SSO Tax

The "SSO tax" is the industry nickname for the widespread practice of gating single sign-on — SAML or OIDC login, and often SCIM provisioning alongside it — behind a vendor's most expensive plan, so a company that wants to manage application access through its identity provider must jump from a self-serve team plan to an enterprise contract, frequently at several times the per-seat price. The name was popularised by a community-maintained list that catalogues vendors whose SSO upgrade multiplies the bill. Buyers care because SSO is not a convenience feature, it is a security control: without it every employee holds a separate password to the tool, offboarding depends on somebody remembering to delete an account by hand, and the security team has no central place to enforce MFA or conditional access. Vendors defend the packaging on the grounds that SSO buyers are enterprises carrying heavier support, legal and compliance costs, and that identity integrations are genuinely expensive to build and maintain. Critics answer that charging a premium for the control which prevents breaches leaves the smallest and least-defended teams on the least secure configuration. Practically, the SSO tax is a line item to price into an evaluation before you commit rather than after. A tool that looks affordable at forty seats on a team plan can land on an enterprise tier with a seat floor, an annual commitment and a different discount structure the moment SSO becomes mandatory — and mandatory is usually decided by your security review, not by you. Ask three questions while you are still shopping: is SSO available on the tier you actually intend to buy, does it include SCIM provisioning and automatic deprovisioning or only login, and what is the seat minimum attached to the tier that carries it. Some vendors have moved SSO into mid-tier plans or made it free in response to public pressure, so verify against the current pricing page rather than assuming last year's answer still holds.