If you pay a hosted identity provider such as Auth0, Okta, Amazon Cognito or Azure AD B2C by monthly active user (MAU) or by seat, your identity bill is one of the few costs that rises in step with your user count rather than with your revenue. Whether it is about to get more expensive depends on how fast your user base grows, which tier you are on, and what your renewal terms say, and you can estimate all three before the vendor sends a quote.
This post is aimed at the person who owns the budget. It explains why per-user pricing tends to outgrow revenue, what Microsoft has actually said about Azure AD B2C, and how to build a simple model at two and five times your current users.
Which line item does not scale like the rest of your stack?
A per-MAU identity service charges in proportion to the number of people who sign in during a month, and the unit price is set by the vendor’s tier table, which does not track what each user pays you. Unit prices often fall at higher tiers, so the risk is less about the rate and more about users growing faster than the revenue behind them.
That mismatch matters most for products with a large base of low-revenue users, such as consumer apps, education platforms, community tools and free tiers that feed a paid plan. A free user still counts as a monthly active user when they sign in.
Why does per-MAU and per-user pricing outpace revenue?
Three mechanics tend to drive it.
- Tiers and thresholds. Many plans include a set number of MAUs and then charge by band. Crossing a threshold can change your unit price or push you into a different plan, so costs can step up instead of rising smoothly.
- Feature gating. Capabilities your security team considers standard, such as MFA options, enterprise SSO connections, custom domains or audit logs, are often sold at higher tiers or as add-ons. Growth in requirements raises the bill even if the user count is flat.
- Negotiated renewals. Terms agreed during a promotion or a small first contract do not always carry over, so the number you pay in year three may not resemble year one.
What changes between 10,000 and 100,000 users?
At 10,000 users many vendors are inexpensive or free enough that nobody tracks it. At 100,000 users the same line item is large enough to appear in a budget review, and at that scale you may be on a negotiated contract rather than a self-serve plan. The shape of the curve matters more than any single price, so the safest approach is to request the full tier table and compute your cost at several user counts.
The renewal-year surprise
The surprise usually comes at renewal, when the vendor reprices based on your usage during the term. If your MAU count doubled and your plan has a usage-based component, the renewal quote could rise substantially with it. Put your renewal date in the calendar and start modeling a quarter or two before it, since that is when you still have leverage to compare options.
Azure AD B2C is a special case, not the only case
Teams on Azure AD B2C face a roadmap question in addition to the usual pricing question. What Microsoft has said publicly is limited and specific, and it is worth separating from the rumors:
- Azure AD B2C stopped being available for purchase by new customers on May 1, 2025.
- Existing customers continue to be supported, and Microsoft states support continues until at least May 2030.
- Microsoft Entra External ID is the successor platform that Microsoft documents as the migration destination.
- Azure AD B2C Premium P2 was scheduled to be discontinued on March 15, 2026, with tenants continuing on P1, which is a pricing-relevant change separate from end of sale.
Those points come from Microsoft’s Azure AD B2C FAQ and its External ID customer FAQ. There is no announced shutoff date beyond that floor, so this is a planning window and not an emergency. We walk through the sourced timeline in Azure AD B2C end of sale and support timeline. The wider point is that any hosted provider can change its product, its tiers or its pricing, so it is sensible to know what leaving would take before you need to.
How to model your identity cost before the vendor does
You only need a spreadsheet with a few inputs. Ask your vendor, or read their pricing page, for the following, and fill it in for today and for projected growth.
- Monthly active users. Count people who sign in during a month, not registered accounts. Pull twelve months of history if you have it.
- Growth scenarios. Use 1x (today), 2x and 5x. If you have a forecast, add it as a fourth column.
- Tier table. Record the unit price or band for each user count, plus any minimums.
- Add-ons you need. MFA methods, enterprise SSO connections, custom domains, log retention, support level.
- Contract terms. Term length, price protection, overage rules and how usage is measured.
- Cost per user and as a share of revenue. Divide the annual identity cost by users and by revenue at each scenario.
If the share of revenue climbs as you move from 1x to 5x, your identity cost scales faster than your business, and you have found the risk the title asks about. If it stays flat or falls, you can stop worrying until the renewal.
For a self-hosted comparison, use the cost components in what it costs to self-host Keycloak and the broader self-hosted vs managed authentication cost guide. The IAM ROI calculator can help you put numbers into the same structure.
What does plan-based pricing look like instead?
Some providers charge for the capacity you run instead of the users who sign in. Skycloak is one of them: our plans are Developer at $29 a month, Launch at $149 a month and Business at $599 a month, with Enterprise priced per contract, and the plan page lists what each includes, including that users are not metered. The full details are on the pricing page, and the hosting page describes what a cluster is. This changes the shape of the risk more than the size of the number: your bill depends on the plan and cluster size you need, not on a count of people, so the model above becomes a question of capacity rather than users.
That is not automatically cheaper for every team. A product with few users and many enterprise requirements can find a per-MAU plan competitive, and a plan-based service can cost more at low volume. Run the same model on each option and compare the 2x and 5x columns, not only today’s.
If you decide to move, an identity hub architecture makes the change safer, because applications connect to one layer that stays put while the providers behind it change. Our guide on how enterprise SSO survives IdP changes explains that pattern, and the exit plan guide covers what to export.
A budget owner’s checklist before the next renewal
- Do you know your MAU count for each of the past twelve months?
- Do you have the vendor’s full tier table, and have you computed cost at 2x and 5x?
- When is the renewal date, and when does the vendor usually send a quote?
- Which features are you using that sit behind a higher tier or an add-on?
- What does the contract say about price protection and overages?
- Can you export users and configuration if you decide to leave?
- Have you compared at least one alternative on the same model?
Frequently asked questions
How much does Auth0 cost?
Auth0 prices by plan and by monthly active users, and its tiers and limits change over time, so check the current numbers on the vendor’s pricing page and model them against your own MAU count. The method in this post works for any vendor.
Why does my identity bill grow faster than my revenue?
Because it is tied to the number of people signing in, while your revenue depends on how many of them pay and how much. Products with many free or low-value users feel this most.
Is Azure AD B2C being shut down?
Microsoft has said it stopped selling Azure AD B2C to new customers on May 1, 2025, and that it will support it until at least May 2030. It has not announced a shutoff date. Entra External ID is its documented successor.
What counts as a monthly active user?
Definitions vary by vendor, but it generally means a distinct user who authenticates, or sometimes refreshes a session, in a calendar month. Read the exact definition in your contract, since it determines your bill.
How can I reduce identity costs without switching providers?
Check which add-ons you can drop, whether inactive or test accounts are counted, and whether a negotiated plan beats pay-as-you-go. Modeling at 2x and 5x also gives you leverage in the renewal conversation.