Businesses have been using Okta as an identity and access management (IAM) solution with crucial compliance features like SSO, MFA, and lifecycle management. Although Okta’s upfront cost is low, there are other costs to consider, such as implementation, training, maintenance, and more. But most importantly, you’ll likely need to upgrade your software and/or your SaaS subscriptions — this post explores what this means for businesses andIT admins.
Businesses need to consider all the factors affecting the true cost of Okta, in order to make an informed decision.
The Okta pricing model is modular, with each service incurring an additional cost. Although this provides flexibility, determining the exact cost for your specific needs can prove difficult. The average per-user cost will typically fall somewhere between $12 and $18 per month, but this can vary depending on the size and needs of your organization.
For example, Okta’s pricing tiers include different features with their own prices:
There are also multiple hidden costs when using Okta. For instance, some SaaS vendors charge a premium to connect a third-party SSO provider — known as the “SSO tax.” Also, the time and complexity involved in setting up and maintaining Okta’s features may add to the overall cost.
To illustrate the true cost of Okta, we’ll look at a fictional case study of a company — Dev Inc. — and explore how the costs stack up, then we’ll explore the non-monetary costs associated with using Okta, such as increased complexity in provisioning and deprovisioning processes, and the sunk cost fallacy.
It’s crucial to understand some essential concepts related to IAM, like SSO, SCIM, and SAML, before delving deeper into Okta’s pricing. If you’re already familiar with these terms, feel free to skip to the next section.
If not, here’s an overview of the three technologies:
Okta is an IAM solution that supports SSO, SCIM, and SAML. This allows organizations to use Okta to simplify user authentication, automate user provisioning and deprovisioning, and implement other security features.
For example, Okta can be used to implement SSO for a variety of applications, including Salesforce, Slack, and Notion, allowing users to log in to all of these applications with a single set of credentials. Okta can also be used to automate user provisioning and deprovisioning for these applications via SCIM, so that user identities are automatically added and removed from Okta when they are added or removed from the organization.
SSO, SCIM, and SAML can be valuable tools for managing user identities and access, but each has its own set of limitations. For example, SSO does not handle authorization — which determines what access an authenticated user has — meaning that organizations may need to implement additional security measures to properly control user access.
SCIM, on the other hand, can be complex to set up and maintain. Additionally, not all applications support SCIM, which can lead to inconsistencies in user identity data across different systems.
Finally, SAML is a complex standard that can be difficult to implement correctly. Misconfigurations can lead to security vulnerabilities, and debugging SAML issues can be challenging, due to the standard’s complexity.
SSO, SCIM, and SAML are important tools; however, it’s important to consider their limitations before implementing them.
One of the biggest hidden costs of Okta is the “SSO tax.” This is a premium that some SaaS vendors charge for customers to connect their SSO provider. This can significantly increase the cost of your SaaS subscriptions, making SSO prohibitively expensive for smaller organizations.
Let’s say you’re using a SaaS tool that costs $10 per user per month. If the vendor charges an additional $4 per user per month to use your SSO provider, you end up paying an SSO tax of 40%. When you multiply this by the number of SaaS tools and then by the number of users in your organization, the costs can quickly add up. It’s also important to mention that the SSO tax can be anywhere between 15% and 6,000% percent. Although 6,000% may be on the extreme end, it’s not uncommon to see at least a 100% increase from the original price.
In addition to the SSO tax, some vendors offer SSO and SCIM only with their more expensive enterprise plans, effectively locking you into higher-priced subscriptions.
But you’re not only paying more for your SaaS subscriptions. To use SCIM with Okta, you’ll also need to buy the Lifecycle Management product for $4 per month per user — this is a crucial feature for organizations that want to automate user provisioning and deprovisioning.
To fully understand the true cost, let’s explore what it would cost for the fictional company, Dev Inc.:
First of all, let’s establish the cost of Okta itself.
|Feature||Purpose||Cost per User/Month|
|SSO||Login with a single password||$2|
|Universal Directory||For Google Workspace and HRIS integrations||$2|
|Workflows||Employee onboarding and offboarding automations||(incl. in Identity Governance)|
|Lifecycle Management||Automating user provisioning and deprovisioning||(incl. in Identity Governance)|
|Identity Governance||Meeting SOC 2 Type 2 requirements||$9|
At this stage, the cost would be $16 per user per month, or $19,200 annually for Dev Inc.
But, this post is about the true cost of Okta, which really adds up when you consider the SSO tax. Here’s a table of examples, based on some of the most widely used SaaS tools:
|SaaS Tool||Plan Without SSO||Cost Without SSO||Plan with SSO||Cost with SSO||Additional Yearly Cost (for 100 users)|
|HubSpot||Professional||$9,600/year||Enterprise||$43,200/year||$43,200 (fixed fee)|
* SCIM, which requires the Enterprise package, not included. ** Assuming 50 users, as not all employees need GitHub access.
As you can see, the additional costs for just these five tools add up to $72,900, bringing the total cost so far to $92,100 annually.
However, if we assume that 40 tools — half of Dev Inc.’s toolset — have to be managed through Okta, with an average annual cost of $5,000 (which is on the low end), the true cost of Okta for Dev Inc. is $219,200. This is more than 10 times the sticker price of Okta, and there’s a high likelihood of your cost being even higher.
The “sunk cost fallacy” is a common cognitive bias, referring to situations where individuals or organizations continue a behavior (or endeavor) because of previously invested resources, even if it’s no longer the best course of action. These ‘resources’ may be one of or a combination of:
For example, you might spend a significant amount of time and resources setting up Okta, integrating it with your existing systems, only to discover later that another IAM solution would be more cost-effective or better suited to their needs. But you might be reluctant to switch because of the resources you’ve already invested in Okta.
While SSO and SCIM can offer numerous benefits, they’re not without their limitations. For instance, SSO handles only authentication, not authorization, which means managing access permissions is still a manual task. Although this is in part solved by SCIM, by automating the exchange of user identity data, it still requires a large number of engineering hours to set up and maintain.
One possible solution is to stick with Google Workspace, adding a specific tool for provisioning and access requests/approvals. This can provide the core features of an IdP without the complexity and cost of a more comprehensive solution like Okta — mitigating the limitations of SSO without replacing SSO.