Cost to Build Identity Management Software

Custom identity management software costs $30,000–$60,000 for a working V1 with an experienced team at $35–$40/hr. A full platform with SCIM provisioning, SAML federation, and compliance-ready audit trails runs $60,000–$120,000. Enterprise-grade IAM -- covering identity governance, adaptive authentication, and FedRAMP or HIPAA controls -- runs $120,000–$160,000 and up. The IAM market reached $22.27 billion in 2025 and is growing at 15.1% annually (Fortune Business Insights), which tells you something about what happens when off-the-shelf auth products hit their limits at scale.

Most builders reading this are not trying to build the next Okta. They are B2B SaaS founders who have run into Auth0's role cap at 200 customers, or enterprise security teams running three separate identity systems -- Keycloak for one product, Okta for workforce, legacy LDAP for on-premise apps. None of those systems talk to each other. None can produce a clean audit trail for SOC 2 Type II. The platform didn't fail them. It just wasn't designed for their specific model.

What is identity management software?

Identity management software controls who gets access to what, and keeps a record of every decision. At the core, it does three things: authenticate the user, authorize the request, and log the outcome in a form an auditor can read later.

The business problem it solves is not technical. It is operational and legal. Without a proper IAM layer, enterprise customers cannot pass their vendor security reviews. SaaS products cannot offer each customer their own isolated user directory. And regulated companies -- fintech, healthtech, govtech -- cannot satisfy auditors who require immutable access logs and quarterly certification campaigns.

According to the 2024 IBM Cost of a Data Breach report (Expert Insights), the average data breach cost $4.88 million in 2024, a 10% year-over-year increase. Credential-based attacks took an average of 292 days to identify and contain. Identity is not an IT checkbox. It is a revenue protection decision.

Who builds custom identity management software?

The decision to build almost always comes from one of three situations.

The first is a B2B SaaS CTO who has crossed 200 customers and is bumping against Auth0's architecture. The role cap -- 1,000 roles per tenant -- is getting close. Enterprise prospects are asking for SAML SSO, and Auth0 charges $5,000–$34,000 per year per connection. The engineering team is spending 20–30% of each sprint on Auth0 Actions workarounds to simulate org-scoped permissions the platform doesn't support natively. Auth0 isn't broken. It just wasn't designed for a multi-tenant SaaS with hundreds of customers, each expecting their own isolated role hierarchy.

The second is a CISO at a mid-market enterprise inheriting three separate identity systems with no centralized policy enforcement. Access reviews are quarterly, manual, and take 60–150 hours of labor each cycle. The company cannot produce a clean audit trail for SOC 2 Type II. An enterprise contract is on the table, and the prospect's security review requires FedRAMP-ready controls within 12 months.

The third is a regulated-industry founder whose identity model has no off-the-shelf equivalent. A health platform where patients manage delegated consent for multiple providers. A fintech service where KYC/KYB workflows require multi-party authorization. A govtech product where data residency rules mean identity data cannot sit on US-hosted cloud infrastructure. None of Auth0, Cognito, or Keycloak maps to these models without so much customization that you've effectively built the system anyway, on a foundation designed for something else.

Company profiles where this decision makes sense: Series A–D funded SaaS companies ($5M–$100M ARR); mid-market enterprises in financial services, healthcare, and government; and platform companies building auth as a core custom software capability rather than plumbing.

Core features, by build phase

V1: The security baseline (12–18 weeks, $30,000–$60,000)

A V1 IAM covers the flows an enterprise prospect expects to see before they sign a contract. The team is 4–5 people at $35–$40/hr.

1. Username/password authentication with bcrypt or Argon2 hashing -- storing plaintext or MD5 passwords is not an option for any enterprise buyer.
2. JWT-based session management with refresh token rotation -- a V1 without proper token expiry and rotation fails basic security review.
3. Tenant-scoped role-based access control (RBAC) -- each customer gets their own isolated role hierarchy with predefined roles and permission assignments.
4. Single Sign-On via OAuth 2.0 and OpenID Connect -- the standard enterprise expectation. Without it, you cannot close deals with companies that run Okta or Azure AD.
5. MFA via email, SMS, or TOTP authenticator app -- the 2024 Sophos report found that 43% of investigated breaches had MFA not configured on compromised accounts (Expert Insights).
6. User self-service -- registration, password reset, profile management. This removes a support burden from day one.
7. Basic audit logging -- login events, access grants, failures, with enough structure for an engineer to query. Not yet compliance-ready, but a start.

The backend runs in Go or Node.js for token issuance performance. PostgreSQL holds the user store. Redis handles session caching and token blacklists. This is enough to replace Auth0 Essentials for most multi-tenant SaaS products.

V2: Full platform (4–6 additional months, $30,000–$60,000)

V2 is what an enterprise security team requires before they will sign off on a vendor. The additional features:

1. SCIM 2.0 automated provisioning and deprovisioning -- when an enterprise customer adds a new employee, they expect your system to pick that up automatically from their HR system. Manual provisioning is a deal-breaker at enterprise scale.
2. SAML 2.0 federation -- connects your platform to enterprise IdPs: Okta, Azure AD, Google Workspace. Without SAML, enterprise SSO means a custom integration for every customer, billed by the hour.
3. Fine-grained attribute-based access control (ABAC) and org-scoped permissions -- RBAC handles "this user is an admin." ABAC handles "this user is an admin in Europe, for the finance team, during business hours." The difference matters for multi-region or multi-department enterprises.
4. Directory sync via LDAP and Active Directory -- required for enterprises running on-premise identity infrastructure.
5. Passkeys and WebAuthn passwordless login -- reducing password-related attack surface while improving the login experience. Enterprise security teams increasingly require this.
6. Admin console for user management, role assignment, and tenant dashboards.
7. Compliance-ready audit trails with exportable reports -- SOC 2 Type II requires audit logs that an assessor can read and query. V1 logging is insufficient.

Open Policy Agent (OPA) externalizes authorization decisions in V2, making policy changes deployable without a release cycle.

V3: Enterprise grade (6–12 additional months, $60,000–$80,000+)

V3 covers the requirements of a large enterprise, a government contract, or a platform where IAM is a core product capability rather than supporting infrastructure.

1. Identity governance and administration (IGA) -- automated access certification campaigns, quarterly review workflows, and evidence collection. Manual quarterly reviews that take 150 hours shrink to a managed process.
2. Just-in-time (JIT) access provisioning -- time-limited privilege elevation for sensitive operations, with automatic revocation.
3. AI-driven anomaly detection and adaptive authentication -- machine learning models flag unusual login patterns (unexpected geolocation, unfamiliar device, off-hours access) and trigger step-up MFA. By 2025, 50% of IAM platforms were expected to incorporate AI-driven analytics for anomaly detection (Veritis).
4. Zero Trust policy engine -- OPA integration for environment-aware, context-sensitive authorization decisions rather than static role checks.
5. FedRAMP, HIPAA, or PCI DSS compliance controls -- evidence collection, immutable log chains, and the infrastructure posture required to pass a government or healthcare security review.
6. SIEM integration -- shipping audit events to Splunk, Datadog, or Azure Sentinel in real time.
7. Machine-to-machine token management -- service account governance, client credential flows, and API access scoped per service.

These figures use RaftLabs' rate of $35–$40/hr. US agencies at $150–$250/hr multiply these by 3–5x.

Build vs. buy: when does custom IAM win?

Auth0 (by Okta)

Auth0's pricing starts at $0 for up to 25,000 MAUs on the free tier, $150/month for Essentials B2B at 500 MAUs, and $800/month for Professional B2B at 1,000 MAUs. Enterprise pricing is a custom quote. The costs that matter more than the monthly fee are the add-ons: enterprise SAML SSO connections run $5,000–$34,000 per year depending on volume.

Auth0 Professional works well when you have fewer than 200 customers with standard authentication flows, users don't need org-scoped permissions, and your enterprise customers either don't require SAML SSO or you have fewer than 20 who do.

The build trigger is almost always the SSO connection cost. Fifty enterprise customers each requiring SAML SSO runs $250,000–$1.7 million per year in Auth0 connection fees. That pays for a custom platform many times over. The second trigger is org-scoped permissions: Auth0 permissions are tenant-wide by default. Simulating organization-scoped RBAC requires custom Actions that are hard to debug and produce audit trails no assessor will accept.

Keycloak

Keycloak is open source with no license fee. The actual cost is infrastructure and expertise. A production high-availability cluster (3 Keycloak nodes, PostgreSQL, reverse proxy) runs $510–$625/month in infrastructure. With 3 hours per week of maintenance at engineer rates, the monthly cost reaches $1,250 minimum. The 3-year total cost of ownership for 50,000 users is $315,960, including $240,000 in specialized expertise (SkyCloak). SOC 2 or ISO 27001 compliance audits add $100,000 on top of that.

Keycloak makes sense when you have an in-house identity engineer who knows the realm model, your deployment stays below 100 realms, and you are not running a multi-tenant SaaS where each customer is a separate realm.

The build trigger is realm scale. Keycloak's realm architecture degrades beyond 100–200 realms. For a SaaS product with hundreds of customers, each needing an isolated tenant, realm-based multi-tenancy hits performance walls before you expect it to. The CI/CD integration compounds the problem -- managing Keycloak configuration across development and production environments adds release cycle drag that fast-moving teams cannot absorb.

AWS Cognito

Cognito's new Essentials tier charges $0.015 per MAU with the first 10,000 free. The Plus tier (which includes advanced security) is $0.02 per MAU with no free tier.

Cognito fits when you are building AWS-native, have simple authentication requirements, users need fewer than 25 custom attributes, and you have fewer than 1,000 App Clients in a single User Pool.

The build trigger is user metadata and multi-tenancy. Cognito's hard limit of 25 custom attributes forces enterprises with rich user data -- multi-tenant roles, preferences, department mappings -- to store the overflow in application databases and keep them synchronized. That sync complexity becomes a recurring engineering cost. The 1,000 App Client cap per User Pool blocks the multi-tenant patterns B2B SaaS products need, and every workaround (scope-based, group-based tenancy) trades one constraint for another. Cognito also creates a hard AWS dependency that rules it out for hybrid or multi-cloud architectures.

Azure AD B2C / Microsoft Entra External ID

Azure AD B2C is no longer available to new customers as of May 2025. Microsoft Entra External ID (its successor) offers the first 50,000 MAUs free, then $0.03 per MAU ($0.01625 during the launch discount period).

Entra makes sense when you are already in the Microsoft ecosystem, your authentication flows are standard, and you have no strict data residency requirements.

The build trigger arrives when authentication flows get complex or data sovereignty matters. Azure AD B2C's Custom Policies -- the mechanism for non-standard authentication journeys -- are XML-based and notoriously hard to debug. Teams building step-up auth, progressive profiling, or custom MFA flows routinely spend weeks on policy configuration that would take days in a purpose-built system. The more consequential limit is data residency: Entra External ID stores identity data in Microsoft's Azure regions. Government, defense, and certain EU GDPR scenarios require identity data in a specific region or on-premise, which Entra cannot satisfy.

How long does it take to build identity management software?

Benchmarks from IAM implementation practice: enterprise IAM rollouts at mid-to-large organizations typically run 15–38 weeks for the core implementation, before governance and AI features (Bridgesoft). A V1 built from scratch at $35–$40/hr is faster, because there is no legacy system to integrate with and no enterprise change control process slowing the release cadence.

The failure mode we see most often in custom IAM builds is skipping the architecture phase. A team that starts coding without settling the multi-tenancy strategy -- single database with row-level security, separate schemas per tenant, or separate databases -- faces a painful migration when the first enterprise customer requires data isolation that the original model can't support. That migration typically costs $20,000–$40,000 and adds 6–10 weeks. A 3-week architecture phase at the start eliminates it.

What this does and doesn't cost

The figures above cover development. Four cost categories sit outside them.

Infrastructure on AWS -- EKS, RDS PostgreSQL, ElastiCache Redis, load balancer -- runs $800–$2,500/month depending on user volume and redundancy. Regulated deployments with multi-region failover run higher.

Ongoing maintenance should be budgeted at 15–20% of the build cost annually, covering security patches, dependency updates, and minor feature additions. An IAM system that goes unmaintained becomes a liability faster than most software categories.

Compliance audit preparation adds $30,000–$80,000 for SOC 2 Type II readiness (3–6 months of work before the assessor arrives). FedRAMP authorization runs $250,000–$500,000 in total program cost. The IAM system is one component, but typically the most scrutinized one.

Third-party integrations for non-standard enterprise directories cost $10,000–$50,000 per connector. Budget for these separately if your target customers run legacy LDAP or proprietary identity systems.

How RaftLabs builds identity management systems

The first thing we do is spend 2–4 weeks on architecture, not code. Protocol choices, data model, multi-tenancy strategy, compliance scope -- these decisions lock in the ceiling of what the system can do. Getting them wrong is expensive to fix later.

From there, we build to a working V1 deploy in 12–18 weeks. The first production version handles real traffic, real enterprise customers, and real security reviews. V2 features (SCIM, SAML, compliance audit trails) follow as the customer base grows and the requirements become clearer.

Every project starts with a fixed scope and a fixed cost. The scoping conversation is free and takes about 30 minutes. If the scope isn't well-defined enough to price, we'll tell you that too, and explain what's needed before we can commit to a number.

If you are evaluating whether to build custom IAM or extend what you have, that's a good conversation to have before the Auth0 invoice arrives.