Okta vs Entra ID: what SSO covers and what SCIM provisioning still costs

The licence line that decides the renewal

A 500-person estate buying Okta Essentials at the published $17 per user per month is committing $102,000 a year before any add-on, because Okta states that Workforce Identity suites are sold per user per month and billed annually. The same estate on Starter pays $36,000 at the published $6 floor. That gap, not the sign-on feature list, is what the renewal conversation turns on.

Microsoft does not publish a per-user figure on the Entra pricing page supplied here. It states that Entra ID P1 and P2 can be purchased as standalone licence subscriptions or as part of Microsoft 365 E3 or E5, and that Entra Suite requires a subscription to Entra ID P1 or a package that includes P1. Prices, the page says, may vary based on the Microsoft agreement, and it directs buyers to contact sales for a customised quote.

So the first question in a vendor call is not which product does SSO. It is how many identities are in scope and which of them already carry a Microsoft 365 E3 or E5 licence, because that answer moves the marginal cost of Entra to zero for those seats and leaves Okta's per-user charge standing.

What SSO covers on both sides, and where the app count bites

Okta describes its single sign-on product as highly secure one-click access to cloud and on-premises apps with a single set of user credentials, and it sells that capability inside the suites rather than only as a standalone. The Essentials tier is where Okta places advanced automation and security, which is the tier a buyer reaches for once sign-on alone is not the requirement.

Microsoft's Entra page lists unlimited SSO and MFA among the features it advertises, and positions Entra ID P1 and P2 as the entry subscriptions for the family. The Entra Suite adds Conditional Access across identities, endpoints, apps and networks, an Identity Governance component, a Secure Web and AI Gateway, and real-time risk detection using unified identity and network signals.

The app count is where the two diverge in practice. Okta states that almost all of its products can be purchased individually or added to any suite, and that adding capacity in most cases means adding more suite licences, because suites share one subscription count across products. That is simple to administer and it means every additional capability is priced per user, not per app.

Microsoft's structure prices the identity layer per user and then lets the surrounding controls, such as private access or governance, be bought as add-ons or standalone. For an estate already running Microsoft 365, the identity line is largely absorbed; for one that is not, the Entra quote has to be built from P1 or P2 upward.

Provisioning is the half that is not in the SSO price

Okta lists lifecycle management as a separate capability: automate user onboarding, offboarding and profile updates, and centralise user profiles from Active Directory, LDAP, HR applications and other sources into a single unified directory. It also lists access reviews and requests as a governance product that automates reviews and enforces least privilege across accounts.

On the Microsoft side, the Entra page lists identity governance as a component that automatically ensures the right people have the right access to the right apps at the right time, and it appears as part of the Entra Suite rather than as the base subscription. That is the structural point a buyer has to price: sign-on is table stakes on both platforms, and the provisioning and review engine is the tier above.

Okta's own pricing page confirms the add-on model. It says almost all products can be bought individually or added to any suite, and it carves out exceptions for Workflows, Okta Privileged Access and machine-to-machine tokens. Privileged Access is licensed in Resource Units, with the Essentials Suite including one Resource Unit that can cover two Privileged Access users, who can then use an unlimited number of secrets.

Neither page publishes a per-user price for the governance or provisioning module on its own. That number is unpublished, and the thing to ask for is the per-identity cost of lifecycle management and access reviews at the estate's actual headcount, quoted separately from the SSO suite so the two lines can be compared.

The 500 and 5,000 identity cases

At 500 identities, the arithmetic is small enough to do on the published Okta numbers. Starter at $6 is $36,000 a year and Essentials at $17 is $102,000 a year, both billed annually per user. A Microsoft estate that already holds E3 or E5 for those 500 people has already paid for Entra ID P1 or P2 inside that licence, so the incremental identity spend is the governance and access add-ons, not the base subscription.

At 5,000 identities the same Okta tiers become $360,000 and $1,020,000 a year respectively, before any add-on. That is the scale at which the Microsoft bundle stops being a convenience and becomes the reason the shortlist narrows: 5,000 E5 seats carry Entra ID P2 by the vendor's own description, and the buyer is then comparing the price of Okta's suite against the price of the add-ons Microsoft has not bundled.

The Okta page does not publish volume discounts, multi-year terms or the Professional and Enterprise suite prices, and it recommends contacting sales for a custom quote on those tiers. The Microsoft page does not publish P1 or P2 list prices at all and states that prices may vary by agreement. Both numbers are unpublished, and the ask is the same on each side: a written per-user price at 500 and at 5,000, with the governance module itemised.

Where each option breaks

Okta's model is legible and it scales linearly, which is its weakness as well as its strength. Every capability added to the suite adds to the per-user count, and the page's own guidance is that more capacity usually means more suite licences. An estate that wants sign-on, provisioning, privileged access and machine-to-machine tokens is buying several lines that all move with headcount.

Microsoft's model hides the price inside an agreement. The Entra page states that prices may vary based on the Microsoft agreement and directs buyers to contact sales, which means the number a reader sees depends on the deal already in place. That is an advantage for an organisation mid-term on E5 and a genuine obstacle for one buying identity as a standalone line item.

The Entra Suite also carries a dependency the Okta suites do not: it requires a subscription to Entra ID P1 or a package that includes P1 before it can be bought. A buyer who wants the unified Conditional Access and governance components has to hold P1 first, so the quote is always at least two lines deep.

Neither page states an offline or air-gapped deployment mode for the workforce identity suites, and neither publishes a migration path or a data-export commitment. Those are questions for the call, not facts this comparison can settle.

The decision rule

Choose Okta if the estate is heterogeneous, the identity budget is a standalone line, and the published per-user price at $6 or $17 is easier to defend to finance than an agreement-dependent quote, because the number is on the page and the suite shares one subscription count across products.

Choose Microsoft Entra if the workforce already holds Microsoft 365 E3 or E5 at the scale in question, since Entra ID P1 and P2 are included in those licences and the marginal identity spend falls to the governance and access add-ons rather than the base subscription.

Wait if the governance and provisioning cost is the deciding factor, because neither vendor publishes that per-user figure and a comparison built on the SSO tier alone will pick the wrong platform once access reviews and lifecycle automation are priced in.