You’re not as locked in to your auth provider as you think
Per-connection SSO and SCIM fees arrive with your biggest customers. Federation hands those connections to another provider, no migration needed.
Picture this: your service has been growing for six months, and you have been in talks with your first big customers. Today the first one finally signed, and you promised to set up SSO and user sync from their Entra ID to your app. You open your auth provider’s settings and see that every SSO connection and every SCIM connection costs $125 a month.1 You do a quick calculation in your head and realise you charged this customer too little, because your auth bill now eats the margin it didn’t touch before.
This is how connection-based pricing works. When you are starting out, the first tier is free or at least cheap, and the cost comes later. It comes with your best and most demanding customers, at exactly the time it is most inconvenient to change your auth.
Charging per connection adds up quickly. In this case every new enterprise customer costs you $250 more a month, so ten of them add $30,000 a year, just to let their users sign in securely.
At this point, with growth at full speed, migrating to something else doesn’t feel like an option. Auth is your users’ way into your service, so it has to keep working, and migrating it now is painful and risky.
You might think it was a mistake to pick that provider in the first place, but it isn’t your fault. The pricing made sense when you started. You couldn’t have known how fast you would grow, or how expensive auth gets when you do.
There is a way out
You are not as stuck as you might think.
Most auth providers support OpenID Connect federation. The words are jargon, but all it means is that your auth provider can trust another auth provider.
So you can keep your current login exactly as it is, and hand the expensive connections to another provider that doesn’t charge for each one.
Your current provider sees one federated connection instead of the ten customer connections you really have. You stay on your current plan, and the expensive part moves somewhere else.
But what about…?
Doesn’t that one connection cost money too? Yes. But it is one connection plus the new provider’s fee, instead of the $2,500 a month that SSO and SCIM for ten enterprise customers would cost in the example above.
How does user sync work? Your customer’s identity provider syncs their users into the new provider. When one of them signs in, your current provider trusts what the new provider tells it. When your customer’s IT removes a user, the new provider stops vouching for them, so they can’t sign in anymore.
Do I lose my organization features? You can’t use your current provider’s organization features for these customers, but you can use the new provider’s, as long as it has them.
So now I run two auth systems forever? No. Your current provider keeps serving your self-service users, and the new one handles your enterprise customers. When the time is right, you can migrate fully, if you want to.
What to do now
If you are already stuck, federation gets you out of the costly situation today. And next time you choose an auth provider, ask one question: what does it cost when I want to offer SSO and SCIM to my customers? Choose a provider whose price doesn’t grow with every enterprise customer you sign.
That is what we believe in when we build Authalla. We don’t want to punish you for growing: there are no per-connection fees, and SSO and SCIM are included on every plan. If you want to see whether we could help with your auth, drop us a line through the contact form.