← All Blogs

The SSO tax: when single sign-on is priced out of your reach

By Best IT MSP Editorial Team - Updated October 21, 2026 - 14 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What is the SSO tax, and what does it cost a small business?

The SSO tax is the extra amount a software vendor charges to let your staff sign in through your own identity provider. It is rarely sold as a feature. It is a tier jump, and the gap applies to every seat you hold.

GitHub prices that gap in public, and read the small print while you are there, because both figures carry a for the first 12 months qualifier. Ask what each becomes in year two before you build a budget on either. Its pricing page lists Team at $4 per user per month and Enterprise at $21 per user per month, and it lists SAML single sign-on only in the Enterprise feature set. That is a $17 per-user gap for one security control, a 425 percent increase on the plan a small team would otherwise buy. We read both prices on 21 October 2026. Vendor pricing moves, so treat the date as part of the figure.

Four more examples, all read from the vendors' own pricing pages the same day, show the range.

• GitHub. Team costs $4 and Enterprise costs $21 per user per month. SAML single sign-on sits on Enterprise. The gap is $17 per user.
• Dropbox. Standard costs $15 and Advanced costs $24 per user per month, and Dropbox lists single sign-on (SSO) integrations on Advanced and not on Standard. The gap is $9 per user. Dropbox Enterprise carries no published price.
• Zoom. Pro costs $16.99 and Business costs $21.99 per user per month on monthly billing, and Zoom lists single sign-on via SAML 2.0 on Business and Enterprise. The gap is $5 per user.
• Bitwarden. Teams costs $4 and Enterprise costs $6 per user per month billed annually, and Bitwarden states that Enterprise organizations can leverage their existing Identity Provider using SAML 2.0 and OIDC. The gap is $2 per user.
• Asana. Starter costs $13.49 and Advanced costs $30.49 per user per month on monthly billing. SAML authentication sits on Enterprise, and Asana publishes no price for Enterprise at all.

Notice the last one. The cheapest plan carrying SAML authentication has no price at all. That is not an oversight. A quote-only enterprise tier keeps the single sign-on conversation inside a sales call, so a small business cannot budget for the control before asking for it.

Why the SSO tax costs more than the sticker gap suggests

To price the SSO tax honestly, multiply the per-user gap by every seat in the workspace, not by the accounts you were actually worried about. Tier pricing is not granular. You cannot buy single sign-on for three administrators alone.

Work it through for a 25-person business running three of the products above. Dropbox adds $9 per user per month, so 25 seats cost $2,700 a year. Zoom adds $5 per user per month on monthly billing, so 25 seats cost $1,500 a year. GitHub adds $17 per user per month, and 8 developer seats cost $1,632 a year. Three applications, $5,832 a year, for a control a federal cyber agency says should be free. That total is our own arithmetic on the published prices above, not a vendor figure.

Now price the alternative. Bitwarden Teams costs $4 per user per month, so 25 people cost $1,200 a year, and the shared vault covers every application you own, including those with no single sign-on option at any price. 1Password's Teams Starter Pack runs $2.49 per user per month billed yearly, and 1Password Business is $8.99.

So a password manager covering the whole estate costs less per user than single sign-on on one file-sharing tool. That arithmetic explains the outcome the security advice never predicts. The standalone password survives on exactly the systems you were told to protect, and the buyer who left it there was being rational about per-seat pricing they did not set.

Why do software vendors price single sign-on this way?

Vendors price single sign-on as a tier marker rather than as a feature, because the ability to federate is a reliable signal that the buyer has an IT function and a larger budget. Willingness to pay sets the number, not cost to serve.

Be fair about the cost side, because it is real. Supporting SAML and OpenID Connect means certificate rotation, metadata changes, a break-glass admin path, and a support queue full of login failures a password never generates. Tiered pricing is also a normal way to run a software business. But none of those costs scales with your seat count, which is what does not add up about charging per user.

A vendor can price it as a line item instead, and a large one already does. Atlassian sells Atlassian Guard Standard at $4.35 per user per month separately from the product tier, carrying enforced single sign-on (SSO) together with SCIM provisioning. Guard Premium costs $8.55. Name that structure at your next renewal. It turns an argument about principle into a request for a published invoice line.

The community catalog, and how to use it

One volunteer project tracks this systematically. sso.tax, the SSO Wall of Shame, is maintained by robchahin and sorts vendors into two tables, one for vendors that raise the price and one for vendors that will not quote a price at all. We counted the second table twice and got 44 vendors both times, on 21 October 2026. We deliberately give no total for the first table, because two counts of it disagreed and a number we cannot reproduce is not a number worth printing. The 44 is the more telling figure anyway. Those vendors publish no single sign-on price whatsoever, and the site's stated assumption is that they apply a significant premium.

Its criteria are stated. The threshold is explicit, because if your SSO support is a 10% price hike, you're not on this list. Free tiers and single-person plans are excluded, and base pricing assumes a team of five to ten people. Its argument is one sentence long, that security shouldn't be a premium feature, and it names the consequence this post is about, that gating single sign-on encourages insecure shortcuts.

Treat it as a catalog rather than a price source, and we found out why on the first entry we checked. Its Asana row shows a $25 base against a $60 single sign-on price, while Asana's own page now publishes Starter at $13.49 and Advanced at $30.49, with SAML authentication on an Enterprise tier carrying no published price. Neither record is dishonest. The vendor repriced, and a volunteer cannot re-audit a catalog this size every week. Verify the number at the vendor, and date it.

CISA says single sign-on should cost nothing extra

CISA states the position plainly, and it names single sign-on rather than implying it. Its Secure by Design page says that out of the box, products should be secure, with additional security features such as multi-factor authentication (MFA), logging, and single sign-on (SSO) available at no extra cost. You can paste that sentence into a renewal email.

NIST explains why centralized identity earns that status. It describes federation as letting one person use many services without the need to hold or maintain separate authenticators at each RP, and says it eliminates the need for the RP to issue an additional authenticator for the subscriber to manage, while delivering centralized account management and technical integration. In plain terms, every application that keeps its own login page adds another password to somebody's memory.

CISA's performance goals carry a conditional that is easy to read past. Goal 3.F asks organizations to require MFA to access assets using the strongest available method, if MFA is available for that asset. Availability does real work in that sentence. Goal 3.C then asks that users refrain from reusing passwords for their accounts, applications, and services and that administrator and service accounts have unique passwords. Those two goals are the fallback the SSO tax forces on you.

The password data says how well that fallback holds. Cloudflare measured its own network traffic and found 41 percent of successful logins involve compromised passwords, and that 52 percent of all detected authentication requests contain leaked passwords once bots are counted, across September to November 2024. Sophos reports that 79 percent of ransomware attacks start with compromised identities, that 59 percent of its incident response cases had no MFA in place, and that 67 percent of cases were rooted in identity-related attacks.

One figure argues for proportion rather than panic. Verizon's 2026 report puts credential abuse at 13 percent of breaches as an initial access vector, while exploitation of vulnerabilities rose to 31 percent. Stolen credentials are no longer the biggest door. They are still one breach in eight, and Verizon also found a third party involved in 48 percent of all breaches, which is what a shared login in a supplier's hands becomes.

The offboarding consequence, in one paragraph

An application outside single sign-on is an application a leaver can still reach after you disable their directory account. That is the sharp end of the SSO tax, and the only part that shows up as a loss rather than a risk. CISA's goal 3.D asks for a defined and enforced process covering the revocation of all access to systems and facilities, and suggests you review user access and disable accounts when inactive for a specified period (e.g., 30 days). A dormant login your directory cannot see fails both halves.

One change makes the checklist honest. Sort it by single sign-on status. The federated applications die with the directory account. The standalone ones need a named owner, a dated step and a second person to confirm it happened. Our employee offboarding IT checklist covers the full sequence, so this post does not repeat it.

How do you decide what to do when you cannot pay the SSO tax?

To decide, price the gap application by application, then spend on the applications where a leaked password does the most damage. Seven steps do it, in this order.

• List every application your staff sign into, and record whether it federates to your identity provider today. The register is the deliverable, not the list.
• Price the gap from each vendor's own page, with the date you read it, because Asana repriced between the catalog entry and the page we read.
• Rank by blast radius rather than by price. The payroll system and the email gateway outrank the design tool, whatever the per-seat gap says.
• Buy provisioning instead of single sign-on wherever the vendor sells the two separately. Bitwarden documents that Teams and Enterprise organizations can use SCIM and that Teams and Enterprise organizations can use Directory Connector, while single sign-on is reserved for Enterprise.
• Vault every credential left outside, with unique passwords and the application's own multi-factor authentication enforced. NIST requires verifiers to allow the use of password managers and autofill functionality, and notes that password managers increase the likelihood that subscribers will choose stronger passwords.
• Negotiate at renewal, naming Atlassian Guard Standard at $4.35 per user per month as the structure you want. Ask for single sign-on as an add-on line rather than a tier.
• Switch where switching is cheap. A note-taking app is replaceable in a week. Your accounting system is not.

Step four is the one most buyers never reach, and it is the cheapest win here. The hole the SSO tax opens is mostly an offboarding hole rather than an authentication hole, because a vaulted password is already unique and already long. If you can provision and deprovision accounts from your directory without buying federation, you close most of the loss and keep the budget.

Step five needs one number to be worth anything. NIST requires verifiers to require passwords used as a single-factor authentication mechanism to be a minimum of 15 characters in length, and permits eight characters only inside a multi-factor process. Most of what sits outside your identity provider is single-factor, so 15 is your floor. Set the shared vault to generate at that length and nobody has to remember anything.

Which of these are equivalents, and which are not?

None of the four mitigations is equivalent to single sign-on, and saying so is the difference between a plan and a story you tell yourself. Each is graded below.

• SCIM provisioning or directory sync. Close to equivalent on offboarding, because the application account dies when the directory record does. Not equivalent on authentication, because the password still exists and still works until something removes it.
• A password manager with shared vaults. Equivalent on unique credentials and password length. Not equivalent on central revocation, because removing somebody from a shared vault does not revoke a live session or unlearn a password they memorized.
• The application's own multi-factor authentication. Equivalent on stopping a reused password. Not equivalent on policy or the audit log, because the sign-in never reaches your identity provider, so your access review has a blind spot.
• Choosing a different vendor. The only true equivalent, and the most expensive to execute. Price the migration honestly before you threaten it, because a bluff you cannot fund weakens every later talk.

Write the grade beside each application in the register, and keep the register next to the renewal calendar. It makes the annual access review finishable, because it names the systems your directory cannot answer for.

Two cautions. A shared vault is not a license to share one login between four people, because CISA asks for unique credentials per person and a shared account destroys the audit trail you would need afterwards. And phishing-resistant belongs to hardware keys and passkeys, not to a long password in a vault, so do not let a provider use the word for the fallback.

What to ask your IT provider on Tuesday

Seven questions separate a provider who has audited this from one who has not. Ask in writing, and keep the answers beside the renewal quote.

• Which of our applications sign in through our identity provider today, and which keep their own login page?
• What does single sign-on cost on each one that does not, at the vendor's published price?
• Where would a former employee still have a working password, named application by application?
• Can we provision and deprovision any of those applications from the directory without buying the single sign-on tier?
• Who holds the credentials for the applications outside single sign-on, and which shared vault are they in?
• How long are the passwords on those accounts, and when did anybody last rotate them?
• Which of these vendors did we ask for single sign-on as an add-on line at the last renewal?

A provider who operates this answers with an application register and a column marked yes or no. One who sells it answers with the phrase zero trust. You already pay for the first answer, so ask for it and give a date.

Read this beside our identity and access management best practices, the SaaS spend management audit, and software procurement best practices. MFA vs 2FA explains the factor language, and passkeys for a small business covers what replaces the password where you can get it.

Has a vendor ever taken a security paywall down?

Yes, and the largest software vendor in the world did it. In July 2023 Microsoft said it would include access to wider cloud security logs for our worldwide customers at no additional cost, moving more than 30 other types of log data previously only available at the Microsoft Purview Audit (Premium) subscription level down to the standard tier, and increasing the default retention period for Audit Standard customers from 90 days to 180 days.

How it happened is the part worth copying. CISA's director said she was extremely pleased with Microsoft's decision to make necessary log types available to the broader cybersecurity community at no additional cost after working collaboratively for over a year, and framed the change as a step in the right direction toward the adoption of Secure by Design principles by more companies. A government agency asked publicly, kept asking for a year, and a price changed.

You are not CISA, and one 25-person business will not move a price book. You can still quote CISA. Put the no-extra-cost sentence in the renewal email, ask for the add-on structure Atlassian publishes, and name the applications you will consolidate onto a competitor if the answer is no.

One last number reframes the whole bill. Microsoft's pricing page describes Microsoft Entra ID Free as giving seamless, protected sign in experiences with MFA, unlimited SSO, and password self-service, with Entra ID P1 at $7 and P2 at $10 per user per month for premium controls. The identity provider you already own is not where the tax sits. Your applications are, so the fix is a procurement conversation rather than an identity project.

The side of single sign-on you control is close to free. The side you do not control is where the price lives.

None of this buys perfect security, and no honest provider promises that. It buys a register you can show an insurer and a renewal conversation with a named ask. Start with the register.

FAQ

What is the SSO tax?

The SSO tax is the price increase a software vendor charges to let your staff sign in through your own identity provider. GitHub publishes Team at $4 and Enterprise at $21 per user per month, with SAML single sign-on only on Enterprise. The volunteer catalog at sso.tax tracks vendors that price it this way.

Why do software vendors charge extra for single sign-on?

Because single sign-on signals that the buyer has an IT function and a larger budget, so it works as a tier marker. Supporting SAML does cost something, but not per seat. Atlassian shows the alternative by selling Guard Standard at $4.35 per user per month with enforced single sign-on as an add-on rather than a tier.

Is there a list of vendors that charge extra for SSO?

Yes. sso.tax, the SSO Wall of Shame, is maintained by robchahin and listed 44 vendors that will not quote a single sign-on price at all when we counted on 21 October 2026. Its threshold is stated, because if your SSO support is a 10% price hike, you're not on this list. Verify every price at the vendor's own page.

What should we do if SSO costs too much for an app we rely on?

Buy provisioning instead, where the vendor sells it separately. Bitwarden documents that Teams and Enterprise organizations can use SCIM while single sign-on needs Enterprise. Then vault the credential with a unique password of at least 15 characters, enforce the application's own multi-factor authentication, and put that application at the top of your offboarding checklist.

Does Microsoft charge extra for single sign-on?

Not for its own identity provider. Microsoft's pricing page describes Entra ID Free as giving MFA, unlimited SSO, and password self-service, with P1 at $7 and P2 at $10 per user per month for premium controls. The SSO cost falls on the third-party applications you connect, not on the directory itself.

← All Blogs