Costing an identity provider renewal from an inventory.

2026-10-19 · TenantFlex

An identity provider renewal arrives with an uplift and a deadline, and the conversation inside the organisation usually runs the same way. Someone asks what it would take to leave. Someone else says "hundreds of integrations" and the room moves on. The uplift gets paid, because leaving looked harder than it was ever actually costed. This is how to cost it, whichever provider you are renewing with, in the time between the quote arriving and the signature being due.

Start with the inventory, not the contract

The contract tells you what you pay. It does not tell you what you would have to move, and the number people quote from memory is wrong in both directions: it includes applications that were decommissioned years ago and misses the ones a business unit set up without telling anyone. So the first step is to read the tenant.

A read-only connection can list every SAML and OAuth/OIDC application in the tenant, with its sign-on mode, claims, assignments and certificates: Application.Read.All on Entra ID, okta.apps.read on Okta, the Configuration Read Only role on PingOne. With the optional sign-in log permission you can also see when each one was last used. In our experience, a tenant that "has four hundred integrations" has about a hundred and forty that are federated and in use. That is the number the rest of the costing is built on.

Band each application

Not every application costs the same to move. Three bands cover almost everything:

• Straightforward. Standard SAML or OIDC, standard claims, group-based assignment. Recreated in the destination with no human decision. Typically sixty to seventy percent.
• Needs review. A claim with an expression, a custom attribute, a group filter, or an OIDC application with unusual grant types. Someone has to make a mapping decision, once. Twenty to thirty percent.
• Manual work. Deep integrations with provisioning logic, legacy WS-Fed, or applications nobody owns. Budget engineering time per application, whatever tool you use. Under ten percent, but they set the critical path.

Put hours against the bands

By hand, an application in the first band takes two to three engineer hours by the time it is exported, rebuilt, tested with the owner and written up; the second band four to six; the third, whatever it takes. With a migration platform the first two bands collapse to minutes of review each, and the third is unchanged. For a hundred and forty applications at a blended rate of 120 an hour:

Band	Apps	By hand	With a platform
Straightforward	95	240 hours · 28,800	24 hours · 2,900
Needs review	35	175 hours · 21,000	35 hours · 4,200
Manual work	10	80 hours · 9,600	80 hours · 9,600
Total	140	495 hours · 59,400	139 hours · 16,700

These are illustrative figures; the calculator takes your own. The point is the shape: by hand, the migration costs about as much as a year of a modest uplift and takes two engineers most of a year part-time. With a platform the engineering cost is a fraction, and what remains is owner coordination, which no tool removes.

Add the destination you may already pay for

If the organisation has Microsoft 365, it very likely has Entra ID P1 or P2 in the agreement already. Consolidating onto a provider you already license does not just avoid the uplift; it removes the renewal line. That changes the arithmetic from "uplift versus migration cost" to "entire contract versus migration cost", and the second comparison is rarely close.

Build the plan back from the date

A renewal date three months out is enough, if discovery happens now. Discovery in the first week gives the inventory and the bands. A pilot wave of twenty straightforward applications in month one proves the owner process and the claim mappings. The remaining waves run as scheduled jobs in month two, with execution logs. By the renewal date, either the applications have moved, or enough of them have that the remaining ones are a short tail rather than a reason to sign.

Then negotiate, whichever way you decide

You may still stay. Many renewals end with the same provider at a different price, because the account team's model assumes you cannot leave and a completed pilot with a scheduled cutover date corrects that assumption. The inventory, the bands and the plan are yours either way, and so is the credential expiry list that discovery produces as a side effect. The only outcome to avoid is the one where the uplift is paid because nobody costed the alternative.