A pricing model that charges based on total monthly active users across an application. It is sensitive to usage growth rather than customer count, so a single large enterprise win can materially change the bill even when the number of enterprise connections stays the same.
What Per-MAU pricing means in practice
Per-MAU pricing ties software cost to monthly active usage, not simply to contract size or seat count. That makes it a usage-sensitive commercial model: the bill can rise quickly when adoption expands, even if the number of customer relationships stays flat.
For buyers, the important detail is that “active user” is an operational metric, not just a sales term. The pricing outcome depends on how the vendor defines activity, how often users are counted, and whether dormant, shared, or automation-driven access is included in the metering logic.
Why this pricing model matters
Per-MAU pricing changes procurement economics because value and cost move together. It can be attractive when usage is uncertain or when a team wants to align spend with actual adoption, but it also creates budget variability as engagement grows.
This model often behaves differently from flat enterprise licensing. A customer may begin with a modest pilot and then see a step-up in spend once the product spreads across business units, partners, or multiple workflows. That makes forecasting and renewal planning more important than in fixed-fee arrangements.
How monthly active usage is measured
The definition of a monthly active user should be read carefully in the contract and billing terms. Vendors may count any authenticated user, only users who complete a defined action, or users who are active within a specified time window. Small wording differences can materially change the commercial result.
Measurement also depends on visibility into the application itself. If a product is used through multiple integrations, embedded interfaces, or delegated workflows, organisations should confirm whether those interactions increment the active-user total. Ambiguity here is a common source of billing disputes.
For a broader security and governance lens on how usage, access, and control boundaries are managed, see NIST Cybersecurity Framework 2.0, which helps teams align governance, identify, protect, detect, respond, and recover activities around service consumption.
Commercial and governance trade-offs
Per-MAU pricing can reward product success, but it can also create concentration risk on the customer side. One large deployment, department rollout, or enterprise expansion may materially alter spend with little advance warning if usage is not monitored continuously.
It also affects internal governance. Finance, procurement, and platform owners need a shared view of what drives usage growth, who can enable new users, and how exceptions are approved. If those controls are weak, a pricing model intended to match value can become a source of surprise cost escalation.
When organisations want stronger control over access and usage boundaries, identity and least-privilege practices can support better measurement and containment. NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference point for access, audit, and configuration controls that help make usage-based billing more observable.
Risk and Threat Considerations
Per-MAU pricing can create exposure when billing is tied to a metric that is easy to inflate, miscount, or manipulate. If active-user logic is unclear, organisations may overpay for usage they did not expect, or miss activity that should have been excluded under the contract.
Failure mechanism: Ambiguous metering, shared accounts, automated access, or poor usage governance can distort the MAU count, turning a commercial model into a billing and accountability problem.
Impact: The result can be unplanned spend, dispute risk, weak forecasting, and incentives to suppress legitimate adoption or, conversely, to allow uncontrolled expansion without commercial review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Per-MAU pricing depends on knowing how the service is used and who drives cost. |
| GV.RM-01 — Risk Management Strategy | Usage-linked pricing introduces forecast and concentration risk that should be governed. | |
| ID.AM-01 — Physical Devices and Systems Inventory | Accurate monthly active user billing depends on knowing the systems and user surfaces involved. | |
| Recommendation — Define the business context for usage-based pricing and align ownership for metering decisions. Incorporate usage-driven cost variability into vendor and budget risk management. Maintain an accurate inventory of systems and access paths that affect usage metering. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Reliable MAU measurement depends on auditable events that show actual product use. |
| AC-2 — Account Management | User activation, deactivation, and shared-account handling directly affect MAU counts. | |
| CM-8 — System Component Inventory | Usage-based licensing needs visibility into the surfaces and integrations that can generate activity. | |
| Recommendation — Log the events needed to validate monthly active user counts and billing disputes. Govern account lifecycle so billing counts reflect intended access rather than unmanaged accounts. Track the application components and integrations that can contribute to measured usage. | ||
Practitioner Guidance
What to watch for: The key operational issue is whether the definition of “active” matches how people actually use the product. If users authenticate through multiple surfaces, if guest access is common, or if automation touches the system, the billing basis may need explicit governance.
Practitioner takeaway: Treat per-MAU pricing as both a commercial and telemetry problem, because the organisations that manage usage visibility well are usually the ones that avoid surprise renewal costs.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 21, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org