Start with licence cost, then add integration effort, manual administration, training, support, and the technician time spent keeping disconnected systems aligned. The real TCO is the full operating cost of a workflow, not the subscription price of a tool. If a cheap product adds recurring labour, it is often the more expensive option.
What “real TCO” means for identity tooling
For MSPs, total cost of ownership is the cost of delivering the identity outcome, not the list price of a platform. A tool that looks inexpensive can become expensive once you account for connector work, exception handling, manual reconciliations, and the steady technician time required to keep fragmented systems aligned. The relevant unit is the workflow, not the licence.
That distinction matters because identity stacks often fail on hidden labour rather than obvious product fees. Subscription cost is only one line item, while operational drag shows up across onboarding, administration, support, and troubleshooting. The same vendor can look affordable in procurement and costly in delivery if it increases touchpoints or creates more states that staff must monitor.
For MSPs, the practical test is whether the tool reduces repeatable work at scale or simply shifts it into a different queue. If a feature saves time once but creates permanent operating overhead, that cost belongs in the TCO model. Good TCO compares steady-state effort over the contract term, including the cost of keeping the identity workflow reliable after go-live. Identity Security Programme Guide
Which cost buckets MSPs should include
Start with direct commercial cost, then add the human and technical effort needed to operate the platform. That usually includes implementation services, connector buildout, ongoing integration maintenance, role and policy updates, support tickets, training, and the technician hours spent resolving drift between the identity tool and upstream or downstream systems.
It also helps to separate one-time onboarding from recurring operating cost. Integration effort may be front-loaded, but manual administration, monitoring, and exception handling recur every month. Over a multi-client MSP model, those recurring tasks often dominate the actual economics because they scale with account count, tenant complexity, and change frequency.
A useful TCO model also includes failure cost. When identity tools are disconnected from the broader stack, teams spend more time reconciling records, chasing approvals, and correcting stale access states. That labour is part of the product’s real price, even if it never appears on the vendor invoice. IGA Buyer’s Guide IVIP and ISPM Buyer’s Guide
How to compare tools without undercounting hidden labour
The cleanest comparison is to model the full annual operating burden for a standard customer, then multiply by expected scale. Define how many tickets, changes, reviews, and sync events each tool creates, and assign an hourly cost to the people who must absorb that work. That makes it possible to compare products on a common basis rather than on vendor packaging.
MSPs should also test whether the tool lowers cross-system coordination or increases it. Identity platforms that require repeated manual exports, custom scripts, or frequent admin intervention can look efficient in demos but become expensive in production. If the workflow depends on a specialist to keep it coherent, the labour cost is part of the architecture, not an edge case.
When evaluating consolidated identity platforms, compare the savings from reduced tool sprawl with the effort required to migrate, reconfigure, and retrain. Some products reduce licence count but increase change-management burden, and that trade-off only becomes visible when you model staff hours over the full lifecycle. Identity and NHI Security Business Case Guide Identity Convergence Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-18 — Security Awareness and Skills Training | Training effort is a real operating cost in identity tool TCO. |
| Recommendation — Include training hours in TCO and budget recurring enablement for admins and technicians. | ||
| NIST SP 800-53 Rev 5 | PM-11 — Mission and Business Process Definition | TCO is tied to the business workflow the tool supports, not just software cost. |
| SA-9 — External System Services | Integration effort and vendor dependencies are central to identity tool operating cost. | |
| Recommendation — Cost the identity workflow end to end before comparing tools. Account for integration and supplier-maintained services in lifecycle cost estimates. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Identity tools incur ongoing access administration and governance overhead. |
| A.8.9 — Configuration management | Keeping disconnected systems aligned drives recurring support and maintenance cost. | |
| Recommendation — Model recurring access administration and review effort as part of ownership cost. Include configuration drift and maintenance effort in the TCO model. | ||
Practitioner Guidance
What to measure: Track licence cost, implementation effort, monthly administration hours, ticket volume, integration break-fix time, and training time as separate line items. If a tool cannot show a lower steady-state labour profile after go-live, it is not cheaper in MSP terms.
Decision rule: If the product reduces headcount-intensive tasks across multiple tenants, it may justify a higher subscription. If it mainly shifts work from the vendor console to technicians, treat the apparent savings as illusory.
What practitioners underestimate: Disconnected identity systems create compounding costs because every exception has to be interpreted, corrected, and rechecked. The hidden expense is rarely one large event, it is the continuous friction of operating around the tool.
Practitioner takeaway: Real TCO for identity tooling is the cost of operating the workflow at scale, so compare tools by recurring labour avoided, not by subscription price alone.