Enterprise sso pricing hides the real cost of enterprise access

At a glance

What this is: Clerk maps how enterprise SSO pricing shifts from per-connection to per-MAU, and shows that the advertised price rarely matches the final bill.

Why it matters: IAM and product teams need to model authentication pricing as a governance and procurement issue, because billing structure can change go-to-market economics and enterprise deal velocity.

By the numbers:

• In ISC2's 2025 Supply Chain Risk Survey of 1,062 security practitioners, 62% named multi-factor authentication and secure-access protocols among the top requirements they impose on vendors.
• Auth0 B2B Essentials starts at $150 per month at 500 MAU and rises to $3,800 per month at 20,000 MAU.
• Building SSO in-house lands in a range from about $110K to several hundred thousand dollars in year one and from the high six figures up to about $1.1M over three years.

Context

Enterprise SSO pricing is not a single number. The commercial model, the user denominator, and the surrounding add-ons all shape what a buyer ultimately pays, which is why price sheets often understate the actual procurement burden.

For B2B SaaS, this is also an access-governance issue. SAML, SCIM, directory sync, and user-count billing sit at the boundary between identity controls and revenue operations, so pricing structure affects both implementation choice and enterprise sales motion.

The article frames the problem as a comparison of per-connection and per-MAU pricing, then layers in the hidden costs that often determine whether SSO is affordable, delayed, or pushed in-house.

Key questions

Q: How should B2B SaaS teams choose between per-connection and per-MAU SSO pricing?

A: Start by modelling your actual customer mix, not the headline price. Per-connection usually fits B2B SaaS better because cost tracks enterprise customers, while per-MAU can spike when one large account adds thousands of active users. Compare the billing unit, then total SCIM, directory sync, and overage costs before deciding.

Q: Why does enterprise SSO pricing often end up much higher than the advertised rate?

A: Because the sticker price usually excludes the pieces that make SSO operational. Connection caps, separate SCIM or directory-sync charges, MAU overages, and internal engineering time all add to the bill, so the real cost reflects packaging and lifecycle support rather than authentication alone.

Q: What are the signs that an SSO pricing model will break at scale?

A: Watch for connection caps, tier cliffs, forced enterprise upgrades, or user-count billing that rises faster than contract count. Those signals show that growth in customers or users will create cost pressure even when the authentication feature itself is stable.

Q: Should teams build enterprise SSO in-house or buy it from a managed provider?

A: Buy when you need predictable delivery and lower early-stage effort, because building SSO in-house can become a high-six-figure to seven-figure multi-year commitment. Build only if the long-term control requirement justifies the staffing, maintenance, and change-management burden.

Technical breakdown

Per-connection pricing versus per-MAU billing

Per-connection pricing charges a flat fee for each enterprise IdP link, so the cost scales with the number of customer tenants rather than the number of end users. Per-MAU pricing charges against active users across the whole application, which means a single large customer can move the bill sharply even if the number of enterprise connections stays unchanged. The practical difference is denominator risk: the same authentication feature becomes either contract-count driven or usage-count driven. For B2B SaaS, that denominator choice matters more than the list price because it determines whether growth changes cost in step with revenue or in step with user volume.

Practical implication: model SSO spend using your real customer mix, not the headline monthly rate.

Why the hidden costs change the total cost of ownership

The sticker price is only one part of enterprise SSO. The article points to the SSO tax, separate SCIM and directory-sync fees, connection caps, MAU overages, and in-house engineering time as the recurring and one-time costs that often sit outside the first quote. That means the economic question is not whether a provider supports SSO, but which pieces of identity functionality are bundled, capped, or metered separately. In practice, these separate lines can turn a feature decision into a multi-year infrastructure commitment, especially when the initial enterprise customer triggers both procurement urgency and engineering scope.

Practical implication: total all subscription, provisioning, and build costs before committing to a provider.

MRU, MAU, and seat-based pricing count different populations

The article shows that 'per-MAU' is not one universal measure. MRU counts retained users, MAU counts active users, and seat-based pricing counts provisioned users whether they log in or not, so two vendors using similar language can still meter different populations. That matters because pricing comparisons only work when the denominator is aligned. If one plan excludes one-time signups while another bills all active users, the apparent price gap may be an accounting artefact rather than a real commercial advantage. Identity buyers need to validate the unit before they compare the rate.

Practical implication: validate the billing unit before comparing enterprise SSO vendors.

Breaches seen in the wild

• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Pricing structure is now part of identity governance, not just procurement. Enterprise SSO sits at the junction of access control, customer onboarding, and revenue operations, so the billing model influences how quickly a business can satisfy enterprise security requirements. When SSO and SCIM are priced separately, the control that a buyer expects as table stakes becomes a commercial decision. Practitioners should treat authentication packaging as part of the identity architecture conversation, not an afterthought in vendor selection.

The unit of measure determines where cost pressure appears. Per-connection pricing aligns with enterprise customer count, while per-MAU pricing aligns with user volume. That distinction matters because B2B SaaS usually grows by adding higher-seat customers, which makes per-MAU exposure harder to predict and harder to budget. The real risk is not that one model is universally bad, but that the wrong denominator can silently turn a healthy go-to-market motion into a cost problem.

Identity billing denominator mismatch: MRU, MAU, and per-seat pricing were designed for different operating assumptions. That assumption fails when teams compare them as though they describe the same population, because each model counts a different user set and produces a different economic signal. The implication is that practitioners need to rethink vendor comparison itself, not just choose a lower number.

SSO packaging is becoming a buying signal for enterprise readiness. If a provider includes one SSO connection in the base plan, buyers can ship faster and reduce early-stage friction. If the same capability is gated behind enterprise tiers or connection caps, procurement slows and the implementation burden shifts earlier to engineering. That does not make one model universally better, but it does mean packaging now affects sales cycle velocity as much as product capability.

Managed identity costs often outcompete build-it-yourself assumptions. The article's year-one and three-year build estimates show that in-house SSO is rarely just a feature project. It is a sustained identity programme commitment with staffing, maintenance, and future change costs attached. Teams that treat SSO as a one-off build tend to understate lifecycle ownership, especially once enterprise customers and provisioning workflows multiply.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Identity billing denominator mismatch: The central planning problem is not simply price, but what the vendor counts. When one plan charges by connection, another by retained users, and a third by active users or seats, procurement teams can misread the same authentication feature as comparable when it is not.

Pricing visibility is becoming part of enterprise trust. If SSO, SCIM, and directory sync are split across separate lines, teams should expect more variance in procurement timelines, stronger scrutiny in security reviews, and a higher chance that engineering gets pulled into commercial modelling before implementation begins.

For practitioners

• Map pricing to your customer shape Model per-connection and per-MAU cost at 10, 50, and 100 enterprise customers, then test those figures against your actual seat distribution and growth path.
• Separate subscription cost from implementation cost Build a total-cost view that includes SCIM, directory sync, connection caps, MAU overages, and internal engineering time before approving the vendor path.
• Validate the billing denominator Confirm whether the provider bills MRU, MAU, per-seat, or per-connection, and document the exact unit before comparing quotes.
• Budget for enterprise SSO as a lifecycle capability Treat SSO as a recurring identity control with ongoing support and maintenance, not a one-time procurement item, especially if you expect enterprise growth.

Key takeaways

• Enterprise SSO pricing is shaped by the billing unit, the add-ons, and the support model, so the real cost often diverges sharply from the headline rate.
• For B2B SaaS, per-connection pricing usually behaves more predictably than per-MAU pricing because it tracks customer count instead of user growth.
• Teams should budget for SCIM, directory sync, connection caps, overages, and internal build effort before choosing an identity provider.

Key terms

• Per-connection pricing: A pricing model that charges a flat fee for each enterprise identity-provider connection, regardless of how many users sit behind it. In practice, it aligns cost with customer count, which can make budgeting more stable for B2B SaaS teams that sell to a smaller number of larger accounts.
• Per-MAU pricing: A pricing model that charges based on total monthly active users across an application. It is sensitive to usage growth rather than customer count, so a single large enterprise win can materially change the bill even when the number of enterprise connections stays the same.
• MRU: Monthly Retained User. In this article's context, MRU is a retained-user unit that counts people who return after signup, which excludes one-time signups that some MAU models still bill. The distinction matters because identity billing comparisons only make sense when the denominator is the same.
• SSO tax: SSO tax is the extra licensing, implementation, and consulting cost that organisations may face when a SaaS app only supports SSO in higher tiers or through difficult integrations. It is an identity governance problem because cost barriers can directly delay access standardisation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.