identity

Okta

Okta is an identity provider for workforce and customer authentication. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Okta stores identities and authenticates them, then asserts the result to applications over SAML or OIDC. The value is the catalogue: thousands of pre-built integrations mean a new SaaS tool is connected by configuration rather than by writing an auth flow.

The lifecycle features are the second half. Joiner-mover-leaver provisioning, group-based access rules and automated deprovisioning are what make an identity provider an operational tool rather than a login page.

How pricing works once you are inside

Per user, per month, with tiers that differ mainly in the authentication factors and the governance features they include. Universal Directory, MFA and lifecycle management are separate line items on the lower tiers, which is where the quoted price and the real price diverge.

The number that surprises finance is the customer identity product, which is priced separately and on a different scale because it counts external users. A business with a million customers is not paying workforce rates for them.

Where it breaks down

Cost at scale. Per-user pricing is comfortable at five hundred employees and uncomfortable at fifty thousand, and the enterprise negotiation is where that gets addressed.

The other limit is that Okta is an availability dependency. If it is unreachable and a session expires, users cannot log in to anything. Organisations plan for that with session length and break-glass accounts rather than with redundancy.

What switching costs

High. Identities migrate, but every application integration, group mapping and provisioning rule is Okta-specific and has to be rebuilt.

Sources

Okta public documentation and pricing page, read October 2026.