Rules
Part of Account administration decisions that are cheap now and costly later
Account administration pricing without the guesswork
Account administration pricing counts identities, not employees. The controls worth having sit at a tier boundary, and log retention is the quiet meter.
Identity products are priced on a variable nobody budgets for: not how many people you employ, but how many identities exist. Those are different numbers, and the gap between them is where the surprise lives.
Then there is the second pattern, which is more consequential. In this category, the controls that make the product worth having are frequently the ones that mark a tier boundary, so a single requirement can lift the whole organization a level.
What to take away
- Count identities, not employees. Contractors, shared roles, service accounts, and people who left last year all sit in the directory.
- The features that make identity useful, meaning single sign on, conditional rules, and a long access record, are commonly the tier boundary rather than an add on.
- Connectors to individual applications are a separate meter in some products and included in others. Compare the list, not the count.
- Log retention is a quiet cost with a compliance consequence, and the default is usually shorter than you assume.
What actually gets counted
| Meter | What it counts | The question that changes the number |
|---|---|---|
| Identities | Every account object in the directory | Do disabled accounts still bill, and for how long |
| External or guest identities | People from other organizations given access | Free, capped, or charged, and does that change by tier |
| Service accounts | Non human identities used by systems | Do they consume a license or sit outside the count |
| Application connectors | Systems wired into the directory | Are they unlimited, listed, or individually priced |
| Devices | Managed endpoints, where the product covers them too | Per device or per person, and what counts as a device |
| Access record retention | How far back the log goes | Is a longer period a tier feature or a paid extension |
| Directory synchronization | Keeping another system in step | Included, or a separate product line |
Rebuild that table with your own numbers before reading any quote. The line that most often moves a five year total is the second one, for anyone whose work involves outside collaborators.
The tier boundary is the whole game
In most categories the entry tier is a smaller version of the product. Here it is usually a different product.
The tier boundary decision
Do you need SSO, location rules, long logs, delegated admin?
these cluster above the entry tier
entry tier may cover accounts
Four controls justify buying an identity layer: single sign on across third party apps, rules that vary access by location or device, an access record kept longer than a short window, and delegated administration.
These cluster above the entry tier almost everywhere. Budgeting error: price the tier that covers accounts, then one obligation forces everyone up a level. The upgrade is rarely available for a subset.
Two things are worth checking before accepting it. Whether a mixed estate is permitted, so a smaller group holds the higher tier. And whether the requirement can be met somewhere you already pay for, since some suites include a usable amount of this and the honest comparison is against that rather than against nothing.
Secure defaults are a cost question
It is tempting to treat baseline security configuration as free, because settings do not have prices. They have prerequisites instead, and the prerequisites have prices.
Before negotiating, take published secure configuration baselines for cloud office products, such as the secure cloud business applications project. Mark which settings your quoted tier can enforce.
The gap between baseline and tier is your real upgrade requirement. State it in something more durable than a preference.
Log retention is a meter people miss
The access record is what answers questions after something has gone wrong. Its default retention is frequently measured in weeks, and extending it is frequently priced.
Retention must reach back
- Defaultweeks, frequently priced to extend
- Investigation startstwo months after event
- Record neededreaching back further than two months
- Decisiondeliberate and funded, not tidy
Decide the period from what you might be asked, not what feels tidy. An investigation that begins two months after an event needs a record reaching back further than two months.
Organizations routinely discover this at exactly the wrong moment. The reasoning for treating this as a deliberate, funded decision is set out in the guidance on logging and monitoring. That guidance is also a good short list of what a log should contain to be worth keeping.
If longer retention is expensive inside the product, ask whether the log can be exported continuously to somewhere you already pay for. Sometimes it can, and the answer changes the arithmetic.
Build the model
- Identities today, split into staff, contractors, guests, shared roles, and service accounts.
- Identities in year three, using your real turnover rather than headcount growth.
- Disabled accounts you are obliged to retain, and whether they bill.
- The list of applications you intend to connect, marked as included or separately priced.
- The tier that holds every control you called a requirement.
- Access record retention, at the period you actually need.
- The internal costsomebody owns this, reviews access, and handles recovery requests.
Line seven is the one that is always left blank and is often the largest. An identity layer moves work rather than removing it: less account creation in ten systems, more policy maintenance in one.
Build the model
- Identities today, split by type
- Identities in year three, real turnover
- Disabled accounts retained, and whether they bill
- Applications to connect, included or priced
- Tier holding every required control
- Access record retention at the period needed
- Internal costowner, access reviews, recovery
Where the savings actually are
Three of them are real and none of them is a discount.
Closing accounts you are paying for elsewhere, which is the first thing a directory reveals and frequently pays for a chunk of the purchase. Removing a shared login, which is a cost and a risk at once. And reducing the support time spent on password resets, which is unglamorous and measurable.
Reconcile against your other bills while you are at it. The seat counts in collaboration pricing, mail pricing, and storage pricing should all match the identity count, and when they do not, the difference is either a saving or an account nobody knows about.
Where this fits
The category overview covers what these products do and why the estate ends up shaped this way. If you are still choosing, the evaluation drill puts these meters in the order they should be answered.
Common questions
Do disabled accounts still cost money?
Sometimes, and it varies more than any other line here. Ask specifically, in writing, and ask how long a disabled account is retained before it is removed. Organizations with high turnover can carry a substantial number of these without noticing.
Is per device pricing better than per person?
It depends entirely on your ratio. Count devices per person honestly, including the phone, and remember that shared devices in a warehouse or a clinic change the answer completely. Neither model is generous; they are just aimed at different customers.
Should we buy the top tier to avoid future upgrades?
Only if you can name the specific control you are buying and who will operate it. Buying capability nobody configures is the most common waste in this category, and an unconfigured control provides exactly as much protection as an absent one.
Can we negotiate the connector list?
Sometimes, and it is the line most worth trying. Ask for the specific applications you need rather than a general concession, and get the answer in the contract rather than in an email from a salesperson who may not be there at renewal.
