MAU pricing distorts identity infrastructure costs on spike days

At a glance

What this is: This is Ory's comparison of MAU and aDAU billing for identity infrastructure, showing that monthly active user pricing can materially overstate costs when traffic spikes.

Why it matters: IAM and platform teams need a billing model that reflects real authentication load, because pricing tied to monthly peaks distorts budgeting, capacity planning, and procurement decisions.

Context

Monthly Active Users, or MAU, is a billing model that charges for unique users who authenticate at least once during a month. For identity infrastructure, that can create a mismatch between what a team pays and what the system actually consumes, especially when usage is bursty.

The article's core governance problem is cost proportionality. If one spike day can drive a full month's invoice, identity leaders lose a clear signal for capacity, forecasting, and vendor comparison across authentication-heavy applications.

Average Daily Active Users, or aDAU, is presented as a closer proxy for sustained usage because it averages daily authenticated users across the billing period. That matters most for applications with intermittent logins, promotional spikes, or event-driven traffic patterns.

Key questions

Q: How should identity teams compare MAU and aDAU pricing models?

A: Start with actual usage behaviour, not vendor price cards. MAU is easier to understand but can overcharge bursty applications because it counts any authenticated user once per month. aDAU usually tracks cost more closely to daily consumption, so the better model depends on whether your users are steady, seasonal, or spike-driven.

Q: Why can MAU pricing make identity costs look higher than actual usage?

A: Because MAU counts any user who authenticates during the month as a full monthly unit, even if they only appear on one day. That means a short spike can be charged as if it defined the whole period. The result is a bill that follows monthly presence more closely than runtime load.

Q: What are the best ways to forecast identity spend for spiky applications?

A: Use historical usage curves, not just total monthly sign-ins. Segment workloads by steady-state, weekend, campaign, and event traffic, then compare MAU and aDAU outputs for each segment. That gives finance and IAM teams a more realistic view of cost exposure before a launch or seasonal peak.

Q: What should procurement teams ask when a provider bills on active users?

A: Ask whether the billing unit reflects monthly reach or daily authentication activity, and request examples based on your own traffic profile. Also ask how spikes, overlap, and user recurrence are counted. Those questions expose whether the invoice will track real usage or simply the highest monthly footprint.

Technical breakdown

How MAU billing distorts identity infrastructure costs

MAU counts each unique user once if they authenticate during the billing month, regardless of whether they log in once or every day. That design makes the metric easy to understand but weak as a proxy for infrastructure consumption, because the compute and auth workload varies with request volume, not with the existence of a monthly user record. When traffic spikes, MAU locks the peak into the whole billing period. For identity teams, the technical issue is not the counting method itself, but the fact that the billing unit is decoupled from runtime load.

Practical implication: Model identity spend against authentication volume, not just monthly user reach.

Why aDAU tracks usage more closely than MAU

aDAU measures unique authenticated users per day and then averages that count over the billing period. In practice, that smooths out one-day spikes and captures whether an application is lightly used on most days or sustained across the month. A daily user contributes more to aDAU than a once-a-month user, so the model better reflects actual activity patterns. This does not eliminate pricing variance, but it reduces the chance that a single burst becomes the dominant cost driver for the entire month.

Practical implication: Use aDAU where intermittent usage is normal and monthly peaks are misleading.

Why usage ratios matter in pricing comparisons

The article's comparison depends on the DAU to MAU ratio, which shows how often monthly users return. Low-frequency applications can have a large gap between the two metrics, while workday-heavy SaaS tools narrow that gap because the same users come back repeatedly. That ratio is what turns a billing model into a forecasting model. Teams that do not estimate return frequency will overread MAU as demand and underread aDAU as usage intensity, even though the two answer different operational questions.

Practical implication: Estimate DAU to MAU patterns before choosing a billing model or negotiating commitments.

NHI Mgmt Group analysis

MAU is a poor proxy for identity infrastructure consumption when usage is bursty. Monthly counting rewards presence, not load, so one promotional or event-driven spike can define the whole invoice. That breaks the assumption that identity cost scales smoothly with real demand. For practitioners, the pricing model becomes a governance issue, not just a finance detail.

aDAU better aligns cost with authentication activity, but only when teams understand their traffic shape. Averaging daily unique users reduces the effect of short spikes and reflects the fact that many identity workloads are intermittent. The result is not just lower cost, but a more defensible basis for budgeting and procurement. Teams should treat billing metrics as operational signals, not vendor-neutral truths.

Identity pricing should be evaluated as proportionality, not as a fixed tariff problem. The same user population can produce very different invoices depending on whether the model measures monthly reach or daily activity. That means architecture, user behaviour, and commercial terms are intertwined. Procurement and IAM teams need a shared view of usage patterns before they can compare providers fairly.

Spike-day billing pressure exposes a broader identity economics gap. When cost is tied to monthly peaks, teams are incentivised to optimise for billing rather than for user experience or operational fit. That can distort rollout planning, especially for apps with seasonal or campaign-based demand. Practitioners should challenge pricing models that ignore how often identity infrastructure is actually exercised.

DAU/MAU ratios are now a practical control point for identity budgeting. The article's own examples show how the same workload can land in very different cost bands depending on user recurrence. That makes traffic segmentation, not just tenant size, the variable worth governing. Teams should use observed usage ratios when setting expectations with finance and procurement.

What this signals

MAU-based billing introduces a governance mismatch when infrastructure is exercised unevenly across the month. Teams should not treat monthly user counts as a proxy for steady cost, because the metric can hide burst-driven overages and distort budgeting.

aDAU is the more useful planning metric when authentication activity is intermittent. It gives IAM and platform owners a better bridge between user behaviour and commercial terms, which is why traffic shape should be part of vendor evaluation.

Identity procurement should now include usage shape review. If a provider bills on monthly presence, the team needs to test how promotions, launches, and seasonal spikes change the cost picture before committing.

For practitioners

• Model spend by traffic pattern Compare MAU and aDAU projections for spike-heavy, workweek, and low-frequency applications before choosing a billing model.
• Use observed DAU/MAU ratios Build pricing forecasts from real return frequency instead of assuming every monthly user carries equal infrastructure weight.
• Separate rollout peaks from steady-state usage Treat launch events, promotions, and seasonal surges as distinct demand profiles when estimating identity costs.
• Negotiate on proportionality Use the relationship between daily authentication load and monthly invoice exposure as the basis for commercial review.

Key takeaways

• MAU pricing can misrepresent identity infrastructure cost when usage is bursty, because one spike day can influence the whole billing month.
• The article shows that aDAU better follows authenticated activity and can materially narrow the gap between billed users and actual load.
• IAM and platform teams should evaluate billing models against real traffic patterns so procurement decisions reflect proportionality, not peak-month distortion.

Key terms

• Monthly Active Users: A billing metric that counts each unique user who authenticates at least once during a month. It is simple to administer, but it can overstate actual infrastructure consumption when the same user logs in only occasionally or when one spike day pulls many one-time users into the billing period.
• Average Daily Active Users: A usage metric that averages the number of unique authenticated users across the days in a billing period. It is often a better fit for identity infrastructure because it reflects daily activity patterns, not just monthly presence, and it smooths out short-lived traffic spikes.
• Usage Shape: The pattern of how authentication demand rises, falls, and spikes over time. In identity infrastructure, usage shape determines whether a monthly billing model will track real consumption or exaggerate the cost of short-lived peaks.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.