capabilities that will matter in the next 2 to 3 years.
12. 12Negotiate contract terms: push for annual pricing with the flexibility to scale user counts, avoid multi-year lock-ins at fixed user counts, and secure the right to add governance or PAM modules later without re-negotiating the base contract.