Contents
Key takeawaysOkta pricing in 2026What we have seenWhy the count mattersSuite or individual productsWorked exampleThe Entra overlapAccount team linesContract termsSmall and large workforcesWhat to do nextFAQOkta publishes its list rates, so the discount is easy to measure. The larger savings come first, from removing leavers and stale contractors from the user count and from buying only the products you deploy.
- Count before you negotiate rate. Reconciling licensed users against sign in data removes leavers and expired contractor accounts that Okta's own records show as dormant.
- List price is public. Okta prints suite rates from $6 to $17 per user per month, so every discount can be checked against a published number.
- Unbundle before you accept a suite. SSO plus MFA covers most workforces, and Lifecycle Management is the product most often bought and never used.
- Price the Entra overlap. Microsoft 365 E3 and E5 already include Entra ID, and a costed comparison earns more discount than a migration threat.
- Take the cap over the deeper discount. A single digit renewal uplift cap protects every year of the next term, while extra first year points are spent once.
- Watch the 30 day notice. Okta subscriptions renew automatically for the same term unless notice is given at least 30 days before the end.
- Repeat the reconciliation. Leavers pile up continuously, so the count needs checking before every renewal.
Okta renewals tend to be argued over the discount percentage. In the Okta Workforce Identity negotiations we advise, the bigger savings come earlier: from the number of users on the order form, from the products bundled into the quote, and from the Microsoft identity licenses you may already own.
Below are Okta's current list rates, the patterns we saw across recent renewals, a worked example with the arithmetic, and the contract terms that decide what you pay in the second term.
How does Okta Workforce Identity pricing work in 2026?
Okta charges per user per month, billed annually, against list rates it publishes on the Okta pricing page. Few enterprise software vendors print their prices, and it helps you: every discount can be measured against a number both sides can see.
As of September 2026 the pricing page leads with suites rather than single products. Workforce Identity carries a $1,500 annual contract minimum.
- Starter, $6 per user per month. Single Sign On, MFA and Universal Directory, with Adaptive MFA and Lifecycle Management sold as add ons.
- Core Essentials, $14 per user per month. A middle tier that adds Adaptive MFA and Lifecycle Management to Starter.
- Essentials, $17 per user per month. Includes Adaptive MFA, Lifecycle Management, access governance and 50 Workflows.
- Professional and Enterprise. Quoted on request, with identity security monitoring, API Access Management and Access Gateway added in the upper tiers.
Okta states that almost all of its products can still be bought individually or added to any suite, so you can ask for a quote that lists Single Sign On, Adaptive MFA, Universal Directory and Lifecycle Management as separate lines. That separation is what makes a product by product comparison against the suite price possible.
| Product | What it does | How often it is fully deployed |
|---|---|---|
| Single Sign On | The entry product, described on the Okta SSO pages | Nearly every customer, fully |
| Adaptive MFA | The second product almost everyone uses | Usually paired with SSO in the first contract |
| Lifecycle Management and Governance | Joiner, mover and leaver automation plus access reviews | Licensed often, put into daily use rarely |
| Workflows and Identity Threat Protection | Newer products attached to renewals | Bought for the roadmap, deployed later or never |
How far below list do Okta deals close?
Deals above roughly one thousand users close 20 to 40 percent below list, depending on term length and product mix. A quote at list price is Okta's opening position. Hold your response on rate until the user count and the product list are agreed, because every later discount is applied to both.
What have we seen in recent Okta Workforce Identity negotiations?
Across roughly 12 to 18 Okta Workforce Identity negotiations I advised in 2024 and 2025, the licensed user count moved more money than the unit rate did. Three patterns repeated.
- Stale seats. Reconciling active users against licensed users removed 10 to 20 percent of seats in most of those renewals, almost all of them leavers and contractor accounts that had outlived the engagement.
- Unused suite products. Buyers who priced SSO plus MFA a la carte instead of accepting the suite saved 25 to 40 percent against the bundled quote. Lifecycle Management was the product most often licensed and never put to work.
- The Entra comparison. Customers who tabled a costed Microsoft Entra ID alternative landed 10 to 15 more discount points than those without one. It did not need to be a migration plan. It needed a price.
The seat removals were not contentious, because Okta's own sign in records showed the accounts were dormant. All three results were settled before anyone discussed a percentage.
Okta Negotiation Kit
The user reconciliation worksheet, the a la carte pricing model and the renewal cap language, in one download.
Get the white paper →Why is the Okta user count worth more than the rate?
The rate is negotiated once, while the count is paid for in every month of the term. Renewals price the licensed quantity, and that quantity drifts upward between renewals as accounts are created faster than they are removed.
Every system has dormant accounts. Identity is the one system that holds the authoritative record of who signed in, when, and whether that person still works for you, so it can prove its own overcount.
Okta's own sign in records are the evidence, so correcting the seat count takes a report and no argument.
How do you check your own Okta user count?
Build the reconciled number from sources Okta cannot dispute. Most of them are already in your admin console.
- Okta Usage report. In the Admin Console, go to Reports, then Reports, and request the Okta Usage report for up to the previous 90 days. Users with zero in the Number of Logins column are your first list.
- The lastLogin attribute. The Okta Users API returns a lastLogin value per user, so you can measure dormancy over a longer window than the report allows.
- HR leaver extract. Match terminated employees against accounts still active in Okta. Any match is a seat you are paying for and a security exposure.
- Contractor end dates. Compare contractor accounts with the end dates in your vendor management or purchasing records.
- Product assignments. For Lifecycle Management, count the applications actually provisioned through Okta alongside the users assigned the license.
Why leavers and contractors need different owners
Split the reconciled list into leavers and contractors before the renewal. Leavers belong to the HR driven joiner and leaver process. Contractor accounts usually belong to procurement or the business unit that hired them, and they expire when an engagement ends, which the HR system never sees.
If one team is told to fix both, the contractor accounts come back within a year and the next renewal starts from an inflated count again.
Should you buy an Okta suite or individual products?
Buy the suite only if you will deploy most of what is in it. Count the products you have switched on. SSO plus MFA covers most workforces, and the full Workforce Identity suite adds products that many customers never deploy.
- Put a deployment date against every product in the quote. Anything without a date and an owner is a roadmap purchase, and it should be priced as one.
- Price SSO and MFA separately before you accept a bundle rate. That comparison produced the largest bundle savings we saw.
- Ask the account team for the suite price and the line item price on the same user count. Two quotes on one quantity make the bundle discount visible.
- Ask what governance replaces. Access reviews earn their cost where they retire a manual certification exercise your auditors already require.
Identity sits next to the rest of your security spend at renewal. Our guides on CrowdStrike and Zscaler work the same count and bundle questions on adjacent contracts.
What does Lifecycle Management have to replace to earn its cost?
Lifecycle Management pays for itself only where it removes manual joiner and leaver work. If your HR system does not feed Okta, or your main applications lack automated provisioning, the license sits unused while the service desk creates accounts by hand. Confirm the HR connector and the first five target applications before you pay for it.
What does a reconciled Okta renewal look like in numbers?
Take a hypothetical company with 3,000 licensed users on Essentials at the $17 list rate. Assume reconciliation removes 15 percent of seats, inside the range we saw, and the final discount is 30 percent.
| Step | Users | Rate per user per month | Annual cost |
|---|---|---|---|
| Quote as received, at list | 3,000 | $17.00 | $612,000 |
| After reconciliation, at list | 2,550 | $17.00 | $520,200 |
| Same 30 percent discount, count not reconciled | 3,000 | $11.90 | $428,400 |
| Reconciled count with 30 percent discount | 2,550 | $11.90 | $364,140 |
At the same discount, reconciliation is worth $64,260 a year, or $192,780 over a three year term. To save the same amount on the unreconciled quote, you would need more than 10 extra discount points.
The same arithmetic shows why a cap beats a deeper first year discount. Five extra discount points granted for the first year only are worth $26,010 on the reconciled list price, once. Holding the renewal uplift to 5 percent instead of a hypothetical 12 percent ask saves $25,490 in every year of the second term, or $76,470 over three years.
How should Microsoft Entra ID factor into an Okta negotiation?
If you run Microsoft 365 E3 or E5, you already own an alternative, and Okta prices against that fact whether you raise it or not. Pricing the overlap accurately earned extra discount points in the renewals described above, and it commits you to nothing.
E3 includes Entra ID P1 and E5 includes Entra ID P2, which Microsoft lists at $7 and $10 per user per month on their own. Our Entra ID pricing guide covers those tiers, and our brief on the Entra suite works through the bundle arithmetic on the other side of the comparison.
Why we would not threaten a move to Entra
A common tactic is to tell Okta you are migrating to Entra and wait for the price to drop. We advise against it. Okta account teams hear it often, and a threat with no numbers behind it is easy to discount.
A costed comparison does better: the Entra capabilities you already pay for, the gaps you would have to fill, and the one time cost of switching. Put it on the table as information and let the account team respond to the figures.
What will the Okta account team say, and how should you answer?
These lines come up in most Okta renewals. Each has a reply that keeps the discussion on your numbers.
- "The suite is cheaper per product than buying separately." Only per product you deploy. Show the deployment dates, then ask for the SSO and MFA line items on the same user count.
- "Your renewal quantity is based on the users in your tenant." Then the quantity should reflect who uses the tenant. Hand over the reconciled list from the Okta Usage report and the HR leaver match, deactivate those accounts, and ask for the quote to be rebuilt on the new number.
- "Entra does not do what Okta does." Agree where that is true, then show the priced comparison. Your request is that the quote reflects the overlap, and the products do not have to be identical for that.
- "This discount expires at quarter end." Okta's fiscal year ends on January 31, so its quarters close at the end of April, July, October and January, and the pressure is real on their side. Accept a deadline only after the count and the product list are settled.
- "A longer term gets you a better rate." Accept a longer term only with a written uplift cap and the right to reduce quantities at renewal.
Which contract terms protect the second Okta term?
A written cap on the renewal uplift, agreed while the count is still being negotiated, protects the second term. A single digit cap is worth more over a term than a deeper first year discount, and it is far cheaper to obtain at signature than at renewal.
The commercial terms sit in the Okta agreements, and the renewal clause is the one to read before the rate is settled. Under the Master Subscription Agreement dated February 2025, subscriptions renew automatically for a term equal to the expiring one unless either side gives notice at least 30 days before the end. Fees are non cancelable and non refundable.
- Renewal uplift cap. A single digit percentage over the prior term's unit price, written into the order form.
- Price hold for added users. New users during the term at the same net unit rate, so growth does not reopen pricing.
- Reduction right at renewal. The right to lower quantities or drop a product at renewal without losing the discount on the rest.
- Billable user definition. A written statement of which user statuses count toward the licensed quantity, checked against Okta's Product Subscription Reference Guide.
- Delayed start for roadmap products. Billing for Lifecycle Management or Workflows starts on the go live date agreed in the order form.
- Renewal quote deadline. Okta delivers the renewal quote at least 90 days before the term ends, so you can review it well before the 30 day non renewal deadline passes.
Why reconcile before every renewal?
Seat drift does not stop after one cleanup. Leavers accumulate continuously, so a count reconciled at the last renewal is already wrong by the next one. Run the Okta Usage report every quarter and keep the leaver and contractor lists current, and the next renewal starts from a clean number.
How does an Okta negotiation differ for a small and a large workforce?
The same three questions apply at any size, but their weight changes with the user count.
Around 800 users
Below roughly one thousand users, expect less movement on rate, so product scope matters most. The gap between Starter at $6 and Essentials at $17 is $11 per user per month, or $105,600 a year at 800 users. Decide first whether you need Adaptive MFA and Lifecycle Management at all.
Around 20,000 users
At this scale the reconciliation carries most of the value, and the contractor population is often large enough to need its own count. Ask for ramped quantities if a new business unit is joining, and write the price hold for added users into the order form before signature.
What to do next
- Six months before renewal. Reconcile licensed seats against active users, using the Okta Usage report, the lastLogin data and the HR leaver list.
- Five months out. Split the stale accounts into leavers and contractors and give each list its own internal owner, so the count stays fixed after the renewal.
- Four months out. Put a deployment date against every product in the quote and ask for SSO and MFA priced as separate lines against the suite.
- Three months out. Cost the Entra ID capabilities you already own under Microsoft 365 E3 or E5 and share the comparison with the account team.
- Before signature. Take the written uplift cap, the price hold for added users and the reduction right over a deeper first year discount.
- If you want help. Our negotiation practice runs the seat reconciliation before the quote is built, on a fixed fee.
Frequently asked questions
How much of an Okta seat count is usually stale?
Between 10 and 20 percent in most of the renewals we advised. Nearly all of it was leavers still holding an account and contractors whose engagements had ended. The Okta Usage report and an HR leaver extract are usually enough to prove it.
Is the Okta suite cheaper than buying products separately?
Only when you deploy what is in it. Buyers who priced SSO plus MFA a la carte saved 25 to 40 percent against the bundled quote, because the suite carried products they had not switched on. Ask for both prices on the same user count.
Does Okta publish list pricing?
Yes. The pricing page lists Workforce Identity suites per user per month, billed annually, with Professional and Enterprise quoted on request. Published rates let you measure any discount against a number the seller did not choose for the occasion.
What discount off Okta list price is realistic?
For deals above roughly one thousand users, 20 to 40 percent below list, with the result driven by term length and product mix. Smaller deals move less on rate, so scope and seat count matter more there.
Does having Microsoft Entra help in an Okta negotiation?
Yes. Customers who tabled a costed Entra ID alternative landed 10 to 15 more discount points. The comparison needs real prices and a gap list, but it does not have to be a plan to migrate.
Which Okta products are most often licensed and unused?
Lifecycle Management and Governance come first, followed by newer attach products such as Workflows and Identity Threat Protection. They tend to be bought for the roadmap and put into use later, or never.
What is worth more, a discount or an uplift cap?
Usually the cap. A written single digit cap governs the price of every year in the next term, while extra points in year one are used up once. Ask for the cap before the discount is final, when Okta still wants the signature.
When should the Okta seat reconciliation happen?
Start about six months before the renewal opens, then repeat it before every renewal. Accounts go stale continuously, so a count cleaned once is inflated again by the next cycle. A quarterly usage report keeps the work small.
Who owns fixing the drift after the negotiation?
Whoever owns each source of stale accounts. Leavers belong with the HR driven joiner and leaver process, and contractor accounts usually belong with procurement or the hiring business unit. Splitting the list in the reconciliation is what makes that ownership clear.
What is the strongest point in an Okta negotiation?
The user count. The unit rate is set once per term, while the quantity is paid for every month, and Okta holds the sign in records that show which accounts are dormant. That makes the count the one argument Okta cannot easily dispute.