Licensing an IAM stack: add-ons, prerequisites and minimums

What are prerequisites?

Microsoft Entra ID Governance costs $7.00 per user per month and requires Entra ID P1 ($7.00) or P2 ($10.00), all paid yearly. Entra Suite ($12.00) requires P1. Okta Identity Governance requires Okta Workforce Identity. A governance price quoted on its own understates the cost if you do not already own the prerequisite.

How do bundles change the comparison?

Some plans include what another vendor sells separately. Microsoft lists P1 as included in Microsoft 365 E3 and Business Premium, and P2 in Microsoft 365 E5. Okta's suites stack features: Starter ($6) includes SSO, MFA and Universal Directory; Core Essentials ($14) adds Adaptive MFA, Lifecycle Management and Access Governance; Essentials ($17) adds Privileged Access. Identity Threat Protection is an add-on from Essentials up and is included in Professional.

Where do minimums and caps apply?

Okta has a $1,500 annual minimum contract. Ping prices PingOne for Workforce at $3 or $6 per user per month on an annual contract with a 5,000-user minimum. JumpCloud's Platform Essentials tier stops at 300 users. At small sizes, a low per-user price with a high minimum can cost more than a higher price without one.

How do modules and add-ons work?

JumpCloud sells modules: Device Management at $9, SSO at $11 and Device Identity Management at $13 per user per month on annual billing, more on monthly billing, with add-ons from $3 to $6 that include conditional access and user lifecycle management. Google lists Cloud Identity at $7.2 per user per month and offers a Free edition.

What if only the structure is published?

C1 publishes its structure, Platform or Flex pricing, Pro or Advanced tiers and 100 to 20,000 managed identities, but no dollar figures. SailPoint lists its Standard, Agentic Business and Agentic Business Plus suites without prices. Saviynt, Veza and Lumos do not publish prices. Orchid Security and Apono publish none on their own sites but list AWS Marketplace prices: $250,000.00 per 12 months for 30 applications (Orchid) and $4,900.00 per month for 100 users (Apono). Silverfort prices by organization size and Push Security publishes $5 per user per month.

How are machine identities counted?

Microsoft prices Workload ID at $3.00 per workload identity per month. As machine and agent identities grow, check whether a vendor counts them as users, as workloads, or not at all.

A worksheet to fill in

For each job: the product, its prerequisite, the plan that includes it, any minimum, the billing period, and whether machine identities count. Fill it from vendor pages first, then ask sales only for what is missing.