CIAM Pricing Explained: MAU vs MTU vs Flat Rate
CIAM pricing models decoded: monthly active users, monthly tracked users, per-tier, and flat-rate. How each is defined, where costs surprise you at scale, and how to model total cost before you commit.
- The dominant CIAM pricing metric is the monthly active user (MAU), a user who authenticates at least once in a billing month; you pay for activity, not for total registered accounts.
- Watch the definitions and the add-ons: what counts as active, whether machine-to-machine tokens count, and whether enterprise features (SSO connections, SAML, MFA, advanced security) are priced separately can change the real bill more than the headline per-user rate.
- Model total cost against your growth curve before committing, because MAU pricing that looks cheap at 10,000 users can dominate your infrastructure budget at 1,000,000.
CIAM pricing is where a platform choice that looked cheap in a proof of concept becomes an expensive surprise in year two. The models are not complicated, but the definitions hidden inside them are where the money is. This guide decodes the common ones so you can model real cost before you commit.
The dominant metric: monthly active users
Most CIAM platforms price on monthly active users (MAU): a user who authenticates at least once in a billing month. The appeal is that you pay for activity, not for a database of dormant accounts. Register ten million users but have one hundred thousand log in this month, and you pay for one hundred thousand. For consumer products with a long tail of inactive accounts, MAU pricing is usually kinder than per-registration pricing.
The catch is the definition of "active." Does a background token refresh count? Does a machine-to-machine token count as a user? Does an anonymous session that never logs in count? Two vendors can both say "MAU" and meter very different things.
Monthly tracked users and other variants
Some platforms price on monthly tracked users (MTU) or a similar "identified user" metric, which can count interactions beyond an explicit login. An MTU count can run higher than an MAU count for the same product, so the label alone tells you little. Others use flat tiers (a fixed price for a band of users), per-connection pricing for enterprise SSO, or a base platform fee plus usage. The only way to compare is to read what each metric actually counts.
Where the bill surprises you
- Tier boundaries. Crossing a threshold can move every user into a higher bracket, so cost jumps in steps rather than smoothly.
- Enterprise add-ons. SAML and OIDC enterprise connections, SCIM provisioning, advanced MFA, bot and fraud detection, and dedicated tenancy are frequently priced on top of the base per-user rate. For B2B products, per-SSO-connection fees can dominate the bill.
- Machine identity. If machine-to-machine tokens count toward your user metric, an API-heavy architecture inflates the number.
- Support and SLA. Production support tiers and uptime guarantees are often separate line items.
Model total cost, not the headline rate
The right way to compare is to model your own growth. Estimate active users at 12, 24, and 36 months, list the enterprise features you will actually need, ask each vendor exactly how each is metered, and compute total annual cost at each stage. A platform that is free at ten thousand users and a strong choice for a startup may be the most expensive option at a million, where a high-scale or self-hostable platform wins. Our build vs buy identity guide and the TCO calculator help put real numbers on it.
Pricing as a selection signal
Pricing structure also reveals who a platform is built for. Per-MAU consumer pricing signals a B2C focus; per-connection and per-organization pricing signals B2B. Transparent public pricing signals a developer-first product; "contact sales" for everything signals an enterprise motion. Match the model to your shape, compare the field in the best CIAM platforms ranking and Deepak Gupta's CIAM Compass, and always run the numbers against your own growth curve rather than the vendor's example.
Frequently asked questions
- What is MAU pricing in CIAM?
- MAU stands for monthly active users. Under MAU pricing you pay for each unique user who authenticates at least once during a billing month, regardless of how many total accounts are registered. A dormant account costs nothing until it logs in. It is the most common CIAM pricing model because it ties cost to usage rather than to a database of inactive registrations.
- What is the difference between MAU and MTU pricing?
- MAU (monthly active users) counts users who authenticate in a month. MTU (monthly tracked users) counts users the platform has any interaction with, which can include tracked or identified sessions beyond explicit logins, so an MTU count can be higher than an MAU count for the same product. Always read the vendor's exact definition, because the label matters less than what triggers a billable count.
- Why does CIAM get expensive at scale?
- Because per-user pricing multiplies. A rate that is trivial at ten thousand active users becomes a major line item at one million, and enterprise add-ons such as SAML connections, advanced MFA, bot detection, and dedicated tenancy are often priced on top of the base per-user fee. Costs also jump at tier boundaries, where crossing a threshold moves you to a higher bracket for every user.
- How do you compare CIAM pricing across vendors?
- Model your own numbers rather than comparing headline rates. Estimate active users at 12, 24, and 36 months, list the enterprise features you will actually need (SSO connections, SAML, MFA, audit export), and ask each vendor how each of those is metered. Then compute total annual cost at each growth stage. The cheapest vendor at launch is often not the cheapest at scale.