Per-user pricing is a charging model where a customer pays a fixed amount for each named user on a licence or subscription. It is common in software and SaaS contracts, and the count of assigned accounts usually determines the bill, regardless of how much each person uses the service.
How Per-User Pricing Works
Per-user pricing charges a fixed fee for each named account on a licence or subscription. The billing unit is the assigned user, not actual usage volume, so the contract price rises or falls with headcount and licence allocation.
This model is straightforward to understand and forecast, which is why it is common in SaaS and enterprise software. It can also create a strong incentive to keep user counts accurate, because billing, access provisioning, and contract compliance all hinge on who is counted as a user.
Why Organisations Use It
Vendors often prefer per-user pricing because it scales revenue with adoption and creates a simple commercial yardstick. Customers may accept it because it is easy to explain to finance, procurement, and operations, especially when the service is used by a stable group of employees or contractors.
The model works best when the organisation can clearly define who qualifies as a named user and can keep that inventory current. If user populations change frequently, the pricing model can become expensive or operationally awkward even when the software itself is valuable.
Where Billing, Access, and Governance Intersect
Per-user pricing sits close to identity governance because the commercial object being billed is an account record. That makes joiner, mover, and leaver discipline important, since stale or duplicate accounts can inflate cost even when they no longer reflect real business use. In practice, the organisation needs a clean relationship between authorised users and billable users.
That same relationship also matters for control enforcement. If access is granted broadly but billing is based on named seats, the licence record can drift away from the actual access estate. A service that tracks accounts accurately helps finance, procurement, and security see the same population rather than three different versions of it.
For organisations that manage this carefully, the commercial model becomes a governance signal as much as a pricing term. It can reveal whether account lifecycle processes are disciplined, whether unused seats are reclaimed, and whether access entitlements align with actual business need.
Common Failure Modes and Commercial Trade-Offs
The main trade-off is predictability versus efficiency. Per-user pricing is easy to budget for, but it can penalise organisations with seasonal staff, external collaborators, or sporadic users who still need occasional access. It can also encourage seat hoarding if teams retain licences “just in case” rather than releasing them promptly.
Another failure mode is definition drift. If a contract says “named user” but the organisation allows shared usage, unreviewed service logins, or multiple people behind one account, the billing model and the control model both become unreliable. The result is usually a combination of compliance ambiguity, cost leakage, and weak accountability.
Risk and Threat Considerations
Per-user pricing can create cost exposure when account inventories are inaccurate, stale accounts are not removed, or licence assignments are not reviewed regularly. The risk is usually financial and governance-related, but it can also mask access sprawl when old accounts remain active after they should have been reclaimed.
Failure mechanism: Organisations lose visibility into the true count of active named users, so billing, entitlement review, and offboarding drift apart. That can leave unused seats paying for itself while inactive accounts remain available longer than intended.
Impact: The organisation may overpay, fail internal licence-compliance checks, and retain unnecessary access paths that complicate investigation, audits, and access governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Named-user billing depends on accurate account lifecycle control. |
| Recommendation — Align licence assignment with AC-2 account lifecycle reviews and deprovision unused users promptly. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | Per-user pricing relies on an accurate inventory of billable accounts and assigned users. |
| Recommendation — Maintain an authoritative inventory of active user accounts and reconcile it to licences. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Seat-based billing is governed by who is authorised to hold an account and access the service. |
| Recommendation — Review access rights regularly so billable users match authorised users. | ||
| CIS Controls v8 | CIS-5 — Account Management | This pricing model exposes the need for disciplined user account management and removal of stale access. |
| Recommendation — Automate account lifecycle management to remove dormant users and avoid licence drift. | ||
Practitioner Guidance
Why practitioners should care: Treat per-user pricing as both a commercial model and an access-governance control point. The same user inventory should support procurement, renewal decisions, and account lifecycle management, or else cost and access data will diverge.
What to watch for: Look for shared accounts, orphaned seats, and licences that remain assigned after role changes or departures. Those are the usual signs that the billing model is no longer aligned with the real user population.
Practitioner takeaway: The best per-user pricing arrangements are backed by disciplined identity administration, because accurate seat counts protect both the budget and the access model.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org