Costing an identity programme honestly: why licences are the small number

Licences Are Usually the Small Line Item

A 50,000-user identity programme can show a licence quote of $180,000 a year and still land at $1.4 million in year one. The surprise is not the software; it is the work around the software: directory cleanup, app integration, MFA rollout, support design, and the migration cutover that burns weekends.

That is why the identity programme cost should never start with licence pricing. It should start with the operating model, because the licence is often 10-25% of the first-year total and even less in year two once implementation is done.

A common failure pattern in 2026 looks like this: a CTO approves a modern IAM platform, the security team celebrates a lower licence quote, and six months later the programme is over budget by 40% because 120 applications still need custom connectors, 18,000 identities need remediation, and the service desk is handling 900 password-reset tickets a week.

Build the Cost Model Around Work, Not Vendor Quotes

A realistic identity programme cost model has six buckets:

1. Software licences and usage tiers
2. Professional services and implementation
3. Internal engineering time
4. Data remediation and migration
5. Operations, support, and governance
6. Change management and adoption

If you only model bucket 1, you will understate the programme by a factor of 3x to 8x depending on app sprawl and identity quality.

A practical 50,000-user example

Here is a representative 2026 enterprise case:

• 50,000 workforce identities
• 140 applications, including 35 SaaS apps, 22 legacy web apps, 11 on-prem systems, and 72 internal APIs
• 18,000 users with stale attributes or duplicate records
• 9,500 users needing MFA enrollment support
• 14 identity-related workflows to redesign, including joiner/mover/leaver and privileged access approvals

Estimated first-year spend:

• Licences: $180,000
• Implementation partner: $420,000
• Internal engineering: $310,000
• Directory and data cleanup: $140,000
• Change management and training: $85,000
• Testing, cutover, and hypercare: $95,000
• Operations and support setup: $160,000

Total: $1.39 million

The licence line is 13% of the total. That is why the identity programme cost conversation must be framed as a business transformation budget, not a software procurement.

What to measure before you buy

Use these inputs before you request pricing:

• Number of identities by type: workforce, contractors, partners, service accounts
• Number of apps by integration pattern: SCIM, SAML, OIDC, LDAP, custom API, mainframe
• Current directory hygiene: duplicate rate, stale accounts, attribute completeness
• MFA coverage and recovery volume
• Privileged account count and review cadence
• Help desk ticket volume tied to identity events

If you cannot quantify these, your identity programme cost estimate is speculation.

The Hidden Cost Drivers Vendors Do Not Put on the Quote

Vendors price the platform. They do not price your reality. Your identity programme cost rises when your environment has old directories, brittle app code, or weak governance.

1. Application integration complexity

A clean SaaS app with SCIM provisioning may take 4-8 hours to integrate. A legacy app with no API, no SCIM, and a custom LDAP bridge can take 3-6 weeks.

Example:

• 40 SaaS apps at 6 hours each = 240 hours
• 20 legacy apps at 24 hours each = 480 hours
• 10 custom apps at 40 hours each = 400 hours

That is 1,120 hours before testing, which at a blended $140/hour internal and partner rate is $156,800.

2. Identity data remediation

In 2026, many enterprises still discover that 8-15% of user records are incomplete or inconsistent across HR, directory, and app systems. Fixing this is not a script-only task.

A realistic remediation plan may include:

• Attribute mapping workshops
• HR source-of-truth validation
• Duplicate resolution
• Exception handling for contractors and affiliates
• Reconciliation after each sync cycle

If 18,000 of 50,000 identities need cleanup and each takes 6 minutes of analyst time, that is 1,800 hours. At $65/hour, that is $117,000 before rework.

3. Support and hypercare

After go-live, identity tickets spike. A typical rollout sees:

• Password reset tickets up 25-40% during the first 30 days
• MFA enrollment tickets up 15-30% during the first two weeks
• Access request tickets down only after workflow tuning

If your service desk handles 1,200 identity tickets per month at $12 per ticket, a 30% spike for three months adds $12,960. That sounds small until you include the escalations, after-hours support, and lost productivity.

4. Governance and audit work

The identity programme cost also includes access reviews, policy exceptions, and evidence collection. In regulated environments, this can consume 0.5-1.5 FTEs per 10,000 users.

A financial services firm with 70,000 users and quarterly access recertification may spend:

• 1 compliance manager at $145,000 loaded cost
• 2 IAM analysts at $110,000 each
• 0.5 security engineer at $95,000

That is $395,000 annually just to keep governance moving.

Use a Cost Model That Shows Year 1, Year 2, and Run Rate

A serious identity programme cost model separates one-time and recurring spend. Otherwise you will overpay for perpetual services or underfund operations.

A simple structure you can use

Year 1 = licences + implementation + migration + internal labour + training + hypercare
Year 2 = licences + operations + support + governance + incremental enhancements
Run rate = licences + steady-state ops + audit + platform admin + minor change backlog

Example spreadsheet logic

Year1_Total = Licences + SI_Fees + Internal_Costs + Data_Cleanup + Training + Cutover + Hypercare
Year2_Total = Licences + IAM_Ops + HelpDesk + Governance + Minor_Enhancements
3Yr_TCO = Year1_Total + Year2_Total + Year3_Total
Cost_Per_User = 3Yr_TCO / Active_Users
Cost_Per_App = Integration_Costs / Integrated_Apps

For a 50,000-user programme, a 3-year total cost of $2.35 million equals $15.67 per user per month. That is a far better executive metric than licence cost alone.

What good looks like in 2026

Healthy programmes usually land in these ranges:

• Workforce IAM: $12-$28 per user per month all-in
• Customer identity at scale: $0.03-$0.15 per monthly active user for platform fees, but much higher once engineering is included
• Privileged access: often 2x-4x the base IAM cost because of workflow and audit overhead

These are not vendor benchmarks. They are planning ranges for the identity programme cost conversation.

Architect for Lower Cost, Not Just Better Features

The cheapest identity programme is the one that avoids custom work. Architecture decisions have direct cost impact.

Prefer standards-first integration

Use SCIM, SAML 2.0, OIDC, and LDAP only where needed. Every custom connector becomes future maintenance debt.

identity_integration_policy:
  preferred_protocols:
    - SCIM 2.0
    - OIDC
    - SAML 2.0
  legacy_only:
    - LDAP
    - custom REST connector
    - file-based import
  controls:
    require_owner: true
    require_test_plan: true
    require_rollback: true

This kind of policy reduces long-term identity programme cost because you stop paying for one-off integrations that break during vendor upgrades.

Reduce directory sprawl

If you have three directories, two HR sources, and a shadow CSV feed owned by finance, your costs will keep climbing.

A cleaner model is:

• One authoritative HR source
• One primary identity store
• One lifecycle engine
• One audit trail

That architecture typically reduces reconciliation effort by 20-35% and cuts access-related defects by 15-25% after stabilization.

Automate the boring parts

Automation is where the programme pays back.

#!/usr/bin/env bash
# Example: nightly identity drift check
ldapsearch -x -H ldaps://id.example.com -b "ou=users,dc=example,dc=com" > users.ldif
python3 compare_hr_to_directory.py --hr hr_export.csv --dir users.ldif --report drift.json
jq '.missing + .duplicate + .stale' drift.json

A nightly drift job like this can detect stale accounts in under 12 minutes for a 50,000-user directory, compared with 4-6 analyst hours for manual reconciliation. That is a direct reduction in identity programme cost.

Common Pitfalls

The same mistakes keep inflating the identity programme cost.

Mistake 1: Buying licences before mapping applications

If you do not know which apps need provisioning, MFA, or SSO, you will buy the wrong tier. Fix it by building an application inventory with integration complexity scoring before procurement.

Mistake 2: Ignoring identity data quality

Bad employee IDs, duplicate emails, and missing manager fields break workflows. Fix it by assigning data owners and adding validation rules at the HR source.

Mistake 3: Underestimating internal engineering time

Even with a partner, your team will spend time on security reviews, networking, secrets management, and testing. Fix it by reserving 15-25% of the implementation budget for internal labour.

Mistake 4: Treating hypercare as optional

Identity changes affect every user. If you do not fund hypercare, your help desk absorbs the pain. Fix it by budgeting 6-12 weeks of elevated support.

Mistake 5: Pricing only for go-live

A platform that costs little to deploy can cost a lot to operate. Fix it by using a 3-year TCO model and reviewing the identity programme cost quarterly.

A CFO-Friendly Way to Present the Business Case

Executives do not need a feature list. They need a cost curve and a risk curve.

Use this structure:

1. Current-state cost: help desk tickets, audit effort, manual onboarding, access review labour
2. Programme cost: licences, implementation, migration, support
3. Savings and avoidance: fewer tickets, faster onboarding, lower audit findings, reduced account leakage
4. Payback window: usually 12-24 months for workforce IAM when manual processes are heavy

Example savings from a 50,000-user programme:

• 18% fewer password-related tickets = $38,000/year
• 30% faster onboarding = 2,400 saved labour hours/year
• 40% less access review effort = $96,000/year
• Reduced orphan account exposure = risk reduction that is hard to price but easy to justify

If you present the identity programme cost honestly, you can defend the investment without overselling the platform.

Key Takeaways

• Start every identity programme cost model with apps, data quality, and operating effort, not licence quotes.
• Expect licences to represent only 10-25% of first-year spend in many enterprise deployments.
• Treat integration, remediation, hypercare, and governance as first-class budget lines.
• Use 3-year TCO, cost per user, and cost per app as your executive metrics.
• Prefer standards-first architecture to reduce custom connector debt.
• Fund operations and support from day one, or the programme will look cheap and perform expensively.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.