Cost of IAM in India: Auth0 vs Okta vs Azure AD vs Keycloak in INR (2026)
Exact INR pricing for Auth0, Okta, Azure AD, and Keycloak at 5 different user scales. Includes hidden costs, DPDP compliance overhead, and total cost of ownership for Indian SMEs.
KeycloakPro Team
KeycloakPro Team
The IAM Invoice That Made a CFO Call an Emergency Meeting
Priya Iyer, CFO of a Hyderabad-based logistics SaaS company, had approved the Auth0 subscription two years ago without much scrutiny. At ₹2.5L per year, it was a line item, not a line item anyone worried about.
The renewal invoice that landed in January 2026 was ₹19.8L.
The company had grown from 300 to 2,800 active users. Auth0's MAU-based pricing had grown right alongside them — silently, automatically, without a single approval workflow. The engineering team had added three new applications, each counting logins against the MAU cap. The customer-facing app had added social login, which pulled external users into the MAU count.
₹19.8L for authentication. Per year. Not for the product. For the login page.
Priya called the engineering head. He pulled up the Keycloak pricing page. There was no pricing page — it's open source. He called KeycloakPro. By the end of the month, they had a migration plan that would cut the authentication bill to ₹4.8L per year and improve compliance posture at the same time.
This guide gives you the exact numbers — in rupees — so you can have that conversation before the invoice arrives.
How IAM Products Price Their Services
Understanding the cost comparison requires understanding the pricing models, because they differ fundamentally.
Auth0: Monthly Active Users (MAU)
Auth0 charges per Monthly Active User — any user who logs in at least once per month. This creates a cost structure that scales linearly with your active user base. Critical nuances:
- B2B and B2C MAU are counted separately; organizational units in B2B require the Teams or Enterprise plan
- Machine-to-machine (M2M) tokens are billed separately from MAU
- Custom domains require the Professional plan or higher
- Multi-tenancy (organizations) requires the Business plan or higher
Okta: Per User Per Month
Okta bills per user per month for each product module. A typical Indian enterprise buying SSO + MFA + Lifecycle Management is buying three separate line items. Each one has a floor price and volume discounts.
Azure AD (Entra ID): Per User Per Month by Tier
Azure AD Free is bundled with Microsoft 365 subscriptions. Azure AD P1 ($6/user/month) and P2 ($9/user/month) add Conditional Access, Identity Protection, and Privileged Identity Management. For Indian companies already paying for Microsoft 365, the incremental cost is P1 or P2 on top of the existing subscription.
Keycloak: Infrastructure Only
Keycloak software is Apache 2.0 licensed — zero licensing cost regardless of user count. You pay for:
- Cloud infrastructure (compute, database, load balancer, storage)
- Operations (your engineering team's time, or a managed service like KeycloakPro)
The infrastructure cost does not scale linearly with users. A cluster that handles 10,000 users can handle 100,000 users with a configuration change.
Pricing at 5 Indian Business Scales
All prices converted to INR at ₹84/USD (April 2026 rate). Auth0 and Okta prices are from their public pricing pages; Azure AD from the Microsoft pricing calculator; infrastructure costs from AWS Mumbai (ap-south-1) pricing.
Scale 1: Early-Stage Startup — 500 MAU, 50 Employees
| Provider | Plan | Monthly (₹) | Annual (₹) |
|---|---|---|---|
| Auth0 | B2C Essential | ₹2,940 | ₹35,280 |
| Okta | SSO + MFA | ₹33,600 | ₹4,03,200 |
| Azure AD | P1 (50 users) | ₹25,200 | ₹3,02,400 |
| Firebase Auth | Free tier | ₹0 | ₹0 |
| KeycloakPro | Managed Starter | ₹67,200 | ₹8,06,400 |
| DIY Keycloak | AWS infra only | ₹12,600 | ₹1,51,200 |
At this scale: Auth0 is the cheapest managed option. Firebase Auth is free until 10K/month SMS verifications. KeycloakPro's managed service has a floor price that makes it less economical than Auth0 for very small teams. DIY Keycloak on a single t3.medium instance is economical but requires operational expertise.
The DPDP factor: Auth0 and Firebase store data in the US. If you have enterprise customers asking about DPDP compliance, you'll need to address this even at startup scale.
Scale 2: Growing SME — 2,000 MAU, 200 Employees
| Provider | Plan | Monthly (₹) | Annual (₹) |
|---|---|---|---|
| Auth0 | B2C Professional | ₹20,160 | ₹2,41,920 |
| Okta | SSO + MFA (200 users) | ₹1,34,400 | ₹16,12,800 |
| Azure AD | P1 (200 users) | ₹1,00,800 | ₹12,09,600 |
| Firebase Auth | — | ₹0–₹8,400 | ₹0–₹1,00,800 |
| KeycloakPro | Managed Standard | ₹67,200 | ₹8,06,400 |
| DIY Keycloak | HA cluster (2 nodes) | ₹25,200 | ₹3,02,400 |
At this scale: The gap starts to widen. Okta and Azure AD P1 become expensive for a 200-person Indian SME — you're paying ₹12–16L per year for authentication. Auth0 is still reasonable at ₹2.4L, but the DPDP compliance gaps remain. KeycloakPro's managed service becomes cost-competitive when you factor in DPDP compliance value.
Key insight: At 200 employees, Okta's per-user pricing is already 2× what KeycloakPro costs — before any customer-facing MAU is counted.
Scale 3: Mid-Market — 10,000 MAU, 500 Employees
This is the inflection point where Keycloak economics become undeniable.
| Provider | Plan | Monthly (₹) | Annual (₹) |
|---|---|---|---|
| Auth0 | B2C Business | ₹3,52,800 | ₹42,33,600 |
| Okta | Full platform (500 users) | ₹8,40,000 | ₹1,00,80,000 |
| Azure AD | P2 (500 users) | ₹3,78,000 | ₹45,36,000 |
| KeycloakPro | Managed Growth | ₹1,17,600 | ₹14,11,200 |
| DIY Keycloak | HA cluster (3 nodes) | ₹42,000 | ₹5,04,000 |
Savings vs Auth0: KeycloakPro saves ₹28L per year at this scale.
Savings vs Okta: KeycloakPro saves ₹86.7L per year — almost ₹1 crore.
Savings vs Azure AD P2: KeycloakPro saves ₹31.2L per year.
At 10,000 MAU, you're also likely encountering enterprise procurement requirements from customers. DPDP compliance capability becomes a revenue enabler, not just a cost center.
Scale 4: Enterprise — 50,000 MAU, 2,000 Employees
| Provider | Plan | Monthly (₹) | Annual (₹) |
|---|---|---|---|
| Auth0 | Enterprise (custom) | ~₹10,50,000 | ~₹1,26,00,000 |
| Okta | Enterprise (2,000 users) | ~₹21,00,000 | ~₹2,52,00,000 |
| Azure AD | P2 (2,000 users) | ~₹15,12,000 | ~₹1,81,44,000 |
| KeycloakPro | Managed Enterprise | ₹2,94,000 | ₹35,28,000 |
| DIY Keycloak | Multi-region HA | ₹1,26,000 | ₹15,12,000 |
Savings vs Auth0: ₹90.7L per year.
Savings vs Okta: ₹2.17 crore per year.
At enterprise scale, the IAM bill with Okta or Auth0 can exceed the salary of your entire engineering team. These are not rounding errors — they are material budget decisions.
Scale 5: Large Enterprise / SaaS Platform — 5,00,000 MAU
At this scale, Auth0 and Okta pricing is entirely custom. KeycloakPro infrastructure scales horizontally; the cost increase is modest.
| Provider | Annual (₹) |
|---|---|
| Auth0 | ₹4–8 crore (custom) |
| Okta | ₹15–25 crore (custom) |
| KeycloakPro | ₹60–90L |
The infrastructure cost of running Keycloak for 500,000 MAU is approximately ₹2.5–4L per month on AWS Mumbai. KeycloakPro's managed operations adds a fixed fee regardless of MAU count. The economics versus MAU-based pricing become increasingly favorable at every order of magnitude of growth.
The Hidden Costs Nobody Puts on the Pricing Page
Auth0 Hidden Costs
MAU overages: Exceed your tier and Auth0 charges premium per-user rates for the overage — often 2–3× the base per-MAU rate. A viral campaign, a successful product launch, or a new enterprise customer onboarding can trigger an unexpected overage bill.
M2M tokens: Machine-to-machine tokens for API-to-API authentication are billed separately from MAU. Each call to Auth0's token endpoint for a M2M flow counts against a separate quota. Microservice architectures with high M2M token usage can generate significant additional charges.
Feature upgrades: Custom domains, advanced attack protection, log streaming, and organizations (multi-tenancy) are gated behind higher tiers. Moving from Professional to Business to Enterprise typically doubles or triples the base cost.
DPDP compliance work: Auth0 has no India data residency option on standard plans. Achieving DPDP compliance with Auth0 requires custom integration work — purpose-specific consent flows built outside Auth0, erasure workflows that call Auth0's Management API, and legal review of SCCs for cross-border transfers. Budget ₹5–15L in engineering time depending on complexity.
Okta Hidden Costs
Module proliferation: Okta's per-module pricing means capabilities you assume are included (MFA, lifecycle management, governance) are separate SKUs. A seemingly reasonable per-user price compounds quickly when you add the modules you actually need.
Minimum commitments: Okta enterprise contracts typically have 3-year minimums with annual price escalators. Customers who outgrow Okta or change their architecture mid-contract have limited options.
Professional services: Complex Okta deployments typically require Okta Professional Services or a certified Okta partner. Budget ₹15–30L for an enterprise implementation.
Azure AD Hidden Costs
P1 vs P2 confusion: Many companies start with P1 (Conditional Access) and discover they need P2 (Identity Protection, Privileged Identity Management) for their actual security requirements. The per-user cost difference is ₹252/user/month — ₹30L/year for a 1,000-person company.
Guest user licensing: B2B collaboration (inviting partner users) requires guest user licensing. At scale this adds meaningfully to the total.
Entra ID Governance: The recently launched Entra ID Governance module for advanced lifecycle management and access reviews is an additional SKU on top of P2.
Keycloak / KeycloakPro Hidden Costs
Initial deployment: A production-grade HA Keycloak cluster requires expertise. DIY Keycloak deployments without proper HA configuration and security hardening create operational risk. Budget 3–4 weeks of senior engineering time for initial setup if doing it yourself.
Upgrade cycles: Keycloak major versions (every 6 months) require migration testing. KeycloakPro handles this as part of the managed service.
Operational on-call: A self-hosted identity provider is critical infrastructure. You need 24/7 on-call coverage. For Indian SMEs without dedicated SRE teams, this is the primary operational cost of DIY Keycloak — and the primary reason managed Keycloak makes sense.
Total Cost of Ownership: 3-Year View
For a 500-employee Indian company with 5,000 customer MAU, here is the 3-year TCO:
| Provider | Year 1 (₹) | Year 2 (₹) | Year 3 (₹) | 3-Year Total (₹) |
|---|---|---|---|---|
| Auth0 Business | 52,08,000 | 57,28,800 | 63,01,680 | 1,72,38,480 |
| Okta Full Platform | 1,00,80,000 | 1,10,88,000 | 1,21,96,800 | 3,33,64,800 |
| Azure AD P2 | 54,43,200 | 57,15,360 | 60,01,128 | 1,71,59,688 |
| KeycloakPro Managed | 21,00,000 | 21,00,000 | 23,10,000 | 65,10,000 |
Assumptions: Auth0/Okta/Azure with 5% annual price increase (conservative — actual increases have been higher). KeycloakPro with flat pricing for years 1–2, modest increase in year 3 reflecting growth.
3-year savings vs Auth0: ₹1,07,28,480 (₹1 crore)₹2.7 crore)
3-year savings vs Okta: ₹2,68,54,800 (
The ₹1 crore you save over three years by running KeycloakPro instead of Auth0 at this scale is a senior engineer for three years, or a growth marketing budget, or the security infrastructure your compliance team has been asking for.
The INR Pricing Reality: Why Global Tools Cost More in India
One detail that pricing calculators don't surface: foreign SaaS pricing in USD creates invisible hedging risk for Indian companies.
Auth0 bills in USD. Okta bills in USD. When the rupee weakened from ₹74 to ₹84 per dollar between 2022 and 2026, every Auth0 or Okta invoice got 14% more expensive in rupee terms — without the vendor changing a single price on their website.
For a company paying Auth0 $50,000/year:
- 2022: ₹37,00,000
- 2026: ₹42,00,000
- Increase: ₹5,00,000 — from currency alone, not from growth
KeycloakPro's managed services are invoiced in INR with rupee-denominated contracts. The infrastructure runs on AWS Mumbai, billed in USD but passed through at actual cost without margin. No currency risk on the service fee.
When Each Option Makes Sense
Choose Auth0 When
- You have fewer than 2,000 MAU and need to ship in 48 hours
- DPDP compliance is not yet a customer requirement
- Your team has zero IAM expertise and no capacity to learn
- You will re-evaluate in 12 months once you have more data
Choose Okta When
- You're running a 2,000+ employee enterprise with complex HR system integrations (Workday, SAP SuccessFactors)
- Your IT team is already Okta-certified
- You need deep Salesforce, ServiceNow, or Microsoft ecosystem integration
- Budget is not a constraint and vendor SLAs are paramount
Choose Azure AD P1 When
- Your company is deeply invested in the Microsoft 365 stack
- Your users are primarily internal employees (workforce identity, not customer identity)
- You have an existing EA with Microsoft that includes licensing
Choose KeycloakPro When
- You have 2,000+ MAU and costs are materializing
- DPDP compliance is a current or near-future requirement
- You want India-hosted authentication data
- You're building a multi-tenant SaaS product
- You want zero vendor lock-in and open-source flexibility
- You're migrating from Auth0 or Okta and want to reduce the annual bill by 70–80%
Start With the Numbers From Your Own Account
The fastest way to quantify your specific savings is to pull your current IAM invoice, count your actual MAU (your IdP dashboard has this), and map it against the scales above.
If you're already seeing IAM costs above ₹5L/year, the economics of Keycloak are in your favour at almost every scale. If you're under ₹5L but growing, the time to switch is before the next renewal, not after.
KeycloakPro's free Cost Audit covers:
- Exact current cost breakdown of your IAM stack in INR
- Projected cost at your expected MAU in 12 and 24 months
- Keycloak equivalent cost at those same scales
- 3-year TCO comparison including migration costs
- DPDP compliance cost included (it's built in, not an add-on)
We'll do the math and show you the number. If the savings don't justify the switch, we'll tell you that too.
Need Help With Keycloak?
Our team specializes in production-grade Keycloak deployments. Get a free 30-minute strategy consultation.
Book a Free Strategy Call