Okta is hired to be the front door: one sign-in for the company's applications, with accounts created and removed as people come and go. That also makes it the hardest line in this section to leave. Below: the Workforce prices as published, the one open-source option we verified, and a staged way to move that never leaves people locked out.
Single sign-on is wired into every application. Joiners, leavers and access reviews run through it, and an auditor or a large customer may have been shown it as evidence of control. Removing it touches everything at once.
The pricing page describes annual billing, and a contract with a renewal date means the decision arrives once a year, often when nobody is looking. Seat counts rise as people are added and rarely fall as they leave.
Only alternatives we have checked. An open-source project is listed with the license its repository reports, on the date shown; one whose license could not be read as a single standard id is not offered as open source. Read the license guide before running any of them.
| Alternative | Kind | License | Read from |
|---|---|---|---|
| Keycloak | Open source | Apache-2.0 | Keycloak repositoryChecked Oct 25, 2026 |
Each feature below is what the product's own page or README says, linked to where we read it on the date shown. Pros and cons are limited to what those pages state and to what the path itself changes. We do not rank products on quality.
| Plan | Price as published | Includes | Read from |
|---|---|---|---|
| Workforce Identity Starter | $6 per user per month, billed annually | Single sign-on, multi-factor authentication, Universal Directory and 5 Workflows, as listed. | Okta pricingChecked Oct 25, 2026 |
| Workforce Identity Essentials | $17 per user per month, billed annually | Everything in Starter, plus Adaptive MFA, Privileged Access, Lifecycle Management, Access Governance and 50 Workflows, as listed. The page's call to action is contact us. | Okta pricingChecked Oct 25, 2026 |
List prices as printed on the vendor's page on the checked date, in US dollars per user per month, billed annually, excluding tax. They may differ at checkout. Okta's page listed a $1,500 annual contract minimum for Workforce Identity. Other plans and the Customer Identity products were not priced and are left out.
Single sign-on sits in front of every other tool, so a mistake does not break one app, it breaks all of them at once. We rate this job hard, and we mean it: for a small company it can still be worth doing, but it is a project for a person who knows identity, not a weekend task.
Keycloak, an open-source identity server, is the alternative we verified. Its repository lists the Apache-2.0 license on the checked date, which has its own terms you should read. Running it makes you the operator of the front door: patching, backups, uptime and the security of the server are yours. Also check each application you use supports the sign-in standard Keycloak offers before you count on it. If your only need is shared logins, a password vault may cover the job at a lower risk.
Samples are made up and are not Okta's prices. Type in the figures from your own invoice or order form.
The honest yearly cost of running open-source software yourself, set against the bill it replaces, with the seat count where it stops paying.
Paid seats against seats in use: what the idle ones cost a year, and what you save by right-sizing at renewal.
Arithmetic only, not tax, accounting or legal advice. Check the figures against your own order form.
Run the old and the new sign-in side by side, move applications one at a time, and cancel only when nothing depends on the old one.
List every application that uses single sign-on, how it connects, who administers it, and whether it has a local administrator login that works without it.
Record who is provisioned automatically, which groups grant which access, and which multi-factor methods people use. Write the joiner and leaver process down as it works today.
Name an owner and a backup. Decide where the new server runs, how it is patched and backed up, and who answers when it is down. If nobody can do this, choose a hosted product instead.
Stand up the new system and connect one low-risk internal application. Sign in with two or three volunteers, including a lost-phone recovery test.
Move applications in small batches, in order of risk. After each batch, confirm that every user can sign in and that a leaver loses access on the same day.
Keep separate administrator logins for banking, cloud consoles and the accounting system in a vault with two holders, so a failed cutover can be reversed.
Run both for at least one full cycle of joiners, leavers and a close. Export the logs you must keep, then end the contract inside its notice window.
Run the vendor report for QuickBooks Online or Xero, then open the free audit.
General information, not legal advice. See cancelling without penalties. Last reviewed Oct 25, 2026. Product names belong to their owners and are used only to identify them.
Send us the export and see which lines are worth a second look. A connected version is planned. Okta is one of the lines worth a look.
Worked example. Type over it.
Result
| Self-hosting, per year | Amount |
|---|---|
| Hosting, backups, tooling | 720.00 |
| Admin and restore-test time | 2,640.00 |
| Total | 3,360.00 |
| One-off set-up (not in the yearly total) | 1,200.00 |
The saving holds only if the time is real. Price the admin hours at what that person's time costs the company, not at zero.
Worked example. Type over it.
Result
“In use” is your call: last sign-in in the past 30 or 90 days from the vendor's admin report. A seat for someone on leave is not idle.