Okta vs Auth0 vs Microsoft Entra: Identity Pricing, SSO/SAML Ceilings & Monthly Cost Math

Identity has three price tags, and they are not the same unit

The three vendors here charge for identity in three different units: Okta per employee per month, Microsoft Entra ID per user per month, and Auth0 per monthly active user — a customer who signs in at least once in the month, not every account in the database. This playbook converts the units: the same headcounts priced three ways, the SSO and MFA ceilings that force an upgrade, and the break-evens where cheap stops being cheap.

Okta is the workforce specialist that also owns Auth0. Auth0 is the developer-first customer identity platform, with a generous free tier and a B2C/B2B split that matters more than price. Microsoft Entra ID, the renamed Azure Active Directory, is the identity layer of Microsoft 365 — and for companies already on Microsoft 365, E3 includes P1 and E5 includes P2.

Workforce identity: Okta vs Entra ID, per seat

Okta's Workforce Identity suites are billed annually, with a $1,500 annual minimum. Starter costs $6 per user per month and includes Single Sign-On, Multi-Factor Authentication, Universal Directory and 5 Workflows. Core Essentials is listed on the compare table at $14, with no separate feature breakdown. Essentials costs $17 and adds Adaptive MFA, Privileged Access, Lifecycle Management, Access Governance and 50 Workflows. Professional and Enterprise are priced on enquiry, adding Device Access, Identity Security Posture Management and Identity Threat Protection (Professional) and API Access Management, Access Gateway and machine-to-machine tokens (Enterprise).

Entra ID Free costs $0 and includes MFA, unlimited SSO and password self-service. P1 costs $7.00 per user per month, paid yearly, and adds Conditional Access, passwordless, phishing-resistant authentication, hybrid identity and self-service. P2 costs $10.00 and adds Identity Protection, risk-based Conditional Access, Privileged Identity Management, basic entitlement management and access reviews. The Entra Suite costs $12.00 on top of P1, so the combined price is $19, and adds Identity Governance, Global Secure Access, Verified ID and Private Access. Microsoft 365 E3 includes P1 and E5 includes P2 — the key fact for any company already on Microsoft 365.

The workforce math at 100, 1,000 and 10,000 users

At the entry tier Okta undercuts Entra by $1 a user: $6,000 against $7,000 a month at 1,000 users, a $12,000 annual gap. At the advanced tier the order flips: Okta Essentials at $17 against Entra P2 at $10 is a $7 per-user gap — $7,000 a month, $84,000 a year, at 1,000 users. The two are not the same product: Essentials brings Lifecycle Management and Access Governance; P2 brings Identity Protection and Privileged Identity Management — for $7 a user less. Okta's $1,500 annual minimum binds only below about 21 Starter seats ($6 × 21 × 12 = $1,512). And the Microsoft 365 bundle: a company on E3 already holds P1, and on E5 already holds P2, so Entra's marginal cost is $0. The honest comparison for a Microsoft 365 shop is Okta's price against $0; anywhere else, Entra's $7 and $10 are real money, and Okta Starter at $6 is cheaper.

Customer identity: Auth0 vs Okta vs Entra External ID

Auth0's B2C plans, read on its pricing page, monthly billing selected: Free at $0 a month for up to 25,000 MAU, with 1 custom domain, 5 organisations, 1 enterprise connection, self-service SSO and SCIM; Essentials at $35 a month for up to 500 MAU, adding Pro MFA, role-based access control and 10 organisations; Professional at $240 a month for up to 500 MAU, adding custom database connections, enterprise MFA, custom token exchange and attack protection; Enterprise on enquiry with a 99.99% SLA.

The higher MAU rungs are derived from Auth0's own pricing definitions on the same page — per-MAU rates with volume discounts at the calculator's tier breakpoints: B2C Essentials is $700 a month at 10,000 MAU and $2,100 at 30,000; B2C Professional is $1,600 at 10,000. The B2B plans start at $150 a month for B2B Essentials (500 MAU, 3 enterprise connections) and $800 for B2B Professional (500 MAU, 5 connections), rising to $2,100 and $2,400 at 10,000 MAU. Extra enterprise connections cost $100 a month each, up to 30. Professional plans bill from a 1,000-MAU floor, so the $240 and $800 figures are the 1,000-MAU tier prices.

B2C Essentials is flat at $0.07 per MAU from 500 to 30,000. The other plans get cheaper per MAU as volume grows. Auth0 bills in discrete MAU tiers, so a count between tiers is billed at the next tier up.

Okta Customer Identity plays a different game. It starts with a required Enterprise base platform at $3,000 a month, billed annually — $36,000 a year before usage-based add-ons, priced on MAU at unpublished rates. The B2C and B2B Suites on top of the base are priced on enquiry. At 10,000 MAU, Okta's base alone is about 4.3 times Auth0 B2C Essentials at $700 a month. That multiple buys unlimited OIDC and outbound SAML apps, enterprise-grade SLAs and Okta's governance depth.

Entra External ID is the cheapest customer identity here for almost everyone: its first 50,000 MAU are free every month, so at 10,000 MAU sign-in costs $0. Beyond the free tier the price is pay-as-you-go; a P1 rate of $0.00325 per MAU (Microsoft licensing documentation, reported March 2026 and corroborated by independent October 2026 reads — confirm on the Azure pricing page first) puts 100,000 MAU at:

The 50,000 free MAU cover sign-in, not governance. Entra ID Governance bills guests separately at $0.75 per guest per month (Microsoft licensing documentation, reported October 2026 and corroborated across independent reads), with no free tier — 1,000 governed guests cost $750 a month.

SSO, SAML and MFA ceilings

The Auth0 B2C trap is the sharpest edge here. Free includes an enterprise connection, self-service SSO and SCIM — then the paid B2C plans remove them: the page states "Upgrade to B2B to continue using EC, Self-Service SSO, and SCIM." A startup that builds on Free and buys B2C Essentials past 25,000 MAU must move to B2B Essentials at $150 a month to keep the SSO connection it already had. Budget the B2B plan from the start if any enterprise customer will ask for SAML.

The two B2B plans never cross. With n enterprise customers each needing one connection:

The gap is a constant $450. At 10 enterprise customers, Essentials costs $850 a month and Professional costs $1,300. Professional is never the cheaper way to buy SSO connections — it is bought for its features, never for the connection count.

Who each vendor fits — and who should avoid it

Okta Workforce Identity fits a company whose workforce lives across many SaaS apps and needs lifecycle automation — joiner-mover-leaver provisioning, access reviews and governance in one suite, with SSO and MFA from the cheapest tier. It does not fit a company already on Microsoft 365 E3 or E5, where Entra P1 or P2 is already paid for; nor a consumer app with 10,000 users, where the $3,000-a-month base is 4.3 times Auth0's price.

Auth0 fits a developer-led team shipping a consumer or B2B SaaS product that needs login this week: Free covers 25,000 MAU, the paid tiers are self-serve, and B2B plans package organisations and enterprise connections. It does not fit a team needing predictable pricing past 30,000 MAU, where the calculator stops printing prices; nor a team whose enterprise customers each need SAML but whose budget assumed the $35 B2C price — the real price is the $150 B2B plan plus $100 per connection.

Microsoft Entra ID fits any organisation on Microsoft 365, where P1 or P2 is already in the bundle, and any B2B collaboration scenario under 50,000 external MAU, where External ID sign-in is free. It does not fit a company with no Microsoft estate that needs deep customer-identity customisation — the B2C story is External ID plus code — nor a team needing guest governance without budgeting the $0.75-per-guest meter.

Execution checklist

• [x] Step 1: Count the right unit. List employees and monthly active users separately; never price MAU with a per-seat rate or seats with a per-MAU rate.
• [x] Step 2: Check the bundle first. If Microsoft 365 E3 (includes P1) or E5 (includes P2) is already paid for, Entra's marginal cost is $0.
• [x] Step 3: Price the security policy, not the entry tier. On Okta that means Essentials at $17, not Starter at $6; on Entra, P2 at $10; on Auth0, B2B not B2C.
• [x] Step 4: Count enterprise SSO customers. Multiply SAML-asking customers by $100 a month on Auth0 B2B, and check the 3- and 5-connection inclusions first.
• [x] Step 5: Model the tier above your MAU. Auth0 bills in discrete MAU tiers, so price the next tier up and confirm it on the vendor page on the day you buy.
• [x] Step 6: Price both Entra meters. External ID sign-in is free to 50,000 MAU; Entra ID Governance for guests is a separate reported $0.75 per guest monthly.
• [x] Step 7: Confirm the deletion and log story in writing. Get the vendor's log-retention period and deletion handling across logs and backups in the contract.
• [x] Step 8: Run the break-even before signing. Use our break-even calculator to compare annual totals at 100, 1,000 and 10,000 users, including the add-ons from Steps 3–4.

What this comparison does not cover

Two figures rest on Microsoft licensing documentation as reported and corroborated across independent October 2026 reads, and are labelled as such wherever they appear: Entra's $0.00325-per-MAU rate and its $0.75-per-guest governance rate beyond the free tiers. Auth0's MAU prices are derived from Auth0's own pricing definitions on its pricing page, read this cycle; the $100-per-month extra enterprise connection price is in the same definitions. Okta's Professional and Enterprise suites and Auth0's Enterprise plan are priced on enquiry — get a written quote. All vendor-page figures were read on 8 November 2026; re-check the pricing page before you buy. For the advertising side of the same budgeting question, see our Google Ads vs Meta Ads playbook.