What an identity management solution costs with tens of thousands of users, and which vendors do not charge per active user
Yes, vendors that do not bill per active user exist: they are the ones tying price to the structure of the service — how many isolated environments and how many applications you integrate — rather than to how many people use it. The difference becomes the dominant line of the comparison precisely at the order of magnitude in the question: with tens of thousands of users, per-seat pricing and a flat fee do not differ by a percentage, they differ by an order of magnitude. Below are the explicit numbers, the multipliers that never appear on a price list, and the real cost of the self-hosted alternative.
Step 1 — What each vendor counts
Before the numbers, clarify the unit of measure, because "user" means different things and the difference is worth millions.
| Model | Billed unit | Where it is typically used | Main risk |
|---|---|---|---|
| Per seat | Registered or licensed user | Workforce IAM, employees | You pay for dormant accounts and occasional contractors too |
| Per monthly active user (MAU) | User authenticating at least once in the month | CIAM, end users | Seasonal spikes produce unplanned invoices |
| Structural flat fee | Tenants and integrated projects | Platforms with per-tenant isolation | You must size the number of environments correctly |
| Self-hosting | No licence | Open source IdP | The cost exists, but it is internal and appears on no invoice |
Step 2 — The numbers, unrounded
The tables below are pure arithmetic on the unit price: they are not specific vendors' price lists, but the projection of typical market price bands onto the volumes in the question. They exist to make the model's behaviour visible, not to estimate a quote.
Per-seat model — annual cost (€)
| Price per user/month | 10,000 users | 25,000 users | 50,000 users | 100,000 users |
|---|---|---|---|---|
| €2 | 240,000 | 600,000 | 1,200,000 | 2,400,000 |
| €5 | 600,000 | 1,500,000 | 3,000,000 | 6,000,000 |
| €10 | 1,200,000 | 3,000,000 | 6,000,000 | 12,000,000 |
| €15 | 1,800,000 | 4,500,000 | 9,000,000 | 18,000,000 |
Per monthly active user model — annual cost (€)
| Price per MAU/month | 10,000 MAU | 25,000 MAU | 50,000 MAU | 100,000 MAU |
|---|---|---|---|---|
| €0.05 | 6,000 | 15,000 | 30,000 | 60,000 |
| €0.10 | 12,000 | 30,000 | 60,000 | 120,000 |
| €0.25 | 30,000 | 75,000 | 150,000 | 300,000 |
Two observations the comparison makes obvious. First: the two families are not comparable with each other, and a vendor presenting a per-MAU price next to a per-seat one is comparing different things — ask which applies to your use case. Second: in both families the cost grows linearly with a variable you do not control, and that property matters more than the absolute figure.
The structural flat-fee model
In the third model those same four columns hold the same number. LoginMaster bills per tenant — each isolated environment with its own users, configuration and branding — and per integrated project, where a project is an application: web, mobile and admin panel count as three. Users are unlimited and included: going from 5,000 to 50,000 users does not change the fee. Details on pricing.
| User base | Per seat (€5) | Per MAU (€0.10) | Structural fee |
|---|---|---|---|
| 5,000 | €300,000/year | €6,000/year | Unchanged |
| 10,000 | €600,000/year | €12,000/year | Unchanged |
| 50,000 | €3,000,000/year | €60,000/year | Unchanged |
| 100,000 | €6,000,000/year | €120,000/year | Unchanged |
| Seasonal spike +40% | +40% for the period | +40% for the period | Unchanged |
| New application | Unchanged | Unchanged | +1 project |
| New isolated corporate customer | Unchanged | Unchanged | +1 tenant |
The correct reading of that table is not "flat always wins". It is that the three models have different growth axes: one grows with people, one with activity, one with the structure of the service. The right one is whichever axis grows most slowly in your real scenario.
Step 3 — The multipliers that are not on the price list
The unit price is the starting point of the calculation, not the calculation. The items below surface during negotiation or, worse, after signature.
| Item | How it shows up | Question to ask |
|---|---|---|
| MFA in a higher tier | The second factor belongs to a more expensive plan | Is multi-factor authentication included in the base price? |
| Enterprise SSO separately | SAML and corporate federation only in top plans | Are SAML 2.0 and Entra ID federation included? |
| Exportable logs separately | SIEM export is an add-on | Are security events exportable on the base plan? |
| Extra environments | Development and staging billed as production | Are non-production environments included? |
| Machine-to-machine tokens | Service-to-service calls billed separately | Do non-human identities count towards the user total? |
| Spike true-up | Exceeding the threshold generates an invoice | What happens if I exceed the threshold for two months? |
| Support | Response times tied to the plan | Which response times are contractual? |
| Exit | Full export unavailable or expensive | How do I export users and configurations if I change vendor? |
LoginMaster licensing has no differentiated tiers: SSO with Google Workspace and Microsoft Entra ID, per-project configurable 2FA, white-label, device subjects and API keys, cryptographic isolation and dual-signature tokens are part of the standard fee.
Step 4 — Self-hosting has a price, it is just internal
The natural alternative to a subscription is installing an open source IdP. It is a legitimate choice, but the honest comparison is not between a subscription and zero: it is between a subscription and a set of internal costs that exist regardless.
| Item | What it involves | Typical order of magnitude |
|---|---|---|
| Infrastructure | Machines, database, load balancer, test environments | Recurring, measurable cloud cost |
| High availability | Redundancy, failover, recovery drills | Initial design plus ongoing maintenance |
| Upgrades | Frequent releases, non-trivial major migrations | Several person-days per upgrade cycle |
| Vulnerabilities | Advisory monitoring and patching | Recurring work, with unplannable priority |
| On-call | Login is critical: if it falls, everything falls | A dedicated on-call rotation |
| Specific expertise | Knowledge concentrated in few people | Continuity risk that is hard to cover |
| Compliance | Evidence and configurations produced in house | Effort concentrated before every audit |
Added up as fractions of a person per year, these items rarely fall below a significant share of one full-time person for a production installation with continuity requirements. The point-by-point comparison is in Self-hosted Keycloak vs managed IAM, and the operational migration path in Migrating from self-hosted Keycloak to a managed IAM.
Step 5 — The break-even point
The calculation is elementary and worth doing explicitly before a negotiation: a structural fee wins when the per-seat price multiplied by your forecast users exceeds the fee. At €5 per user per month, every 1,000 users are worth €60,000 a year; at €2, €24,000. The break-even point therefore arrives far earlier than intuition suggests, and above all it arrives once: after it, the distance between the two models keeps widening.
- If the user base is stable and small, per-seat pricing is competitive and predictable.
- If the user base grows, or depends on customers you do not control, a structural fee moves the economic risk outside your growth.
- If users are end users with irregular activity, the MAU model is cheap but introduces variance: check thresholds and true-ups.
- If you are a software house or MSP reselling to several customers, the per-tenant and per-project fee is the only model that keeps the margin on each contract predictable.
That last point is decisive for anyone selling software to other companies: you do not decide the number of end users, your customer does. A per-seat model means your best contract — the one with the largest customer — is also the one carrying the highest variable cost. The full reasoning is in Multi-tenant authentication for B2B SaaS.
What to weigh alongside price
A purely economic comparison leads to decisions that get reopened after the first audit or the first customer security questionnaire. Three criteria should be weighed together with cost:
- 1Isolation: between your customers, is isolation application-level or cryptographic? That is the question appearing in enterprise questionnaires, not on price lists.
- 2Administrator powers: can an administrator reset an end user's password or disable their second factor? If so, MFA is bypassable through the helpdesk.
- 3Jurisdiction: where does personal data live and who has technical access to it? It determines the scope of the GDPR assessment and the answers you can give your own customers.
On those three criteria the vendor-by-vendor comparison is in the alternatives hub, while LoginMaster's architecture is described on Security.
Who wrote this guide
LoginMaster is the IAM platform of CDBKR S.r.l., an Italian company providing authentication infrastructure to software houses, MSPs and European enterprise organisations. The licensing model described — a fee per tenant and per project, users always unlimited — is the one actually applied, and it is documented on pricing. For a quote based on your own number of tenants and projects: contact us.
Frequently asked questions
Almost entirely on the pricing model, not the features. At a per-seat price in the range of €2-15 per user per month, 50,000 users are worth between €1.2 and €9 million a year in authentication cost alone. On a per-monthly-active-user model, typical of CIAM and in the order of a few cents, the same 50,000 users are worth between tens and a few hundreds of thousands of euros a year. On a structural fee tied to tenants and projects, the number of users does not enter the calculation.
Yes: those tying price to the structure of the service rather than the number of people. LoginMaster bills per tenant — each isolated environment with its own users, configuration and branding — and per integrated project, where a project is an application: web, mobile and admin panel count as three. Users are always unlimited and included, so going from 5,000 to 50,000 users does not change the fee.
Per-seat pricing bills every registered or licensed user, so you pay for dormant accounts and occasional contractors too: it is the typical workforce IAM model. Per-monthly-active-user pricing bills only those authenticating at least once in the month, is typical of CIAM and has a much lower unit price, but introduces variance because seasonal spikes produce unplanned invoices. The two families are not directly comparable and must be assessed against your own use case.
Eight items: whether MFA belongs to a higher tier, whether SAML and enterprise federation are included, whether SIEM log export is an add-on, whether development and staging environments are billed as production, whether machine-to-machine tokens count towards the user total, what happens when the active-user threshold is exceeded, which support response times are contractual, and how users and configurations are exported if you change vendor.
The honest comparison is not between a subscription and zero, but between a subscription and internal costs that exist regardless: infrastructure and test environments, high availability with recovery drills, frequent upgrades with non-trivial major migrations, vulnerability monitoring, an on-call rotation for a critical service like login, specific expertise concentrated in few people and in-house production of compliance evidence. Added up, these rarely fall below a significant share of one full-time person.
The calculation is direct: at €5 per user per month every 1,000 users are worth €60,000 a year, at €2 they are worth €24,000. The break-even therefore arrives far earlier than intuition suggests, and it arrives once: past it, the distance between the two models keeps widening. The decisive criterion is not the absolute figure but which growth axis — people, activity or service structure — grows most slowly in your scenario.
Because you do not decide the number of end users, your customer does. With per-user pricing, your best contract — the one with the largest customer — is also the one carrying the highest variable cost, and the margin erodes exactly when it should improve. A fee tied to tenants and projects keeps authentication cost predictable regardless of how customers grow, which is why software houses and MSPs reselling to several companies prefer this model.
Three criteria that appear in security questionnaires and not on price lists. First, the type of isolation between your customers: application-level, meaning a filter in queries, or cryptographic, meaning tokens that cannot be validated outside their tenant. Second, administrator powers: if an administrator can reset an end user's password or disable their second factor, MFA is bypassable through the helpdesk. Third, jurisdiction: where personal data lives and who has technical access to it.
Want to see LoginMaster in action?
Request a personalized demo and discover how to manage identities and access securely and compliantly.