Okta's model is a stack of separately-priced modules on the same user. Reps land you cheap on SSO, then layer MFA, Lifecycle Management, Workflows, and Governance until a $2/user login quietly becomes $18–$25+/user.
What you should really pay
| Product / suite | List $/user/mo |
|---|---|
| Workforce suites (Starter / Core / Essentials) | $6 / $14 / $17 |
| SSO / MFA (legacy per-product) | $2 / $3 |
| Lifecycle Management / Workflows | $4 / $4 |
Most Okta buyers take only ~14% off — there's clear room. Multi-year and prepay reach 20–40% on enterprise deals.
The traps
- Per-module stacking — every capability is a separate SKU on the same user.
- The downstream "SSO tax" — your other SaaS vendors charge 15–100%+ to enable SSO; often the largest hidden identity cost.
- Uplift + auto-renewal at 7–10%+ without a negotiated cap.
The levers that work
- Play the Microsoft Entra card. If you run M365 E3/E5 you already own Entra ID P1/P2 — tell Okta you can fund identity through your Microsoft agreement at near-zero incremental cost. Nothing resets an Okta quote faster.
- Right-size the stack: commit multi-year only on what you'll deploy (SSO/MFA/UD); keep Governance and Auth0 on annual flexibility.
- Refuse to pay twice for controls you already own in Entra P2 or your EDR stack.
- Lock renewal protections: uplift cap ≤3–5%, remove auto-renewal, co-term all SKUs.
Timing
Okta's fiscal year ends January 31 — fiscal-year-end deals can save up to ~30% more if you're ready to sign on demand.
Bottom line
Don't pay for a stack you don't deploy, and don't pay twice for what Entra already covers. Right-size, play the Microsoft card, and close in January.
Get the full Okta playbook
Real pricing benchmarks, every cost trap with dollar examples, the discount levers and the ranges buyers actually hit, fiscal-year timing, and copy-paste negotiation emails.
Browse the benchmarksGet the free checklist