Active user reconciliation removed 10 to 20 percent of licensed seats before renewal, almost all of them leavers and stale contractors, which makes identity the one estate that can prove its own overcount
Every system has dormant accounts. Identity is the system that knows about them, which is why the count is a stronger argument here than the rate will ever be.
Prepared by Redress Compliance · August 18, 2026 · Identity advisory. 12 to 18 Okta Workforce Identity negotiations advised, 2024 to 2025.
Executive summary
Reconciling active users before renewal removed 10 to 20 percent of licensed seats. Mostly leavers and stale contractor accounts, in most of the estates advised, before any discount was discussed.
Pricing SSO plus MFA a la carte instead of the suite saved 25 to 40 percent against the bundled quote, because the suite adds products many estates never switch on.
List is a printed anchor, not the price. Okta publishes per user per month rates, and deals above roughly a thousand users routinely close 20 to 40 percent below them depending on term and product mix.
Estates that tabled a costed Entra ID alternative landed 10 to 15 more discount points. Microsoft 365 E3 and E5 estates already own an alternative, and Okta prices against that fact whether the buyer raises it or not.
How does Okta Workforce Identity actually price?
Per user per month per product, against published list rates. Okta prints its numbers on the Okta pricing page, which is unusual and useful: every discount is measurable against an anchor both sides can see.
Single Sign On, Adaptive MFA, Universal Directory and Lifecycle Management are separate line items unless they are rolled into a suite. That separation is where the second finding in this brief lives.
| Product | What it does | How often it is fully deployed |
|---|---|---|
| Single Sign On | The entry product, documented on the Okta SSO pages | Nearly every estate, fully |
| Adaptive MFA | The second universal product | Usually paired with SSO in the first contract |
| Lifecycle Management and Governance | Joiner leaver automation and access review | Licensed often, operationalized rarely |
| Workflows and Identity Threat Protection | Newer attach products | Bought on the roadmap, deployed later or never |
List is the anchor and not the price
Deals above roughly one thousand users close 20 to 40 percent below list depending on term length and product mix. A quote at list is an opening position, not an offer.
Why is the user count worth more than the rate?
Because the rate is negotiated once and the count is billed every month. Renewals price the licensed count, and licensed counts drift upward on their own while nobody is watching.
Across the negotiations advised, reconciling active users against licensed users removed 10 to 20 percent of seats. The removals were not contentious. They were leavers and contractors whose accounts had outlived the engagement.
Identity is the one estate that can prove its own overcount. Every other system guesses at who is really using it. This one holds the authoritative record of who logged in, when, and whether they still work here.
The Okta Workforce Identity renewal brief
Defending the seat count, unpicking the suite against a la carte, and the cap language that decides what the second term costs.
Get the brief →What 12 to 18 Okta negotiations showed
Across roughly 12 to 18 Okta Workforce Identity negotiations Fredrik Filipsson advised between 2024 and 2025, the licensed user count moved more money than the unit rate did.
Active user reconciliation removed 10 to 20 percent of licensed seats in most estates. Leavers and stale contractor accounts made up almost all of it, which means the correction needed evidence rather than argument.
Buyers who priced SSO plus MFA a la carte rather than accepting the suite saved 25 to 40 percent against the bundled quote. The suite is only cheaper if you deploy the products inside it, and Lifecycle Management is the one most often licensed and never operationalized.
Estates that tabled a costed Microsoft Entra ID alternative landed 10 to 15 more discount points than estates without one. The alternative did not have to be a migration plan. It had to be priced.
None of those three levers is a rate argument. All three are settled before the conversation about percentage begins.
- Your quote benchmarked against 500,000+ real closed deals, adjusted for size, region, and industry
- Licensed seats reconciled against active users, with leavers and contractors separated out
- Uplift and cap language flagged with the exact quote, the page, and the replacement text
Suite or a la carte, and how do you tell?
Count the products you have actually switched on. SSO plus MFA covers most workforces, and the full Workforce Identity suite adds products that many estates never deploy.
- List every product in the quote against a deployment date, and treat anything without one as a roadmap purchase rather than a requirement.
- Price the two universal products separately before accepting a bundle rate, which is what surfaced the 25 to 40 percent gap.
- Ask what governance actually replaces, because Lifecycle Management earns its cost only where it removes manual joiner leaver work.
Identity sits next to the rest of the security estate at renewal. Our briefs on CrowdStrike and Zscaler work the same count and bundle questions on adjacent lines.
The Entra overlap is real and it is not a threat
A Microsoft 365 E3 or E5 estate already owns an alternative. Pricing that overlap honestly is worth 10 to 15 discount points, and it commits you to nothing. Our brief on the Entra suite works the bundle arithmetic on the other side of that comparison.
What protects the second term?
A written cap, agreed while the count is still being negotiated. A single digit uplift cap is worth more over a term than a deeper year one discount, and it is much cheaper to obtain at signature than at renewal.
The commercial terms sit in the Okta agreements, and the renewal mechanic is the clause worth reading before the rate is settled.
Reconcile before every renewal, not once
Seat drift is not a one time cleanup. Leavers accumulate continuously, so a count reconciled at the last renewal is already wrong by the next one.
What the negotiations measured, 2024 to 2025
Two cuts of the engagement file frame where the money moved.
Mostly leavers and stale contractor accounts, across the estates advised, before any discount was discussed.
Against the suite quote, in estates that were not deploying the rest of the products in the bundle.
Both are count and scope findings rather than rate findings, which is the pattern this whole brief describes.
Watch the briefing · 6:05Pricing Okta Against the Identity You Already OwnHow to price the Entra overlap honestly and use it without committing to a migration you do not want.
Your first five moves
- Reconcile licensed seats against active users before the renewal opens, which removed 10 to 20 percent of the count across the estates advised.
- Separate leavers from contractors in that list, because the two need different internal owners to stay fixed after the renewal.
- Price SSO and MFA a la carte against the suite quote, a comparison worth 25 to 40 percent where the extra products are not deployed.
- Cost the Entra alternative you already own, which was worth 10 to 15 discount points and commits you to nothing.
- Take the written uplift cap over a deeper year one discount. The negotiation practice runs the seat reconciliation before the quote is built.
Frequently asked questions
How much of an Okta seat count is usually stale?
Between 10 and 20 percent in most estates advised. Reconciling active users against licensed users before renewal removed that much, almost all of it leavers and stale contractor accounts.
Is the Okta suite cheaper than buying products separately?
Only if you deploy what is in it. Buyers who priced SSO plus MFA a la carte saved 25 to 40 percent against the bundled quote, because the suite adds products many estates never switch on.
Does Okta publish list pricing?
Yes, per user per month per product. That is unusually helpful, because every discount is measurable against a printed anchor rather than against a number the seller describes.
What discount is realistic?
Deals above roughly one thousand users close 20 to 40 percent below list, depending on term length and product mix.
Does having Microsoft Entra help in an Okta negotiation?
Yes. Estates that tabled a costed Entra ID alternative landed 10 to 15 more discount points. The alternative has to be priced, but it does not have to be a migration plan.
Which Okta products are most often licensed and unused?
Lifecycle Management and Governance, then the newer attach products. They are bought on the roadmap and operationalized later, or not at all.
What is worth more, a discount or an uplift cap?
The cap. A written single digit uplift cap governs every year of the term, while a deeper year one discount is spent once.
When should the seat reconciliation happen?
Before the renewal opens, and then before every renewal after that. Leavers accumulate continuously, so a count cleaned once is wrong again by the next cycle.
Who owns fixing the drift after the negotiation?
Whoever owns the joiner leaver process, which is why separating leavers from contractors in the reconciliation matters. They are usually two different owners.
What is the single strongest lever in an Okta deal?
The count. The rate is negotiated once and the count is billed every month, and identity is the one estate that holds the authoritative record of who actually logged in.
