Identity is the one line in this library where the do-it-yourself alternative is genuinely worse at almost any price. At 100–1,000 people you have more SaaS applications than you have security engineers, an audit coming, and a leaver problem: every app someone still has access to a month after they resigned is a finding waiting to happen. A directory with SSO in front of it is not a productivity purchase, it is a control.
So the call is Buy, and the money is entirely in which suite. Okta publishes three prices for Workforce Identity — Starter at $6 per user per month, Core Essentials at $14 and Essentials at $17, all billed annually — and the two upper suites are where lifecycle management, access governance, adaptive MFA and privileged access live. That is a $6-to-$17 spread on a meter that counts every identity in the company, which at 500 people is the difference between $36,000 and $102,000 a year.
The trap is not that the upper suites are bad. It is that their value is labour you have to redirect, not software you switch on: automated joiner-mover-leaver only pays if somebody wires it to your HR system and maintains the mappings. Buy the suite whose control you can name, staff and evidence this quarter — and buy the next one when you can name the next control.
The money, named
What you pay. Okta publishes three Workforce Identity suite prices and two "inquire for pricing" tiers. The published ones, read 30 August 2026: Starter $6 per user per month (single sign-on, multi-factor authentication, Universal Directory, 5 Workflows), Core Essentials $14, and Essentials $17 (everything in Starter plus adaptive MFA, privileged access, lifecycle management, access governance and 50 Workflows). The footnote on the same page states that all suites are billed annually and a $1,500 annual contract minimum applies. Professional and Enterprise are quote-only, and are therefore absent from every figure below.
| Suite | List price | 250 identities / yr | 500 identities / yr | 1,000 identities / yr |
|---|---|---|---|---|
| Starter | $6 / user / mo | $18,000 | $36,000 | $72,000 |
| Core Essentials | $14 / user / mo | $42,000 | $84,000 | $168,000 |
| Essentials | $17 / user / mo | $51,000 | $102,000 | $204,000 |
| Professional | inquire for pricing | — | — | — |
| Enterprise | inquire for pricing | — | — | — |
Three things fall straight out of that table. The Starter-to-Essentials step is $66,000 a year at 500 identities and $132,000 at 1,000. The Core-Essentials-to-Essentials step — the one that buys governance on top of automation — is a much smaller $18,000 a year at 500. And every identity you provision and forget costs $204 a year on Essentials, so fifty stale accounts is $10,200 a year for access you actively do not want to exist.
What the upgrade has to beat. There is no per-engineer break-even for identity, so use the one that is actually decidable — the labour the automation replaces:
Core Essentials -> Essentials, 500 identities ($17 - $14) x 500 x 12 = $18,000 / year
$18,000 / $90 per hour ( = $180,000 / 2,000) = 200 hours / year
= 3.8 hours per week
Starter -> Essentials, 500 identities ($17 - $6) x 500 x 12 = $66,000 / year
$66,000 / $90 per hour = 733 hours / year
= 14 hours per weekThose two bars are very different, and that is the whole point of pricing it this way. Three-point-eight hours a week of IT and security time is a bar that joiner-mover-leaver automation and access reviews clear comfortably in an org with real turnover. Fourteen hours a week is a bar you should insist on seeing evidence for — and if your provisioning today is one person doing tickets by hand for two hours a week, you have just discovered that the honest answer is Starter plus a written plan, not Essentials plus hope.
What it can cost you. The two published mechanics that produce surprises are the annual commitment and the definition of a user. Okta bills annually, so the suite you pick is the suite you own for twelve months — there is no mid-year climb-down. And Workforce Identity counts every identity you provision, which in a 500-engineer company is rarely 500 people: it is employees plus contractors plus the support vendor plus the accounts nobody closed. Headcount is the wrong input; your directory is the right one.
The reason, at this size
1. The meter is the whole company, not the engineering org.
Almost every other tool on your renewals list is bought by and for engineers. Identity is not: sales, finance, support and the contractors all need SSO, and they all appear on the same per-user line. This is why identity budgets surprise engineering leaders who sized them from an engineering headcount — a 500-engineer company can easily be provisioning 800 identities.
The practical consequence is that your identity spend is the most accurate headcount forecast in the business, and the most sensitive to sloppiness about who counts. Before any renewal, reconcile the directory against the HR system of record. At $204 per identity per year on Essentials, that reconciliation is one of the few security jobs with a directly measurable payback.
2. What separates the suites is labour, not features.
Okta's published suite breakdown puts single sign-on, MFA and Universal Directory in Starter, and adds adaptive MFA, privileged access, lifecycle management, access governance and 50 Workflows in Essentials. Read as a feature list, that looks like an obvious upgrade. Read as a work plan, it is four projects: HR-driven provisioning, an app-by-app entitlement model, an access-review cadence with named reviewers, and a workflow estate somebody has to maintain.
Buy the tier you can staff. An unstaffed Essentials subscription performs exactly like a staffed Starter one, at nearly three times the price. And the sequencing matters: SSO and MFA everywhere is worth more than governance on half your apps, so Starter fully rolled out beats Essentials rolled out to your top ten applications.
3. Deprovisioning is the control that pays for itself twice.
It is worth being blunt about this, because it is the strongest argument for the upper suite and it is almost never made in dollar terms. Every leaver whose access persists is both a security exposure and a line on your bill — on Okta at $204 a year, and again on every downstream tool that is billed per seat. A stale identity at a company running Jira, GitHub, Slack, an observability platform and a CRM is not $204, it is $204 plus five other per-seat lines.
That is the number that makes lifecycle management arguable at Essentials prices: it is not just IT hours, it is the seat licences that quietly renew for people who left in March. Count your leavers over the last twelve months, multiply by the per-seat lines they held, and you will have a real figure to put next to the $18,000 or $66,000 step — one that is specific to you, which is why we are not going to invent it here.
4. Above Essentials, there is no published price at all.
Professional (device access, identity threat protection, identity security posture management, sandbox) and Enterprise (API access management, access gateway, machine-to-machine tokens) are both listed as inquire for pricing. That means the moment your requirement is device-bound authentication or threat protection, you are in an unanchored negotiation — there is no list price to compare a quote against, and nothing on this page can help you.
The defence is preparation, not a benchmark we are unable to source honestly: bring the requirement in writing, bring your identity count, ask for the quote at both this year's count and next year's, and ask what the renewal uplift looks like in year two before you sign year one. An unpriced tier is a negotiation about your urgency; the more of it you have decided in advance, the less of it is about your urgency.
5. Workforce and customer identity are different products and different budgets.
For a B2B SaaS company the confusion is expensive in both directions. Workforce Identity is what your employees log into internal tools with, and it is what this page prices. Auth0 / Customer Identity is what your customers log into your product with, and it is a separate platform with a separate published price list and a completely different meter — it scales with your customers, not your headcount.
Never let one budget owner approve both on one line, and never size the second from the first. If your product's login is the actual question you came here with, this verdict does not answer it, and we would rather say so than blur two products into one number.
What to do instead of just buying the bigger suite
Four controls, each of which is worth more than the discount you will negotiate.
1. Reconcile the directory against HR before you count seats.
Active identities, not headcount, and not the number in last year's contract. Deactivate everything with no login in ninety days that HR does not recognise. On Essentials each one you remove is $204 a year, plus whatever downstream per-seat tools that person still holds.
2. Name the control you are buying, and who runs it.
"Lifecycle management" is not a control. "Leavers lose access to all SSO-integrated apps within one hour of the HR termination event, run by IT ops, evidenced monthly" is. If nobody will own the second sentence, buy Starter and write the sentence first — you can upgrade at renewal with better information and no penalty.
3. Sequence coverage before capability.
Every application behind SSO and MFA is worth more than governance on the ten applications you have already integrated. Get the long tail in first — it is where the abandoned admin accounts live — then decide whether the automation tier is still the next best dollar.
4. Put the annual commitment date and the identity count in the calendar.
Okta bills annually, so the only day you have leverage is the renewal. Ninety days out: the current identity count, the growth you can already see, the list of controls in place, and — if you are being quoted an unpriced tier — the written requirement. Ask for year two's uplift in the same document as year one's price.
What would change our mind
- You are under about 100 identities with fewer than twenty applications. Then your identity provider's built-in SSO (Google Workspace or Microsoft Entra, which you are already paying for) may cover the whole requirement, and the marginal control Okta adds is small relative to the line.
- You have a named compliance requirement for device-bound authentication or identity threat protection. Those live in Okta's quote-only tiers, and a documented control requirement outranks every cost comparison on this page. We can price the published suites; we cannot price yours, and we will not pretend otherwise.
- You have measured your leaver volume and it is high. Fifty leavers a year holding five per-seat tools each is a very different arithmetic from ten, and it is the strongest published-price-independent argument for the automation tier. Count it; do not assume it in either direction.
- Okta publishes a price for Professional or Enterprise. The moment there is a list price for the tiers above Essentials, the negotiation stops being unanchored and this page needs rewriting.
- You are already committed to a single-vendor identity stack from Microsoft. Entra ID's higher tiers cover much of the same ground on a bundle you may already own; that comparison is real, and it is a different page with different published prices.
What we checked
Every figure above came from a page we opened, so you can check our work before you forward this to finance.
- Okta — Plans and pricing (Workforce Identity) — Starter $6 per user per month (single sign-on, multi-factor authentication, Universal Directory, 5 Workflows); Core Essentials $14 per user per month; Essentials $17 per user per month (adds adaptive MFA, privileged access, lifecycle management, access governance, 50 Workflows); Professional and Enterprise listed as "inquire for pricing"; footnote: "All suites are billed annually. $1,500 annual contract minimum required for Okta Workforce Identity." Read 30 August 2026.
- Okta — Auth0 platform pricing (customer identity) — The separate customer-identity price list, referenced here only to make the point that workforce and customer identity are different products with different meters. No figure from it is used on this page. Read 30 August 2026.
Provenance. Every suite price, feature split and billing term on this page was read from Okta's own pricing page on 30 August 2026. The annual costs at 250, 500 and 1,000 identities, the $66,000 and $18,000 suite steps, the $204-per-identity-per-year figure and the 200-hour and 733-hour break-evens (at a $180,000 fully-loaded cost per engineer and 2,000 hours a year) are our arithmetic on those published prices, and are labelled as ours in the caption. Okta's Professional and Enterprise suites are deliberately absent from every table because Okta publishes no price for them, and no volume discount is assumed because none is published. No leaver volume, application count or identity count is assumed for your org — those are inputs you have and we do not. No sponsorship, no affiliate link, no vendor review of this page. Last reviewed 30 August 2026. Corrections: [email protected].
Questions we get asked about this one
Is Okta worth it for a 100–1,000 person engineering team?
Yes. At this size single sign-on, a real directory and MFA across every application are controls rather than conveniences, and building the equivalent in-house costs more than the licence. The decision that carries the money is the suite: Okta publishes Workforce Identity Starter at $6 per user per month, Core Essentials at $14 and Essentials at $17, all billed annually, so 500 identities is $36,000, $84,000 or $102,000 a year. Buy the smallest suite that covers a control you can name, staff and evidence this quarter.
What does Okta cost for 500 employees?
On Okta's published list prices: $36,000 a year on Starter at $6 per user per month, $84,000 on Core Essentials at $14, and $102,000 on Essentials at $17 — our arithmetic of price × 500 × 12. All suites are billed annually and there is a $1,500 annual contract minimum, which is irrelevant at this size. Note the meter counts identities, not engineers: a 500-engineer company usually provisions considerably more than 500 accounts once contractors and vendors are included, and each extra identity is $72 to $204 a year depending on suite.
Is Okta Essentials worth it over Starter?
It depends on labour you can actually redirect. The step is $66,000 a year at 500 identities, which is 733 engineer-hours at a $180,000 fully-loaded cost — about fourteen hours a week of work that lifecycle management, access governance and adaptive MFA would have to remove. The smaller step from Core Essentials to Essentials is $18,000 a year at 500 identities, or 3.8 hours a week, which is a far more achievable bar. The honest test is whether someone owns wiring provisioning to your HR system: an unstaffed Essentials subscription performs like a staffed Starter one at nearly three times the price.
How much does Okta Professional or Enterprise cost?
Okta publishes no price for either — both are listed as "inquire for pricing" on its own pricing page — so we do not quote or estimate one. That matters practically: if your requirement is device access, identity threat protection or API access management, you are negotiating without a public anchor. Bring the requirement in writing, bring your true identity count, ask for the quote at this year's and next year's counts, and get the year-two renewal uplift in the same document before signing year one.
How do we cut an Okta bill without weakening access control?
Start with the directory, not the contract. Reconcile active identities against the HR system of record and deactivate anything with no login in ninety days that HR does not recognise — at $204 a year on Essentials, plus the downstream per-seat tools each stale account still holds, that is usually the biggest single saving available. Then check you are on the right suite: if nobody owns the automation, the Essentials premium is buying capability you are not running. Then sequence application coverage ahead of capability, because SSO on the long tail of apps is worth more than governance on the ten you already integrated. None of those three weakens a control; all three shrink the bill.
Tomorrow morning, five tools you haven’t heard of yet.
This verdict is free and always will be. The newsletter is the part you pay for: five new AI tools every weekday morning, one line on what each does, one line on why it matters for a PM, and the link. Start with this morning’s issue, free.
$10/month or $96/year after 7 free days, cancel in one click · a real Adoption Brief, in full · every issue, published free · [email protected]
Other verdicts at this size
- Is Atlassian Jira worth it for a 100–1,000 person engineering team? — Yes, on Standard — the tool is not the decision at this size, the edition is. Jira Cloud Standard is $36,500 a year at 500 users and $68,500 at 1,000, and the Premium step is $26,000 and $42,000 a year for a checkbox that applies to everyone on the site.
- Is LaunchDarkly worth it for a 100–1,000 person engineering team? — Yes, once you have counted service connections and client-side MAU — neither of which is your headcount. $10 per connection per month and $8.33 per 1,000 MAU means one extra environment across 80 services costs $9,600 a year, and the governance tier is quote-only.
- Is New Relic worth it for a 100–1,000 person engineering team? — Yes, if the user-type policy is written before the contract. Full platform users are $349 a month at Pro list against $49 for a core user, so fifty misassigned people cost $180,000 a year — several times the $0.40-per-GB data line everyone actually negotiates.
- Is PagerDuty worth it for a 100–1,000 person engineering team? — Yes, on Professional and billed annually. At 500 responders that is $126,000 a year against $246,000 on Business — and the money leaks through licences held by people who left the rota, at $252 each per year.
- Is Sentry worth it for a 100–1,000 person engineering team? — Yes, and paid plans include unlimited users so hiring does not raise the bill. The money is the rate card: Business re-prices every error at two to three times the Team rate, which is $5,268 a year at two million errors a month and $19,668 at ten million.
- Is Cursor worth it for a 100–1,000 person engineering team? — Yes, on Standard seats billed annually. At 500 engineers that is $192,000 a year against $576,000 for the all-Premium version of the same purchase — and the rework exposure is 4.7x to 38x the licence.
- Is Datadog worth it for a 100–1,000 person engineering team? — Yes, but only on a host count you measured yourself. Infrastructure Pro and APM on the same 500 hosts is $276,000 a year at list — and Datadog's own published retention rate says bills like yours grow about 20% a year.
- Is GitHub Copilot worth it for a 100–1,000 person engineering team? — Yes, on Business at $19 a seat. At 500 engineers that is $114,000 a year against a rework exposure of $900,000 to $7.4m — which is why the three controls matter more than the purchase order.
- Is Snowflake worth it for a 100–1,000 person engineering team? — Yes, on Standard at $2.00 a credit unless somebody can name the Enterprise feature. One X-Large warehouse left running is $280,320 a year — the settings decide this bill, not the contract.
- Should we buy Glean? — The other purchase priced per employee rather than per engineer.
- Is Cursor worth it for a 10-person engineering team? — Per-seat arithmetic at the other end of the scale, done the same way.
- The do-not-adopt library — The calls we make against tools we think you should skip entirely.
Every published verdict is listed on the verdicts index.