Pricing
Published so you can budget without a sales call. Compare it with an IGA platform licence or a full-time identity administrator.
Estimate
Runs in your browser; nothing you enter is sent or recorded. The tables below are the source of truth.
Figures exclude applicable taxes, which are added as a separate line item. They are estimates subject to scoping.
Three tiers, one feature set
Choose any tier your organization fits under. The scope and the audit are identical; included hours, certification cadence and readout length differ.
| Tier 1 | Tier 2 | Tier 3 | |
|---|---|---|---|
| Drift detection | Monthly | Monthly | Monthly |
| Access certification campaign | Annual | Semi-annual | Quarterly |
| Readout | Monthly, 30 min | Monthly, 60 min | Monthly, 60 min, plus a quarterly executive review |
| Included consult and remediation hours | 15 / month | 20 / month | 30 / month |
| Response commitment1 | 1 business day | 1 business day | 1 business day |
1 Governance requests only; incident response is out of scope. Extra certification campaigns are billable. A daily drift digest for every tier is on the roadmap; until then, drift is detected month over month.
Monthly retainer
12-month term. Monthly audit and drift detection, access certification, joiner-mover-leaver runbooks, evidence packaging and included hours.
| Tier | 1 tenant | 2 tenants | 3 tenants | Each additional |
|---|---|---|---|---|
| Tier 1 · up to 150 users | 1,800 | 2,600 | 3,200 | +550 |
| Tier 2 · up to 1,000 users | 2,900 | 3,900 | 4,800 | +750 |
| Tier 3 · any size | 6,000 | 7,100 | 8,000 | +900 |
Above the base (500 users on Tier 2, 1,000 on Tier 3), add $900 per month per 250 users, partial blocks rounded up. Tier 2 goes up to 1,000 users.
Retainer onboarding
One-time, at signature: connector setup, baseline build and runbooks. No user surcharge.
| Tier | 1 tenant | 2 tenants | 3 tenants | Each additional |
|---|---|---|---|---|
| Tier 1 · up to 150 users | 300 | 500 | 800 | +300 |
| Tier 2 · up to 1,000 users | 600 | 900 | 1,200 | +300 |
| Tier 3 · any size | 1,100 | 1,600 | 2,200 | +600 |
Included consult and remediation hours
One bucket for consulting and remediation: 15 hours on Tier 1, 20 on Tier 2, 30 on Tier 3, per organization, not per tenant. No rollover. Overage at the standard rate in one-hour increments, invoiced monthly in arrears.
One-time IAM audit
Fixed price, about two weeks, no ongoing commitment, walked through live.
if you sign a retainer at the same or higher tenant count within 60 days of the readout. Not refundable as cash.
| Tier | 1 tenant | 2 tenants | 3 tenants | Each additional |
|---|---|---|---|---|
| Tier 1 · up to 150 users | 2,750 | 3,900 | 4,800 | +800 |
| Tier 2 · up to 500 users | 5,500 | 7,700 | 9,600 | +1,600 |
| Tier 3 · up to 1,000 users; Tier 2 above 500 | 9,500 | 13,000 | 15,800 | +2,800 |
Tier 2 organizations above 500 users pay Tier 3 audit rates. Above 1,000 users, add $1,400 per 250 users, partial blocks rounded up.
On-premises Active Directory and hybrid identity
Quoted under its own statement of work: AD hygiene, Entra Connect sync, hybrid join, privileged AD groups, stale objects and delegation. Not in the figures on this page.
Rate card
For work outside the included hours and for fixed-bid projects.
| Standard consulting and project work | 100/hr |
|---|---|
| After-hours, weekend, holiday | 150/hr |
| Emergency identity support2 (4-hour minimum) | 180/hr |
| Fixed-bid projects (migration, JML build-out, readiness) | Quoted per statement of work |
| Billing increment | 1 hour |
2 Identity remediation help, not incident response or detection and response.
Terms
- 12-month term on retainers.
- 8% off for annual prepayment at signature, on the retainer and any user surcharge. Onboarding and hourly work are not discounted.
- 4% annual escalator after year one.
- Remediation in your tenant needs your documented approval and is logged in the remediation change record.
- Prices exclude applicable taxes, which are added as a separate line item.
- Findings are bounded by your licensing: PIM, access reviews and ID Protection need Entra ID P2 or Entra ID Governance; Defender for Identity needs its own licence. Missing licences become recommendations.
- Microsoft 365 commercial cloud only. Government clouds (GCC High, DoD) are not supported.
- Up to five tenants in published pricing; more are quoted.
- On-premises AD and fixed-bid projects are scoped separately.
- All figures in US dollars, and estimates subject to scoping.
Not sure which tier you are?
Free, no access granted, and it tells you what you are dealing with.