Contents
Key takeawaysHow Oracle IAM is licensedWhere the cost goes wrongProcessor versus Named User PlusDirectory Services Plus pricingRestricted use rightsWhat we have seenWhat Oracle will sayContract terms to ask forChecking your positionSupport timelineWhat to do nextFAQOracle IAM is three separately priced and separately audited suites, and the directory is priced differently from the other two. Most overpayment comes from counting errors made before the negotiation opens, which no discount can correct.
- Three suites, three order lines. Identity Governance Suite, Access Management Suite Plus and Directory Services Plus are licensed and audited independently, so one entitlement never covers the stack.
- Two suites share a price. Governance and access management list at about $180,000 a processor or $3,600 a named user, with support at 22 percent a year.
- The directory has its own metrics. Directory Services Plus lists at about $12 per employee user with a 2,000 minimum and $4 per external user, or $50,000 per processor.
- Break even near 50 users per processor. Processor licensing wins above roughly 50 named users per processor, after the core factor has been applied to every host.
- Unused suites still cost support. Where all three suites were bought and only two ran, 30 to 45 percent of the spend supported components that never went live.
- Included products have limits. The bundled WebLogic, BI Publisher and database rights cover the identity components only, and wider use creates full license exposure.
- The upgrade has a date. Extended support for the 12.2.1.4 line ends in December 2027, so fix the license model before upgrading to 14c.
How is Oracle identity and access management licensed?
Oracle sells identity and access management as three separately priced suites: Identity Governance Suite, Access Management Suite Plus and Directory Services Plus. They are marketed as one product family, but each suite has its own order line, metric and audit count. One entitlement never covers the whole stack.
| Offering | Main components | Metric | List price |
|---|---|---|---|
| Identity Governance Suite | Identity Manager, Identity Role Intelligence, connectors | Processor or Named User Plus | ~$180,000 per processor or ~$3,600 per Named User Plus |
| Access Management Suite Plus | Access Manager, Adaptive Access Manager, Identity Federation, Entitlements Server | Processor or Named User Plus | Same as Identity Governance Suite |
| Directory Services Plus | Unified Directory, Internet Directory, Virtual Directory, Directory Server Enterprise Edition | Employee User, Non Employee User (external), or Processor | ~$12 per employee user with a 2,000 minimum, ~$4 per external user with a 5,000 minimum, or $50,000 per processor |
| Enterprise Single Sign-On Suite Plus | Logon Manager, Password Reset, Kiosk Manager | Named User Plus, sold separately | ~$85 per Named User Plus, not part of the three suites |
Support follows the license at 22 percent: $792 a year per Named User Plus on the governance or access suite, $39,600 per processor, and $2.64 per directory employee user. Current rates are on our technology price list page.
Which suite does Oracle Unified Directory belong to?
Oracle Unified Directory sits inside Directory Services Plus, so it licenses on the directory's metrics. Teams that deployed it expecting the suite processor rate priced it on the wrong basis from the first spreadsheet.
Build your entitlement model from the component lists in Oracle's licensing documentation, then reconcile it against what is installed. The two lists diverge more often than they match, and an audit reads deployed binaries, not product brochures. The middleware underneath carries its own exposure, covered in our middleware audit risk guide.
Is enterprise single sign on part of the three suites?
No. Enterprise Single Sign-On Suite Plus is a separate product at about $85 per Named User Plus, although it sits beside the suites in the same product family. If you run desktop single sign on through Logon Manager, that needs its own order line. For web access, see our guide to Oracle Access Manager licensing.
How to Negotiate an Oracle ULA: No Price List, Just Your Business Case
Why do Oracle IAM costs go wrong before the negotiation starts?
They go wrong because the quantity is calculated incorrectly, and a discount only reduces the price of that quantity. A buyer can win an excellent discount and still overpay for licenses that were never required. Five calculation errors account for most of it.
- Pricing the directory like the other suites. Directory Services Plus has its own user metrics, floors and processor price, so borrowed arithmetic gives a number no percentage off can fix.
- Counting cores without the core factor. The processor count comes out too large on the most common chips.
- Missing the Named User Plus minimum. The per processor floor, not the user count on paper, then sets the bill.
- Buying the bundle for the stack. Suites that never reach production still carry license and support, hidden inside one identity line on the invoice.
- Skipping the break even. The crossover between metrics can be computed before any conversation with Oracle.
All five are spreadsheet errors, and you can correct them at no cost before the commercial process opens. Fix them first, so the discount applies to a quantity you actually need.
Oracle CIO guide
The five year plan to control Oracle spend, from metric choice to support renewals.
Get the white paper →When does processor licensing beat Named User Plus for Oracle IAM?
Processor licensing wins above roughly 50 named users per processor. At $180,000 against $3,600, the crossover is simple division. Compute it separately for governance and for access management, because each suite can run on different hardware with a different user population.
Say you run Access Management Suite Plus on two servers with 8 Intel Xeon cores each, and 600 people sign in through it. The hypothetical arithmetic below, at list price, shows how skipping the core factor changes the metric you choose.
| Step | Correct model | Model without the core factor |
|---|---|---|
| Physical cores | 16 | 16 |
| Core factor | 0.5 | Not applied |
| Processor licenses | 8 | 16 |
| Processor cost at $180,000 | $1,440,000 | $2,880,000 |
| Break even (processors x 50) | 400 users | 800 users |
| Named User Plus cost, 600 x $3,600 | $2,160,000 | $2,160,000 |
| Metric the model picks | Processor | Named User Plus |
| License fee signed | $1,440,000 | $2,160,000 |
| Annual support at 22 percent | $316,800 | $475,200 |
The flawed model overpays $720,000 at list and $158,400 in support every year after. The error did more than inflate a count. It pushed the buyer onto the wrong metric.
How does the core factor change the processor count?
Oracle multiplies physical cores by a factor from its published table: 0.5 for current Intel Xeon and AMD EPYC chips, 1.0 for IBM POWER. On a single Xeon host, forgetting the factor doubles the count. Our core factor guide covers the table in detail.
Virtualization adds a second trap. Oracle does not accept most VMware configurations as a limit on processor counts, so the count can reach every host a virtual machine could run on. Our soft partitioning guide covers the evidence Oracle accepts.
What is the Named User Plus minimum, and when does it set the bill?
Named User Plus licenses carry a minimum number of users per processor, which your ordering document reflects. When real users fall below processors times that minimum, you pay for the minimum, and the metric you chose on paper no longer decides the bill. Test it with the crossover calculator and our guide to Named User Plus minimums.
How is Oracle Directory Services Plus priced?
Directory Services Plus is priced on employee users at around $12 each with a 2,000 employee minimum, plus about $4 per external non employee user, with a 5,000 minimum on the external count. A processor option exists at $50,000. Say a company with 1,500 employees and 3,000 external users runs its directory on 4 processors after the core factor.
- Employee users. The 2,000 minimum applies, so 2,000 x $12 = $24,000.
- External users. The 5,000 minimum applies, so 5,000 x $4 = $20,000.
- User based total. $44,000 in license fees.
- Directory processor option. 4 x $50,000 = $200,000.
- A model that borrows the suite processor price. 4 x $180,000 = $720,000, more than 16 times the user based figure.
How does customer identity change the directory arithmetic?
Customer facing identity reverses the result. At 200,000 external users, the user metric costs $800,000, while 4 directory processors cost $200,000. For the two suites sold on Named User Plus, public access usually forces the processor metric, because Oracle does not let you license uncounted internet users on Named User Plus.
A 500 person workforce deployment and a retail login service with millions of accounts can run the same products and land on opposite metrics. Size workforce and customer identity as separate cases, even when they share servers.
What do the restricted use rights in Oracle IAM suites cover?
The suites include an application server as a host only, a reporting component for shipped reports only, and a database for directory data only. Inside those limits, they replace products you would otherwise buy. Beyond them, they create full license exposure on three additional products.
- WebLogic Server Enterprise Edition. Licensed solely to host the suite's own components. A custom application in the same domain needs a full license, as our WebLogic licensing guide explains.
- BI Publisher, now Oracle Analytics Publisher. Limited to shipped reports, with layout changes, or new reports on the uncustomized identity schema. See standalone versus bundled BI Publisher.
- Oracle Database Standard Edition as the directory's infrastructure database. Restricted to LDAP data for Internet Directory used as a general purpose directory. Any other data needs a full database license.
Most teams never read the restriction and first learn about it during an audit. Write the three boundaries into your architecture standards, so the next project cannot borrow the identity servers.
What have we seen in Oracle IAM reviews in 2024 and 2025?
Across roughly 30 to 40 Oracle IAM reviews between 2024 and 2025, one costly assumption kept returning: that a single entitlement covered the whole identity stack. It produced four patterns.
- Shelfware in the bundle. Buyers bought all three suites, only two ran in production, and 30 to 45 percent of the spend sat behind components that never went live.
- Core factor inflation. Processor counts sized without the correct core factor inflated the total license quantity in the sizing model by 15 to 25 percent on common chips.
- The minimum set the bill. On 2 in 5 reviews, the Named User Plus minimum was missed at sizing, and the per processor floor set the real bill.
- The directory on the wrong metric. Teams assumed the directory followed the same pair of metrics as the other two suites.
Each pattern could have been caught with arithmetic before the negotiation opened, using orders, hardware records and user counts the buyer already held.
Why we advise against buying all three suites for the bundle discount
The usual advice is to buy the full identity stack in one order, because the discount is larger and you will grow into it. We disagree. Oracle reprices the remaining support lines when you drop licenses, so shelfware is hard to exit. Buy the suites you will deploy within the term, with a price hold on the rest.
The bundle discount looks largest on the day you sign. The support on a suite you never deploy is paid every year after.
What will the Oracle account team say, and how should you answer?
Expect the conversation to push toward a larger footprint and a simpler metric. These are the lines we hear most, with replies that hold up.
- "The full suite costs little more than two of them." Ask for each suite priced separately. Compare the third suite's price with the support you will pay on it every year.
- "Processor licensing is simpler and covers growth." Show your break even per suite. Below 50 named users per processor, the simpler metric costs more.
- "The directory follows the access management metric." Point to the price list, where Directory Services Plus carries user and processor prices of its own.
- "WebLogic and the database are included." Agree, and ask for the restricted use terms in writing before anyone deploys against them.
What should the Oracle IAM order and contract say?
The ordering document should name each suite, its metric, its quantity and the hardware or user definition behind it. Anything left vague becomes Oracle's interpretation during an audit.
Terms to ask for before you sign
- A component schedule. List the products inside each licensed suite, so every installed binary maps to a line.
- The metric definitions in full. Attach the Employee User and Non Employee User definitions in force on the order date.
- A price hold. Fix the unit price for growth and for any suite you defer.
- Metric migration credit. Ask for credit toward processor licenses if user growth passes the break even.
- A support increase cap. Limit the annual uplift on the support base, which compounds for as long as you run the product.
Our support renewal contract checklist covers the support wording.
How do you check your own Oracle IAM license position?
Start from what is installed and running, then compare it with the orders. Oracle's audit team works from deployed software, so your review should too.
- Installed products. Run opatch lsinventory in each Oracle home and read the central inventory.xml.
- What runs on WebLogic. Read config.xml in each domain and flag any application that is not an identity component.
- Hardware. Record cores per host with lscpu or the hypervisor console, including every host in a VMware cluster.
- Users. Count governance users in Identity Manager, access users in Access Manager, and employees in your HR system.
- External users. Count entries in the directory's external user branch, for example with ldapsearch.
Then match the results against your ordering documents, suite by suite. Our guide to internal Oracle license audits sets out the full method.
Does the Oracle IAM support timeline change the licensing decision?
Yes, because it puts a date on the upgrade. Premier Support for the 12.2.1.4 release line ends in December 2026, and extended support ends in December 2027.
The current 14c line (14.1.2.1.0) shipped in March 2025 with a long support horizon. Oracle plans Premier and Extended Support for 8 years from that release, and at least two years of overlap with 12c.
Correct the licensing model before the upgrade to 14c starts. A migration changes hosts, cores and sometimes metrics, and an error carried onto new servers is harder to unwind.
| When | What to do |
|---|---|
| 12 months before | Inventory installed products, hosts and users. Map each component to a suite. |
| 6 months before | Apply the core factor, compute the break even per suite, check the Named User Plus minimum, price the directory on its own metric. |
| 3 months before | Decide which suites stay on support, request separate suite pricing, draft the contract terms. |
| 1 month before | Confirm restricted use scope in writing and sign only the quantities your model supports. |
What to do next
- Price the directory on its own metric. Employee users with the 2,000 floor plus external users, compared with the processor option.
- Build the entitlement model from component lists. Reconcile it against installed binaries.
- Apply the correct core factor. Do it for each host model before any quantity reaches the account team.
- Compute the break even for each suite. Test roughly 50 named users per processor and the minimum on your own numbers.
- Read the restricted use boundaries. Keep the included application server, reporting component and database inside their stated purpose.
- Plan the 14c upgrade on corrected numbers. Our Oracle practice runs the sizing with you.
Frequently asked questions
Is Oracle identity and access management one product?
No. It is three suites covering identity governance, access management and directory services, each with its own price, metric and audit count. Enterprise Single Sign-On is a fourth, separate product. Treating the family as one entitlement is the assumption behind most overpayments we review.
Which metric does each Oracle IAM suite use?
Identity Governance Suite and Access Management Suite Plus use processor or Named User Plus, at roughly $180,000 per processor and $3,600 per Named User Plus. Directory Services Plus uses employee users at about $12 with a 2,000 minimum, external users at about $4, or a processor price of its own. The metrics are not interchangeable across suites.
Where is the break even between processor and Named User Plus?
At roughly 50 named users per processor, the list price ratio of the two metrics. Run it per suite on counts taken after the core factor, and repeat it whenever you add hosts or users. A move to new hardware can flip the answer even if the user count stays flat.
Why do Oracle IAM processor counts come out wrong?
Because the core factor is left out, or the wrong factor is used for the chip. In our reviews that inflated license quantity by 15 to 25 percent. Oracle does not refund licenses bought in error, so the only cheap time to catch it is before the order is signed.
What is the Named User Plus minimum problem?
Each processor carries a minimum user count. When your real users fall below processors times that minimum, you pay for the minimum anyway, so the metric written into the order is not the one that decides the bill. We saw this on 2 in 5 of the environments we reviewed, usually discovered at invoice time.
Are the restricted use rights in Oracle IAM worth having?
Yes, as long as you stay within them. They save you buying a separate application server, reporting tool and directory database. The risk comes later, when another team finds spare capacity on the identity servers and deploys something unrelated. Review those hosts before every renewal.
Does the Oracle IAM support timeline affect the licensing decision?
It gives the decision a deadline. Extended support for the 12.2.1.4 line ends in December 2027, and a 14c upgrade usually means new hosts and new core counts. Fix the license model first, so the new servers are sized on correct counts from the start.
Do you need new licenses to upgrade Oracle IAM from 12c to 14c?
No, if the licenses are on active Software Update License and Support, which includes new releases of the same products. The cost risk sits in the new infrastructure: more cores, different chips or a virtualized cluster can raise the processor count when the upgraded suite goes live.