The identity costs that surprise teams after signing fall into three groups: usage-based fees that grow as your users do, features that are priced separately once enterprise customers arrive (single sign-on, audit logs, extra environments), and support or contract terms that are not in the base price. If you build or run login yourself, the equivalent hidden cost is engineer time for upgrades, security fixes and on-call. The way to avoid being surprised is to ask a fixed list of questions before signing and to build a three-year estimate that includes each of those lines.
This post is for a CTO, VP of Engineering or founder at a 20 to 300 person B2B SaaS company that is choosing an identity vendor, or building login in-house, and has to forecast the cost for a budget owner. It is a checklist of cost lines that are easy to miss in a quote. For related angles, see what login costs your engineering team each quarter, build vs. buy for identity and how to model per-MAU pricing at scale. This post does not quote any vendor’s prices, because those change and the point is the shape of the bill.
Why is the first quote rarely the cost in year two?
A first quote is usually priced for the customer you are today, with a handful of users and no enterprise customers. Year two is different in two ways: you have more users, and the customers you have won since then ask for things your first plan did not include. The quote is accurate for your current size, but it does not cover the users and features you will need by year two.
What do the common pricing models mean?
Vendors tend to charge in one of four ways, and each grows differently:
- Per user counts every registered account, whether or not it signs in.
- Per active user (often called monthly active users, or MAU) counts only accounts that sign in during a month.
- Per connection charges for each customer’s single sign-on setup, which matters when each of your enterprise customers brings its own identity provider.
- Per cluster or environment charges for the infrastructure that runs the identity system, regardless of how many people use it.
What happens to each model when users grow ten times?
Per-user and per-active-user bills grow roughly in line with users, so a tenfold increase in users is a tenfold increase in that line, unless the contract has volume tiers that you have checked. Per-connection bills grow with the number of enterprise customers rather than with total users. Per-cluster bills grow when you need more capacity or more environments, but not directly when you add users. None of these is automatically better, and the right choice depends on whether your growth comes from many small accounts or a few large customers. Skycloak, as an example, prices by cluster with no per-user or per-MAU fees, so cost grows with clusters, including any extra clusters for staging (see pricing).
Which costs appear after you sign a contract?
Features you need once enterprise customers arrive
The features enterprise buyers ask for are often priced separately: single sign-on with the customer’s own identity provider, audit logs and log export, extra environments for staging, custom domains, and automated user provisioning through SCIM (the standard that lets a customer’s directory create and remove accounts in your product). Our post on the login evidence enterprise buyers ask for lists what they look for. Before signing, check which of those are included in the plan you are pricing and which need an upgrade or an add-on.
Support level and response times
Support often differs across plans. Business-hours support with a best-effort response may be fine for a prototype, but if login goes down, your customers are blocked, not just your engineers. Ask what response time applies to your plan, which hours it covers, and what the price of the next tier is, then decide whether the gap is worth paying for.
Overage, minimum commitments and renewal terms
Look for how overage is billed when you exceed a limit, whether there is a minimum annual commitment, whether the price is locked for the term, and what the renewal clause says. A renewal that resets pricing to list price is a common source of a bill that jumps in year two. Our post on identity service procurement, contract negotiation and SLA requirements goes through the terms worth negotiating.
Which costs appear when you build or run login yourself?
Engineer time for upgrades, security fixes and on-call
Self-running an identity system moves the cost from an invoice to your team’s calendar. Someone has to apply upgrades, respond to security advisories, tune the database, back up and test restores, and be reachable when sign-in fails. None of this appears on a quote, which is why it is easy to underestimate. Our posts on the hidden costs of self-hosted versus managed authentication, the cost of self-hosting Keycloak and whether self-hosting Keycloak is worth it go through the work in detail.
What happens when the one person who knows the system leaves
If login depends on one engineer, the hidden cost is the risk of that person leaving, which shows up as a rushed hire, a consultant or a delayed migration. Write down in the estimate who else can operate the system and how long a replacement would take to get up to speed. Who owns login without a security hire covers how small teams reduce that dependency.
Identity management as a service, on open source
Skycloak does what Auth0 and Okta do, SSO, MFA, SCIM, audit logs and enterprise federation, on an open source core. Unlimited users and applications on every plan, no charge per monthly active user, and you can export and self-host whenever you want.
What should a three-year cost worksheet include?
Build one row per line and one column per year, and mark who supplies each number.
| Line | Who supplies the number |
|---|---|
| Base subscription or infrastructure | Vendor quote, or your cloud bill |
| Growth in the usage-based line (users, connections, clusters) | Product and sales forecast |
| Enterprise features you expect to need in year two or three | Sales (which deals ask for what) |
| Support tier you actually need | Engineering (what an outage costs) |
| Overage and renewal assumptions | Vendor contract, reviewed by legal |
| Engineer time for operations, if self-run | Engineering lead |
| Migration cost if you outgrow the choice | Engineering lead, see what it costs to switch identity providers |
Present it as a range with two or three scenarios (slow, expected and fast growth), so the finance partner can see how sensitive the total is to the assumptions.
Which questions should you put to any vendor before signing?
- How is the bill calculated, and what is the unit (user, active user, connection, cluster)?
- What does the bill look like at ten times our current volume, in writing?
- Which features that enterprise customers ask for are included in this plan, and which are add-ons or a higher plan?
- What support hours and response times apply to our plan, and what does the next tier cost?
- What are the overage terms, the minimum commitment and the renewal pricing?
- Can we export our users and configuration if we leave, and in what format?
- What is the notice period to cancel, and does the contract renew automatically?
Question 6 deserves extra attention, because if you cannot export users and configuration, any future move costs more and that belongs in the estimate.
FAQ
What is the biggest hidden cost of identity management?
For most B2B SaaS companies it is the gap between the plan that fits today and the plan that fits once enterprise customers arrive, because that is when single sign-on, audit logs and support requirements all show up in the same quarter.
Is building login in-house cheaper than buying?
Not by default. The subscription is replaced by engineering time, on-call load and the risk of key-person dependency, which are real costs even though no invoice shows them. It can still be the right choice for teams with identity expertise and unusual requirements.
How do I explain these assumptions to a finance partner?
Show the worksheet with scenarios and name the assumption that moves the total most, usually user growth or the timing of enterprise deals. Finance generally prefers a stated range with reasons to a single precise figure.
Do per-user prices become cheaper at scale?
Some vendors offer volume tiers, but the effective price per user depends on the contract, so ask for the full tier table and model your three scenarios against it rather than assuming a discount.
What to do next
Take the worksheet above and fill in the lines for the vendor you are leaning towards, then send the seven questions to that vendor and get the answers in writing. If an answer is missing or vague, treat it as a cost line you cannot yet estimate.