How to estimate what SSO and SCIM will cost before you pick a provider
Per-connection prices are easy to compare and rarely the number that decides your bill. Here's a worksheet for estimating enterprise auth costs at 5, 25 and 100 customers.
Enterprise SSO is usually the line item B2B teams plan for. SCIM is increasingly the one that surprises them.
More auth providers now bill directory sync as its own line item, separate from SSO, and at least one moves to that model on January 1, 2027. Others bundle SCIM into a higher plan, or count SSO and SCIM against one shared pool of connections. If your enterprise customers expect automated provisioning and deprovisioning, and most eventually do, two providers with the same SSO price can end up costing very different amounts.
Pricing pages don't make this easy to see. This guide covers the pricing models you'll run into, the costs that sit outside the per-connection price, and a worksheet you can fill in for any provider, with a worked example at the end.
The pricing models you'll run into
Most B2B auth providers combine two or three of these.
None of these is better in general. Each one is cheaper at some customer counts and more expensive at others, which is why the number on the pricing page tells you so little until you know your own numbers.
What the per-connection price leaves out
SCIM is often a second connection
If SSO and SCIM are billed separately, a customer who needs both costs two connections. If they share a pool, the pool runs out twice as fast. Model SSO and SCIM as separate counts, even when the pricing page lists them together.
Users
A B2B app's user count grows with its customers. One enterprise customer with 2,000 employees is up to 2,000 monthly active users. Many plans include a few thousand to a few tens of thousands of users, and some don't publish the price past that. Estimate users from your real customers' seat counts, not from today's total.
Organization caps
Some plans limit how many customer organizations, tenants or workspaces you can have, separately from connections. A cap can force an upgrade before your connection count does.
Plan cliffs
When SCIM, extra connections or more organizations require the next plan up, one customer can move your bill by hundreds of dollars a month. Find each boundary and check where your customer count will be when you hit it.
Where published pricing stops
If a pricing page sends you to sales after a certain number of connections or users, you can't model your cost past that point. That isn't necessarily more expensive, but it means a negotiation at exactly the moment enterprise demand picks up.
Setup and support time
A connection only works once your customer's IT admin has configured it. If there's no hosted setup flow for those admins, someone on your team walks each customer through Okta, Entra ID or Google Workspace by hand, and that time is a cost too. Check which identity providers and directory sources are supported out of the box.
Billing terms
Some prices on pricing pages assume annual billing, and some discounts only exist in a sales quote. Compare monthly against monthly.
The worksheet
Fill this in once with your own numbers, then apply it to each provider you're considering.
Your inputs
- Enterprise customers today, in 12 months and in 24 months.
- How many of them will need SCIM. Assume more will need it in 24 months than need it today.
- Users per customer, based on seat counts from your largest customers.
- Total customer organizations, including ones that don't use SSO.
For each provider, at each point in time
Monthly cost = plan fee + SSO connection fees + SCIM directory fees + user fees + required add-ons
Then note:
- which plan you need, and what would push you to the next one
- whether any number falls past the point where the provider publishes prices
- what the setup experience looks like for your customers' IT admins
A worked example
Here's the worksheet applied to WorkOS's published pricing, for a B2B app where 60% of enterprise customers need SCIM and each customer has about 500 users.
WorkOS prices SSO and Directory Sync per connection: $125 each for connections 1 to 15, $100 for 16 to 30, $80 for 31 to 50 and $65 for 51 to 100. There's no platform fee. AuthKit is free up to 1 million monthly active users.
Two things stand out. Connection fees are almost the whole bill, so the SCIM share is the input that moves the total most. And user growth doesn't change the cost here at all: the same 100 customers at 2,000 users each would be 200,000 users, still inside the free AuthKit allowance.
Run the same worksheet against any other provider and the shape will differ. Some will cost less at 5 customers, some at 100, and some will need a quote before you get there. That's the point of doing it with your own numbers.
Questions to ask any provider
- Is SCIM billed separately from SSO, or does a customer with both use two connections?
- How many users are included, and what does each user cost past that?
- Is there a cap on organizations or tenants?
- At what point do you stop publishing prices?
- Which plan do I need for SCIM, and for my expected customer count in 24 months?
- What does my customer's IT admin see when they set up SSO or SCIM?
- Are these prices monthly or annual?
Where WorkOS fits
WorkOS prices SSO and Directory Sync per connection, with published volume tiers up to 100 connections and no platform fee. AuthKit is free up to 1 million monthly active users, so user growth inside your enterprise customers doesn't change the bill until you're well past most B2B apps' scale. Admin Portal gives your customers' IT admins a hosted flow to set up SSO and Directory Sync themselves. You can model your own numbers with the estimator on the pricing page.