# CIAM Pricing Explained: MAU vs MTU vs Flat Rate

Source: https://startwithidentity.com/articles/ciam-pricing-models-explained/
Last updated: 2026-07-16
License: content by Start with Identity. Cite the source URL.

---

CIAM pricing is where a platform choice that looked cheap in a proof of concept becomes an expensive surprise in year two. The models are not complicated, but the definitions hidden inside them are where the money is. This guide decodes the common ones so you can model real cost before you commit.

## The dominant metric: monthly active users

Most [CIAM](https://startwithidentity.com/guides/fundamentals/what-is-ciam/) platforms price on monthly active users (MAU): a user who authenticates at least once in a billing month. The appeal is that you pay for activity, not for a database of dormant accounts. Register ten million users but have one hundred thousand log in this month, and you pay for one hundred thousand. For consumer products with a long tail of inactive accounts, MAU pricing is usually kinder than per-registration pricing.

The catch is the definition of "active." Does a background token refresh count? Does a machine-to-machine token count as a user? Does an anonymous session that never logs in count? Two vendors can both say "MAU" and meter very different things.

## Monthly tracked users and other variants

Some platforms price on monthly tracked users (MTU) or a similar "identified user" metric, which can count interactions beyond an explicit login. An MTU count can run higher than an MAU count for the same product, so the label alone tells you little. Others use flat tiers (a fixed price for a band of users), per-connection pricing for enterprise SSO, or a base platform fee plus usage. The only way to compare is to read what each metric actually counts.

## Where the bill surprises you

- **Tier boundaries.** Crossing a threshold can move every user into a higher bracket, so cost jumps in steps rather than smoothly.
- **Enterprise add-ons.** SAML and [OIDC](https://startwithidentity.com/standards/openid-connect/) enterprise connections, [SCIM](https://startwithidentity.com/standards/scim-2-0/) provisioning, advanced MFA, bot and fraud detection, and dedicated tenancy are frequently priced on top of the base per-user rate. For B2B products, per-SSO-connection fees can dominate the bill.
- **Machine identity.** If machine-to-machine tokens count toward your user metric, an API-heavy architecture inflates the number.
- **Support and SLA.** Production support tiers and uptime guarantees are often separate line items.

## Model total cost, not the headline rate

The right way to compare is to model your own growth. Estimate active users at 12, 24, and 36 months, list the enterprise features you will actually need, ask each vendor exactly how each is metered, and compute total annual cost at each stage. A platform that is free at ten thousand users and a strong choice for a [startup](https://startwithidentity.com/rankings/best-ciam-for-startups/) may be the most expensive option at a million, where a [high-scale](https://startwithidentity.com/rankings/best-ciam-for-high-scale/) or self-hostable platform wins. Our [build vs buy identity](https://startwithidentity.com/guides/buyer-guides/build-vs-buy-identity/) guide and the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/) help put real numbers on it.

## Pricing as a selection signal

Pricing structure also reveals who a platform is built for. Per-MAU consumer pricing signals a B2C focus; per-connection and per-organization pricing signals B2B. Transparent public pricing signals a developer-first product; "contact sales" for everything signals an enterprise motion. Match the model to your shape, compare the field in the [best CIAM platforms](https://startwithidentity.com/rankings/best-ciam-platforms/) ranking and [Deepak Gupta's CIAM Compass](https://guptadeepak.com/ciam-compass/), and always run the numbers against your own growth curve rather than the vendor's example.