Single sign-on is usually bought for the wrong reason. Teams shop for it because staff complain about passwords, then discover six months later that the real value was somewhere else: one place to switch off an account the day someone leaves, one place to require phishing-resistant sign-in, and one audit trail a client’s security questionnaire will accept. That difference matters for a small business, because the cheapest tier of most identity products covers the password problem and leaves the offboarding and audit problems untouched.
This guide compares six options a business of roughly 5 to 200 employees can realistically run: Microsoft Entra ID, Google Workspace with Cloud Identity, JumpCloud, Cisco Duo, Okta, and self-hosted Keycloak. It is written for the person who will own the rollout, not for a procurement committee.
How we compared these products
This is a documentation and pricing comparison, not a hands-on review. We did not run these products in a lab, and we do not claim performance results. What we did do is read each vendor’s own administrator documentation and public price list, and record only what the vendor states in writing. Four things were checked for every product:
- Published entry price. The lowest tier a small business can actually buy, taken from the vendor’s public pricing page. Where a price is only available through sales, the table says “not published” rather than guessing.
- Federation protocols. Whether the vendor documents SAML 2.0 and OpenID Connect for third-party apps, which determines whether your existing SaaS tools can be connected at all.
- Automated provisioning. Whether SCIM-based user provisioning and de-provisioning is documented, because that is what turns offboarding from a checklist into an automatic action.
- Phishing-resistant sign-in. Whether passkeys or FIDO2 security keys (the W3C WebAuthn standard) are documented, and at which tier.
Prices below are list prices in USD per user per month, checked on 2 September 2026, and every one of them is annual-commitment pricing unless stated otherwise. Vendors change pricing without notice, so treat these as a starting point for a quote rather than a guarantee.
Comparison at a glance
| Product | Published entry price | SAML 2.0 / OIDC | SCIM provisioning | Passkeys / FIDO2 | Contract minimum |
|---|---|---|---|---|---|
| Microsoft Entra ID P1 | $7.00 per user/month, annual commitment | Both documented | Documented (SCIM 2.0) | Documented | None published |
| Google Workspace + Cloud Identity | Workspace Business Starter $7.00 per user/month, annual commitment; Cloud Identity Free edition includes 50 licences | Both documented | Documented (automated provisioning) | Documented | None published |
| JumpCloud (SSO package) | $11.00 per user/month billed annually, or $13.00 billed monthly; SSO as an individual module is $3.00 per user/month annually | Both documented | Documented | Documented as a paid add-on (JumpCloud Go, $5.00 per user/month annually) | None published |
| Cisco Duo | Free for up to 10 users; Duo Essentials $3.00 per user/month | Both documented (Duo Single Sign-On) | Not part of the SSO product | Documented | None published |
| Okta Workforce Identity | Starter suite $6.00 per user/month, billed annually | Both documented | Documented; Lifecycle Management sits in a higher tier or the governance add-on | Documented | $1,500 annual contract minimum |
| Keycloak (self-hosted) | No licence cost; you pay for hosting and administration | Both documented | SCIM endpoints documented in the admin guide | Documented (WebAuthn, including passwordless) | Not applicable |
Microsoft Entra ID: the default if you already pay for Microsoft 365
If your business runs on Microsoft 365, you already have an identity provider and the decision is narrower than it looks: it is a decision about which Entra tier, not which vendor. Microsoft publishes Entra ID P1 at $7.00 per user per month on an annual commitment, and P2 at $10.00. Microsoft also states that P1 is included with Microsoft 365 Business Premium, which is the detail most small businesses miss — if you are on Business Premium, you are entitled to P1 and may only need to turn it on.
The tier matters because Conditional Access — the policy engine that lets you say “finance apps require a compliant device” or “block sign-in from outside our country” — is a P1 capability, not a free-tier one. Microsoft’s own deployment guidance documents SAML, OpenID Connect and password-based SSO for gallery and custom applications, and its provisioning documentation covers SCIM 2.0 for creating and removing accounts in connected apps. Passkeys and FIDO2 security keys are documented as supported passwordless methods.
Where it disappoints: non-Microsoft device management. Entra will happily authenticate a Mac, but device-compliance policy that is genuinely equal across Windows and macOS usually pulls you further into Intune, and that is another product to learn. Choose Entra when Windows is your majority.
Google Workspace and Cloud Identity: strong value, one important limit
Google’s arrangement confuses buyers, so it is worth stating plainly. Cloud Identity is the identity product; Google documents a free edition that includes 50 user licences by default, with more available on request, and a premium edition whose billing is handled as part of a Google Workspace subscription rather than as a separate Google Cloud line item. Google does not publish a standalone per-user price for Cloud Identity Premium on its Cloud Identity pricing page, so if a reseller quotes you one, ask them to show it in writing.
What you can price precisely is Workspace itself: Business Starter is listed at $7.00 per user per month with an annual commitment, Business Standard at $14.00 and Business Plus at $22.00, with promotional discounts running at the time of writing. Google documents SAML-based SSO for a catalogue of pre-integrated third-party applications plus custom SAML apps, and automated user provisioning to supported apps.
Where it disappoints: Context-Aware Access, Google’s equivalent of conditional policy, is documented as a premium-edition capability. A business on the free Cloud Identity edition gets sign-on but not the access rules, which is exactly the gap that fails a security questionnaire later.
JumpCloud: for mixed fleets with no on-premises directory
JumpCloud is the option to look at when your laptops are a genuine mix of macOS, Windows and Linux and you have never had Active Directory. It sells both bundles and individual modules, and the module pricing is unusually transparent: SSO on its own is listed at $3.00 per user per month billed annually, the same as MFA, cloud directory and conditional access. The bundled “SSO” package — SSO and MFA plus password management — is listed at $11.00 per user per month billed annually or $13.00 billed monthly.
JumpCloud’s help centre documents SAML 2.0 SSO through both pre-built and custom application connectors, and OIDC through a custom OIDC connector. Passwordless sign-in via JumpCloud Go is listed as a separate $5.00 per user per month module, so a passwordless rollout is a deliberate budget line rather than something included by default.
Where it disappoints: à-la-carte pricing looks cheap and then stacks. SSO plus MFA plus conditional access plus passwordless is four modules, and at that point compare the total against a bundle before you commit.
Cisco Duo: the cheapest credible starting point
Duo is the only product here with a genuinely usable free tier: Cisco publishes Duo Free at $0 for up to 10 users with MFA and integrations included, then Duo Essentials at $3.00 per user per month, Advantage at $6.00 and Premier at $9.00. Duo documents Duo Single Sign-On as a hosted identity provider supporting both SAML 2.0 and OIDC, including a generic connector for applications without a pre-built guide.
For a ten-person consultancy that needs strong sign-in on a handful of web apps this week, Duo is the least painful place to start, and the upgrade path to risk-based authentication sits in the Advantage tier.
Where it disappoints: Duo is an access-security product layered on a directory, not a directory itself. It authenticates people; it does not become the system of record that creates and deletes their accounts. If automatic joiner-mover-leaver provisioning is the outcome you are buying, Duo alone will not deliver it.
Okta: capable, but read the contract minimum first
Okta’s Workforce Identity Starter suite is listed at $6.00 per user per month billed annually, which reads as competitive until you reach the footnote: Okta states a $1,500 annual contract minimum for Workforce Identity. For a 15-person business that is effectively a floor of roughly $100 per month regardless of headcount, and it is the single most common surprise in Okta quotes at this size.
Above Starter, Okta publishes Core Essentials at $14.00 and Essentials at $17.00 per user per month, with Professional and Enterprise priced through sales. Okta documents SCIM provisioning through its app integration wizard, and its Lifecycle Management and access governance capabilities are packaged in higher suites or the Okta Identity Governance add-on rather than in Starter. Okta is the right answer when SaaS breadth is your dominant requirement — its integration network is the largest of the group — and the wrong answer when you are simply trying to secure Microsoft 365 for 20 people.
Keycloak: free software, not free identity
Keycloak is open-source and has no licence cost. Its administrator guide documents OpenID Connect and SAML for applications, W3C WebAuthn including passwordless authentication with passkeys, and SCIM endpoints for managing users and groups. On capability it is not a toy.
Where it disappoints: everything a vendor normally absorbs is now yours. You run the server, the database, the certificates, the upgrades and the availability of the thing that stands between your staff and every application they use. If Keycloak is down, nobody works. Choose it when you already have someone who operates production infrastructure as part of their job, and avoid it when your IT capacity is one part-time person or an outsourced provider.
Which one fits your situation
- Microsoft 365 shop, mostly Windows: Entra ID P1. Check whether Business Premium already entitles you to it before buying licences.
- Google Workspace shop: stay with Google, and price the Workspace tier that includes the access controls you need rather than assuming the free Cloud Identity edition covers them.
- Mixed macOS/Windows/Linux laptops, no directory today: JumpCloud, with the module list priced out honestly before signing.
- Ten people, needs MFA and SSO this month, minimal budget: Duo, starting on the free tier.
- Dozens of SaaS apps and provisioning is the point: Okta, provided the $1,500 annual minimum is acceptable.
- In-house infrastructure skill and a preference for self-hosting: Keycloak.
Five things to confirm before you sign
- Which tier includes conditional or context-aware access. This is the most common upsell. Ask for the tier name in writing.
- Whether your specific apps are supported for provisioning, not just sign-in. SAML support and SCIM support are different lists, and vendors publish them separately.
- Billing term and any contract minimum. Annual-commitment prices are the ones advertised; monthly billing is typically higher, and Okta publishes a hard annual floor.
- Whether passwordless costs extra. It is included with some products and a paid module with others.
- What happens to access on the day someone leaves. If the answer involves a human remembering to visit each application, you have not solved the problem you are paying to solve.
A rollout order that avoids the usual mess
Connect email and file storage first, because that is where most of your risk sits and because those integrations are the best documented. Enrol administrators in phishing-resistant sign-in before anyone else; the FIDO Alliance’s rationale for passkeys is that they remove the reusable secret an attacker can phish, and admin accounts are what attackers phish for. Then connect the two or three applications that hold customer or financial data, and only then work through the long tail. Turn on automated de-provisioning last, once you trust the group membership that drives it, and test it with a real departure before you rely on it.
Budget an afternoon per application rather than a morning for all of them. The work is not technically difficult; it is a sequence of small vendor-specific configuration steps, and it goes wrong when it is rushed across a whole estate in one sitting.
Sources
- Microsoft Entra plans and pricing — Entra ID P1 and P2 list pricing and Microsoft 365 inclusion.
- Microsoft Learn: plan a single sign-on deployment — supported SSO protocols.
- Microsoft Learn: SCIM 2.0 support in Entra ID — automated provisioning.
- Microsoft Learn: Conditional Access overview — licensing tier for policy enforcement.
- Microsoft Learn: passwordless authentication options — passkeys and FIDO2 security keys.
- Google Cloud: Cloud Identity pricing — free edition licence allowance and premium-edition billing.
- Google Workspace pricing — Business Starter, Standard and Plus list prices.
- Google Workspace Admin Help: SAML apps — pre-integrated and custom SAML SSO.
- Google Cloud Identity Help: Context-Aware Access — premium-edition requirement.
- JumpCloud pricing — package and per-module pricing, annual and monthly.
- JumpCloud Help: get started with SAML SSO — SAML connector workflow.
- JumpCloud Help: SSO with OIDC — custom OIDC connector.
- Cisco Duo editions and pricing — Free, Essentials, Advantage and Premier tiers.
- Duo documentation: Duo Single Sign-On — SAML and OIDC support.
- Okta pricing — Workforce Identity suite prices and the $1,500 annual contract minimum.
- Okta Help: SCIM provisioning in the app integration wizard.
- Keycloak server administration guide — OIDC, SAML, WebAuthn and SCIM.
- FIDO Alliance: passkeys — why passkeys resist phishing.