The SSO Tax Explained: What It Costs, Why It Matters and How to Negotiate It

The SSO tax is the practice of selling single sign-on only on a more expensive plan, an enterprise tier or a paid add-on. In Start with Identity's Phishing-Resistant MFA Support Matrix, which checked 95 widely used business SaaS apps against vendor documentation on October 31, 2026, 49 of the 82 apps that offer SSO and document which plan includes it (59.8%) charge more for it: 23 on a higher paid tier, 20 on an enterprise plan only and 6 as a paid add-on (finding 4). The other 33 include SSO on every paid plan. The tax matters because, for most SaaS apps, SSO to an identity provider is the only way to make phishing-resistant MFA mandatory.

This article explains the term, what the matrix measured, why the tax belongs in the security budget rather than the IT convenience line, how to negotiate it, and which apps do not charge it.

What counts as the SSO tax

Single sign-on lets employees sign in to a SaaS app through the company's identity provider, usually over SAML 2.0 or OpenID Connect. The phrase "SSO tax" was popularized by the SSO Wall of Shame, a community list of vendors that treat SSO as a luxury feature. SWI's matrix records it more narrowly, as a class on each app's row:

The denominator is 82, not 95. Nine apps sell by quote and tie SSO to no documented plan (BambooHR, Deel, Jamf Pro, Kandji, NetSuite, Outreach, Rippling, Strata Cloud Manager and Workday), and four have no SSO at all (JetBrains Account, npm, PyPI and Xero). Counting either group as taxed or untaxed would add assumptions the documentation does not support.

Two category results stand out. Collaboration apps (8 of 8) and design and marketing apps (5 of 5) taxed SSO in every app checked. Infrastructure and data platforms mostly do not: Snowflake, Databricks, Confluent, MongoDB Atlas, AWS, Google Cloud, Azure, Cloudflare, Datadog and GitLab all include SSO on every paid plan.

Some examples from the rows, as documented by each vendor:

• Slack puts SAML SSO on Business+.
• Notion puts SAML SSO on Business and SCIM on Enterprise only.
• Figma documents SAML SSO and SCIM for Organization and Enterprise.
• GitHub puts SAML and SCIM on GitHub Enterprise, which the row records at $21 per user per month.
• Atlassian Cloud needs the Atlassian Guard Standard subscription for SAML SSO and SCIM, which the Cloud Enterprise plan includes.
• Bitwarden (row) offers Login with SSO for Enterprise organizations, while SCIM is available to Teams and Enterprise.

Why the SSO tax is a security cost

The usual argument against the SSO tax is about administration: central onboarding, central offboarding, one password. That argument is true, and it undersells the problem. The stronger argument is about phishing-resistant MFA.

Phishing-resistant MFA means passkeys and FIDO2 security keys built on WebAuthn, or PKI-based authentication. The matrix found that 51 of 95 apps (53.7%) support passkeys or security keys on their own login, but only 12 (12.6%) let an admin require them (finding 1). Optional phishing resistance does not protect the account an attacker targets, because the phishing page simply asks for the weaker factor the account still allows.

So the realistic way to make passkeys mandatory for most SaaS apps is to route sign-in through an identity provider that requires them. That is where the tax bites. Of the 71 apps with a documented SSO plan that do not let an admin require phishing-resistant MFA locally, 48 (67.6%) put SSO behind a higher tier, an enterprise plan or an add-on, and 20 of the 71 (28.2%) on an enterprise plan (finding 5). A Slack workspace below Business+, a Notion workspace below Business, a Figma team below Organization or a GitHub organization below Enterprise cannot require phishing-resistant sign-in for that app at all without upgrading.

Across all 95 apps, 77 (81.1%) offer SSO but have no local setting that requires phishing-resistant MFA. For those apps the identity provider is the only enforcement point, and in two of every three the right to use it costs a plan upgrade.

The breach data shows what is at stake. In SWI's Identity Breach Report 2026, MFA was bypassed in 25 of the 40 breaches where MFA status was known, and 13 of those 25 bypasses came from a person handing over or approving access. Phishing-resistant MFA on every human login is the top control in that report, addressing 40 of 115 incidents (34.8%). Pricing that control into a higher tier is a decision about who gets protected.

The second tax: SCIM

SSO stops a leaver from signing in through the identity provider. Only SCIM provisioning removes the app account, its sessions and its API tokens automatically. The matrix found that 17 apps offer SCIM only on an enterprise plan, and 7 of those 17 sell SSO on a lower plan than SCIM: Notion, Miro, Docker Hub, Postman, Vercel, Calendly and the Cloudflare dashboard (finding 7). Buy SSO without SCIM and deprovisioning stays a manual step, which is where offboarding fails (see where SCIM provisioning breaks).

"No SSO tax" does not always mean no extra cost

Read the "none" class carefully. Microsoft 365 includes SSO federation on all plans, but requiring passkeys needs the built-in Phishing-resistant MFA authentication strength in Conditional Access, which needs Microsoft Entra ID P1 (in Business Premium and E3/E5, not Business Basic or Standard). ServiceNow and Gong are classed "none" because they sell by quote and document no SSO gating, not because either vendor said SSO is free. The tax can also move into the identity provider's own pricing, so put both sides on the same sheet. The TCO calculator is a reasonable place to do that.

How to negotiate the SSO tax

None of the following is a guaranteed discount. It is what tends to work when a security team, rather than an individual department, owns the purchase.

1. Make SSO and SCIM a policy requirement, not a feature request. A written rule that every SaaS app holding company data must support SAML or OIDC SSO with SCIM, enforced through the identity provider, changes the conversation from "we would like" to "we cannot buy without". Procurement can then treat the SSO plan as the minimum viable plan.
2. Raise it before signature. Once a team has onboarded, the vendor knows the cost of switching. Ask for SSO in the first quote.
3. Ask for SSO on the plan whose other features you need. If you only need SSO from the enterprise tier, say so and ask for the lower plan plus SSO, or a per-seat price for the SSO add-on that does not force every seat onto the top tier.
4. Ask for SCIM in the same plan. The seven apps that sell SSO below SCIM are the ones where this matters most. A contract with SSO and no SCIM buys half the control.
5. Bring comparable data. 33 of 82 apps in the matrix include SSO on every paid plan. If a competitor in the same category is one of them, name it. Each row links to the vendor's own pricing source, so the comparison is checkable.
6. Put it in the order form. Write the SSO and SCIM inclusion, the plan, the per-seat price and a renewal price cap into the contract. Plan names and inclusions change, often quarterly.
7. Check for bypasses after you pay. Paying for SSO is not the same as enforcing it. Some apps keep a local login next to SSO for owners or admins, which is covered in the phishing-resistant MFA enforcement playbook.

If a vendor will not move, record the decision. A documented exception with an owner and a review date is better than an app that quietly stays on local passwords.

Apps that include SSO on every paid plan

These are the 33 apps in the matrix whose SSO tax class is "none", as of October 31, 2026. Each links to its row, where the vendor sources sit. An asterisk marks the apps where an admin can also require phishing-resistant MFA on the app's own login.

Three caveats from the rows. Including SSO is not the same as including SCIM: Zendesk and Pipedrive document no SCIM, and the Cloudflare dashboard has free SSO with SCIM on Enterprise. Some apps in this group name a starting plan that is their lowest paid tier, such as GitLab.com Premium and Snowflake Standard. And the Salesforce row notes that the Sales Cloud pricing page does not list SSO, while Salesforce's help docs list SAML federated authentication and SCIM as available in all editions.

The identity and security consoles in this list belong to vendors with SWI profiles: Okta, Duo, Cloudflare and Tailscale. The SSO and SCIM platforms for B2B SaaS ranking covers the other side of the market: what it costs a SaaS vendor to add enterprise SSO, which is relevant when a vendor argues that SSO is expensive to provide.

Bottom line

The SSO tax is common (59.8% of apps with a documented SSO plan), concentrated in collaboration and design tools, and in two of three apps that cannot enforce passkeys locally it is the price of phishing-resistant MFA. Budget for it as a security control, negotiate it before signature with SCIM in the same plan, and use the matrix to check each vendor's own documentation before you sign. The full method and all eight findings are in the Phishing-Resistant MFA Support Matrix 2026 report.