Identity, Identity Verification, External Identity, and Customer Identity all carry different price points and different audit rules. The buyer side levers that keep a Salesforce identity estate from doubling on a quiet renewal.
Salesforce Identity rewards buyers who map every authenticating user to the cheapest license that still grants access, and quietly overcharges those who default everyone to a full platform seat.
Key takeaways
Salesforce splits identity into three products that cover different people. Getting the population right is the whole game.
Internal employees authenticate through the Identity capability bundled in standard licenses. External customers and partners use External Identity. Step up checks use Identity Verification.
The product overview sits in the Salesforce Identity documentation, which confirms the bundled internal entitlement.
Single sign on ships inside core licenses. You rarely need a separate Identity purchase just to enable SSO for employees who already hold a Salesforce seat.
The headline price per user matters less than the population you attach to it. Mapping discipline beats discount chasing here.
Three levers carry most of the value. Each is an entitlement decision, not a negotiation favor.
External Identity is sold in blocks of monthly active users. A community with 100,000 registrations but 20,000 monthly actives needs the 20,000 tier, confirmed in the Salesforce Platform pricing page.
Salesforce Identity SKU comparison, illustrative
| Product | Who it covers | Billing basis | Common waste |
|---|---|---|---|
| Salesforce Identity | Internal employees | Per user, often bundled | Paying twice for bundled users |
| External Identity | Customers and partners | Per monthly active block | Sizing to registrations not actives |
| Identity Verification | Any step up event | Prepaid credit packs | Credits expiring unused |
The standard partner pitch is that every authenticating identity needs its own paid Identity license, so buyers stack seats to be safe. We disagree. In roughly 20 of the 30 Salesforce estates we reviewed in 2024 and 2025, the bundled internal entitlement already covered most employees, and External Identity blocks were sized to registrations rather than monthly actives. That double counting inflated Identity spend by 12 to 25 percent. The buyer side move is to map every authenticating population to the cheapest license that still grants the required access before you renew, then size External Identity to the trailing twelve month active peak, not the registration total.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
You do not buy identity by headcount. You buy it by who actually authenticates, and how often.
Size to monthly active users measured over a full year, then add a modest burst margin. Registrations are vanity, actives are the bill.
Pull the active user trend from your community analytics and set the block to the trailing peak. Renegotiate the tier down at renewal if actives fell.
For communities with a clear seasonal spike, negotiate a burst clause rather than buying the peak tier for twelve months. You pay for the season, not the year.
Start with an entitlement audit, not a discount ask. The cheapest seat is the one you delete.
White Paper · Salesforce
Salesforce License Optimization
Salesforce shelfware runs 15 to 30 percent of seats in most orgs. Read it free.
Get the buyer side framework our advisors use on live Salesforce engagements. No sales pitch, just the levers, the benchmarks, and the sequence.
See the Salesforce PracticeSalesforce Identity is bundled with most internal user licenses, so employees who already hold a Salesforce seat usually do not need a separate paid Identity license. Paying again for those users is typically a mapping error rather than a real entitlement gap.
External Identity is priced in blocks of monthly active users, not total registrations. A community can hold hundreds of thousands of accounts yet only need the block that matches its real monthly active peak.
No in most cases. Single sign on for employees ships inside core Salesforce licenses, so a standalone Identity purchase purely to enable SSO is often unnecessary for internal users.
Identity Verification provides step up authentication checks billed through prepaid credit packs. The credits expire, so buying them ahead of real demand risks writing off the unused balance.
A disciplined mapping exercise typically reclaims 12 to 25 percent of Identity spend, driven mainly by removing duplicate internal seats and resizing External Identity to monthly actives rather than registrations.
Size to monthly active users measured over a full year. Registrations overstate demand because most community accounts authenticate rarely, and the bill follows actives, not sign ups.
Yes. External Identity tiers can be renegotiated down at renewal if your trailing monthly actives fell, which is why measuring actual usage before the contract date is the key buyer side step.
Begin the entitlement audit at least 90 days before the renewal date so you have time to remove duplicates, resize blocks, and counter the opening proposal with usage data rather than estimates.
Once a month. Audit patterns, renewal benchmarks, vendor commercial signals across Oracle, Microsoft, SAP, Salesforce, IBM, Broadcom, AWS, Google Cloud, ServiceNow, Workday, Cisco, and the GenAI vendors. No follow up sales pressure.
Free providers (Gmail, Yahoo, Outlook) cannot subscribe. Work email only. Unsubscribe in one click.
