Practitioner reference · 2026.05

IAM vendor pricing index — without the back-and-forth.

Practitioner-observed pricing ranges for the major IAM vendors — workforce IAM, PAM, IGA, CIAM. Composite of askmeidentity engagement data + recruiter network + public RFP intel. These are ranges, not quotes — use for triangulation before vendor procurement. CC BY 4.0.

Get a real quote analysis

These are ranges, not quotes

Vendor pricing varies significantly by volume tier, region, contract length, bundled SKUs, and whatever other procurement leverage you carry. The bands below are composite ranges from active engagements, placement network intel, and public sources. Treat them as triangulation aids, not as quotes for procurement.

Workforce IAM

3 vendors

Okta

Workforce Identity Cloud

Vendor site

Per-user monthly subscription bundled by feature tier (SSO, MFA, Lifecycle, Identity Governance).

Model Per user per month, billed annually. Tiered by capability (e.g. "Adaptive MFA" requires the higher tier).

Product / SKU	Unit	Enterprise	Mid-market	Notes
SSO	per user / month	$3-5	$5-7	List is typically $2/user but enterprise volume discounts move down; mid-market lacks the discount leverage.
Adaptive MFA	per user / month	$4-7	$6-10	Required for risk-based + Okta Verify push. Cheaper combined with SSO.
Lifecycle Management	per user / month	$6-10	$10-15	Adds JML automation + SCIM provisioning to managed apps.
Identity Governance	per user / month	$10-18	$15-25	Recently rebranded suite covering access certifications + access requests. Competes against SailPoint / Saviynt at higher tiers.

What adds cost

Multi-year terms with annual price escalators (5-7% common)
Per-app SCIM premium connectors
Customer Identity Cloud (Auth0) bundled in the same MSA — typically separate procurement
Phishing-resistant MFA tier vs basic push

What reduces cost

Multi-year prepay (typically 8-15% off)
Larger user counts (>5K) into mid-volume tier
Bundling SSO + Adaptive MFA + Lifecycle in one SKU

Microsoft

Entra ID

Vendor site

Entra ID is the workforce IdP for the Microsoft ecosystem; pricing often consumed via E3 / E5 licensing.

Model Per user per month standalone, OR consumed via Microsoft 365 / Office 365 / EMS suite licenses. Most enterprise customers consume Entra ID via E3 / E5 rather than as a separate SKU.

Product / SKU	Unit	Enterprise	Mid-market	Notes
Entra ID P1 (standalone)	per user / month	$5-6	$6 (list)	List $6. P1 includes SSO + MFA + Conditional Access. Included in E3.
Entra ID P2 (standalone)	per user / month	$8-9	$9 (list)	List $9. Adds Identity Protection + PIM. Included in E5.
Entra ID Governance (add-on)	per user / month	$5-7	$7 (list)	List $7. Adds access reviews + entitlement management. Optional add-on to P2.

What adds cost

Entra Private Access + Internet Access (per-user adders)
B2B / external collaboration MAU billing on Entra External ID
Workload Identity add-ons for service accounts

What reduces cost

Already-paid M365 E3 / E5 suite licensing
Microsoft Enterprise Agreement (EA) discounts
Bundled with Defender / Purview for security suite economics

JumpCloud

Open Directory Platform

Vendor site

SMB / mid-market workforce IdP with device management + RADIUS. List pricing is published.

Model Per-user-per-month bundles published on the website. Lower commitment threshold than enterprise IdPs.

Product / SKU	Unit	Enterprise	Mid-market	Notes
Core Directory	per user / month	$9-13	$13 (list)	SSO + MFA + RADIUS + device. Quoted publicly.
Platform Prime	per user / month	$22-27	$27 (list)	Includes everything — patch, password manager, dashboards.

What adds cost

Premium support tier
Custom contracts at >2K users

What reduces cost

Annual prepay (10-20%)
Quarterly commits at higher seat counts

Privileged Access Management

4 vendors

CyberArk

Identity Security Platform

Vendor site

Premier PAM platform. Per-vaulted-account + per-session-monitored pricing; not published.

Model Per-vaulted-account (privileged credentials in the vault), with adders for session monitoring, JIT, secrets management, and endpoint privilege management. Multi-year MSA is the norm.

Product / SKU	Unit	Enterprise	Mid-market	Notes
Privileged Access Manager	per vaulted account / year	$200-450	$400-700	Wide range — depends heavily on volume tier and modules.
Endpoint Privilege Manager	per endpoint / year	$25-60	$50-100	Workstation-side least-privilege enforcement.
Secrets Manager (Conjur Cloud)	per machine identity / year	$20-50	$50-100	For DevOps secrets management. Competes with HashiCorp Vault.

What adds cost

Session monitoring + recording at full coverage
Just-in-time elevation modules
AAM (Application Access Manager) for non-human credentials

What reduces cost

Long-term MSA (3-5 years) for cap-out pricing
Bundle of PAM + EPM + Secrets
Public-sector + healthcare discount programs

BeyondTrust

Privileged Remote Access + Endpoint Privilege Management

Vendor site

PAM + remote support + EPM. Often slightly less than CyberArk at parity coverage.

Model Per-asset / per-user / per-endpoint depending on the module. Multi-product bundling.

Product / SKU	Unit	Enterprise	Mid-market	Notes
Privileged Remote Access	per concurrent admin / year	$1,500-3,500	$3,000-5,000	Concurrent-admin model differs from CyberArk's per-vault model.
Endpoint Privilege Management	per endpoint / year	$20-50	$45-90	Direct competitor to CyberArk EPM.
Password Safe	per vaulted account / year	$150-350	$300-600	CyberArk PAM equivalent.

What adds cost

Premium support
Unix / Linux Privilege Management add-on

What reduces cost

Multi-product bundles
Remote Support consolidation with PRA

Delinea

Secret Server + Privilege Manager

Vendor site

PAM platform formed from Thycotic + Centrify. Mid-market-friendly pricing.

Model Per-vaulted-secret + per-endpoint. Generally lower entry point than CyberArk / BeyondTrust.

Product / SKU	Unit	Enterprise	Mid-market	Notes
Secret Server	per vaulted secret / year	$80-200	$150-300	Vault-anchored PAM with DevOps + Unix add-ons.
Privilege Manager	per endpoint / year	$15-40	$30-70	Endpoint least-privilege.

What adds cost

On-prem deployment vs cloud SaaS
Premier support tier

What reduces cost

Cloud-first SKU bundle
Mid-market volume tiers

HashiCorp

Vault Enterprise

Vendor site

DevOps-anchored secrets management. The open-source community edition is free; Enterprise adds replication, HSM, SSO.

Model Per-cluster + per-client (HCP Vault) or per-instance (self-hosted Enterprise). Pricing skews to engineering buyers, not security buyers.

Product / SKU	Unit	Enterprise	Mid-market	Notes
HCP Vault (managed)	per cluster + per Vault Client	$0.03-0.10 / Vault Client / hour	Public list	Active-Vault-Client billing. Pricing details on the HashiCorp site.
Vault Enterprise (self-hosted)	per instance / year	~$25-70K starting	Per-quote	For replication, HSM, governance modules. Wide range.

What adds cost

Disaster Recovery / Performance replication
HSM integration
Governance + namespaces modules

What reduces cost

Starting on community edition + upgrading later
HCP managed offering for smaller deployments

Identity Governance

2 vendors

SailPoint

Identity Security Cloud

Vendor site

The IGA category leader. Per-identity + per-connector pricing on a multi-year MSA.

Model Per identity (employee, contractor, machine) + connector-tier surcharges. Multi-year MSA standard.

Product / SKU	Unit	Enterprise	Mid-market	Notes
Identity Security Cloud Standard	per identity / year	$30-70	$60-120	Core IGA: provisioning, certifications, requests.
Identity Security Cloud Business Plus	per identity / year	$70-150	$120-220	Adds AI-driven recommendations, IDA-enabled features.

What adds cost

Premium connectors (SAP, ServiceNow integrations)
AI / IDA modules
Implementation services from SailPoint partners (often 1-2x the annual license)

What reduces cost

Multi-year MSA
Larger identity counts → tier discounts
Bundling with Microsoft / Okta SSO discounts via partner programs

Saviynt

Enterprise Identity Cloud

Vendor site

Cloud-first IGA + PAM in one platform. Per-identity pricing similar to SailPoint.

Model Per identity / year with PAM modules as add-ons.

Product / SKU	Unit	Enterprise	Mid-market	Notes
Identity Security Cloud (IGA)	per identity / year	$25-60	$55-100	Generally priced slightly below SailPoint at parity.
Cloud PAM	per privileged account / year	$120-300	$250-500	Below CyberArk pricing — but PAM maturity is lower.

What adds cost

SAP Application Access Governance (AAG)
Premium connectors

What reduces cost

Bundling IGA + PAM in one MSA
Multi-year terms

Customer Identity

2 vendors

Auth0

Customer Identity (Okta CIC)

Vendor site

Developer-friendly CIAM. Published tier pricing for B2C; enterprise via quote.

Model Per MAU (monthly active user). Published tiers up to 25K MAU; enterprise quote above.

Product / SKU	Unit	Enterprise	Mid-market	Notes
B2C Professional	per 1K MAU / month	Quote	$240+ at 7K MAU	Public tier pricing on Auth0 site.
B2B Professional	per 1K MAU / month	Quote	$1,500 at 500 MAU starting	B2B tier is more expensive per MAU because each MAU is typically higher-value.

What adds cost

Organizations (multi-tenant) feature
Attack Protection (bot mitigation)
Adaptive MFA
Custom domains (enterprise tier)

What reduces cost

Annual commit
Bundling with Okta workforce contract
Volume discounts above 1M MAU

Microsoft

External ID

Vendor site

Microsoft's consolidated B2B + B2C CIAM. Per-MAU pricing typically below Auth0 at scale.

Model Per MAU per month, with a generous free tier (50K MAU).

Product / SKU	Unit	Enterprise	Mid-market	Notes
External ID (consumer)	per MAU / month	$0.0325	$0.0325 (list)	First 50K MAU free. List price published.
External ID (B2B guest)	per MAU / month	$0.05	$0.05 (list)	B2B guests billed separately. First 50K free.

What adds cost

Premium MFA features
Identity Protection on consumer accounts
Custom domain SKU

What reduces cost

Microsoft EA pricing leverage
Free 50K MAU tier covers most early-stage products

Methodology

Where these ranges come from.

Composite of multiple sources
Active engagement data, placement network intel, public RFP leaks, published list prices where vendors publish them, and partner-program disclosures. No single source dictates a band.
Enterprise vs mid-market
Enterprise = 10,000+ users / accounts / endpoints, multi-year MSA with procurement leverage. Mid-market = 500-5,000 with less leverage. Spot-buy small deployments price closer to list.
Annual refresh
Full annual refresh in Q4 + quarterly directional check on the most-active categories. Vendor model changes can move the bands significantly within a cycle — bookmark this page rather than copying figures into static documents.

Procurement help

We’ve seen the contracts. Want a second opinion?

We help enterprise buyers triangulate vendor quotes against market reality — and identify the SKU bundling and term-length levers that move 15-30% on the headline price.

Talk to a procurement leadVendor practices

IAM vendor pricing index — without the back-and-forth.

Product / SKU

Unit

Enterprise

Mid-market

Notes

SSO

per user / month

$3-5

$5-7

List is typically $2/user but enterprise volume discounts move down; mid-market lacks the discount leverage.

Adaptive MFA

per user / month

$4-7

$6-10

Required for risk-based + Okta Verify push. Cheaper combined with SSO.

Lifecycle Management

per user / month

$6-10

$10-15

Adds JML automation + SCIM provisioning to managed apps.

Identity Governance

per user / month

$10-18

$15-25

Recently rebranded suite covering access certifications + access requests. Competes against SailPoint / Saviynt at higher tiers.

Product / SKU

Unit

Enterprise

Mid-market

Notes

Entra ID P1 (standalone)

per user / month

$5-6

$6 (list)

List $6. P1 includes SSO + MFA + Conditional Access. Included in E3.

Entra ID P2 (standalone)

per user / month

$8-9

$9 (list)

List $9. Adds Identity Protection + PIM. Included in E5.

Entra ID Governance (add-on)

per user / month

$5-7

$7 (list)

List $7. Adds access reviews + entitlement management. Optional add-on to P2.

Product / SKU

Unit

Enterprise

Mid-market

Notes

Core Directory

per user / month

$9-13

$13 (list)

SSO + MFA + RADIUS + device. Quoted publicly.

Platform Prime

per user / month

$22-27

$27 (list)

Includes everything — patch, password manager, dashboards.

Product / SKU

Unit

Enterprise

Mid-market

Notes

Privileged Access Manager

per vaulted account / year

$200-450

$400-700

Wide range — depends heavily on volume tier and modules.

Endpoint Privilege Manager

per endpoint / year

$25-60

$50-100

Workstation-side least-privilege enforcement.

Secrets Manager (Conjur Cloud)

per machine identity / year

$20-50

$50-100

For DevOps secrets management. Competes with HashiCorp Vault.

Product / SKU

Unit

Enterprise

Mid-market

Notes

Privileged Remote Access

per concurrent admin / year

$1,500-3,500

$3,000-5,000

Concurrent-admin model differs from CyberArk's per-vault model.

Endpoint Privilege Management

per endpoint / year

$20-50

$45-90

Direct competitor to CyberArk EPM.

Password Safe

per vaulted account / year

$150-350

$300-600

CyberArk PAM equivalent.

Product / SKU

Unit

Enterprise

Mid-market

Notes

Secret Server

per vaulted secret / year

$80-200

$150-300

Vault-anchored PAM with DevOps + Unix add-ons.

Privilege Manager

per endpoint / year

$15-40

$30-70

Endpoint least-privilege.

Product / SKU

Unit

Enterprise

Mid-market

Notes

HCP Vault (managed)

per cluster + per Vault Client

$0.03-0.10 / Vault Client / hour

Public list

Active-Vault-Client billing. Pricing details on the HashiCorp site.

Vault Enterprise (self-hosted)

per instance / year

~$25-70K starting

Per-quote

For replication, HSM, governance modules. Wide range.

Product / SKU

Unit

Enterprise

Mid-market

Notes

Identity Security Cloud Standard

per identity / year

$30-70

$60-120

Core IGA: provisioning, certifications, requests.

Identity Security Cloud Business Plus

per identity / year

$70-150

$120-220

Adds AI-driven recommendations, IDA-enabled features.

Product / SKU

Unit

Enterprise

Mid-market

Notes

Identity Security Cloud (IGA)

per identity / year

$25-60

$55-100

Generally priced slightly below SailPoint at parity.

Cloud PAM

per privileged account / year

$120-300

$250-500

Below CyberArk pricing — but PAM maturity is lower.

Product / SKU

Unit

Enterprise

Mid-market

Notes

B2C Professional

per 1K MAU / month

Quote

$240+ at 7K MAU

Public tier pricing on Auth0 site.

B2B Professional

per 1K MAU / month

Quote

$1,500 at 500 MAU starting

B2B tier is more expensive per MAU because each MAU is typically higher-value.

Product / SKU

Unit

Enterprise

Mid-market

Notes

External ID (consumer)

per MAU / month

$0.0325

$0.0325 (list)

First 50K MAU free. List price published.

External ID (B2B guest)

per MAU / month

$0.05

$0.05 (list)

B2B guests billed separately. First 50K free.

Where these ranges come from.

Composite of multiple sources

Active engagement data, placement network intel, public RFP leaks, published list prices where vendors publish them, and partner-program disclosures. No single source dictates a band.

Enterprise vs mid-market

Enterprise = 10,000+ users / accounts / endpoints, multi-year MSA with procurement leverage. Mid-market = 500-5,000 with less leverage. Spot-buy small deployments price closer to list.

Annual refresh

Full annual refresh in Q4 + quarterly directional check on the most-active categories. Vendor model changes can move the bands significantly within a cycle — bookmark this page rather than copying figures into static documents.