Okta vs Entra ID vs Google Cloud Identity 2027: $6 to $17 a user compared

Summary. For a 200-person US company, the cheapest paid workforce identity tiers cost almost the same at list price. Okta Starter and Google Cloud Identity Premium on Google's Annual plan both cost $6 per user per month, or $14,400 a year. Microsoft Entra ID P1 lists at $7.00 per user per month, paid yearly ($16,800 a year), and P2 at $10.00 ($24,000), after Microsoft raised both by $1.00 from 1 July 2026. In the UK, Entra lists P1 at £5.40 and P2 at £7.70 before VAT, Cloud Identity Premium is £60 a year per licence, and Okta's UK page shows only dollar prices. Okta bills every Workforce Identity suite annually with a $1,500 annual contract minimum: Starter $6, Core Essentials $14, Essentials $17, higher suites on quote. Google's free edition covers SAML single sign-on and 2-Step Verification. The cheapest option is often a licence you already pay for: Microsoft 365 Business Premium and E3 include Entra ID P1. Choose Okta for a vendor-neutral directory across mixed apps, Entra if you run Microsoft 365, and Cloud Identity if you run Google Workspace or need free SSO. All three support passkeys.

About this article. For IT leads and finance teams in the US and UK choosing or renewing a workforce identity platform for employees and contractors. We checked every price, plan name, minimum and feature claim against Okta's US and UK pricing pages and help centre, Microsoft's US and UK Entra and small-business pricing pages and Microsoft Learn, and Google Cloud and Google Workspace documentation, on 13 November 2026. All figures are list prices before tax; resellers and agreements can differ, so re-check before you commit. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What changed for 2027, and what to check before you renew

Entra ID costs more than older comparison tables say. Microsoft's US pages list Entra ID P1 at $7.00 and P2 at $10.00 per user per month, paid yearly on an annual subscription that renews automatically. An archived copy of the same pricing page from 24 December 2025 shows $6.00 and $9.00. Microsoft's pricing FAQ of 24 March 2026 lists Entra P1 and P2 among the products whose prices rose on 1 July 2026, with existing customers moving to the new price at their first renewal after that date. Our Microsoft 365 renewal playbook covers the rest of that change.

Okta has a middle tier. Core Essentials, at $14 per user per month, sits between Starter ($6) and Essentials ($17) and adds Adaptive MFA and Lifecycle Management without Identity Governance.

Google's price depends on commitment. Cloud Identity Premium costs $7.20 per user per month on the Flexible Plan, which you can cancel at any time, or $6 per licence per month ($72 a year) on the Annual/Fixed-Term Plan. Google last updated that page on 10 November 2026. Premium is billed through your Google Workspace subscription, not through Google Cloud.

What to do now. List the identity licences you already pay for in Microsoft 365 or Google Workspace, then decide whether you need lifecycle automation and access reviews, because that is where the tiers split.

Okta Workforce Identity: Starter, Core Essentials, Essentials and up

Okta sells Workforce Identity as suites, priced per user per month and billed annually. Its comparison table on 13 November 2026 showed the following.

• Starter ($6). Single sign-on (SSO), multifactor authentication (MFA), Universal Directory and 5 Workflows flows (Okta's no-code automation). Adaptive MFA, Lifecycle Management, Device Access and Privileged Access are add-ons.

• Core Essentials ($14). Starter plus Adaptive MFA and Lifecycle Management, still with 5 flows and no Identity Governance.

• Essentials ($17). Adds Identity Governance (the plan card calls it Access Governance), Privileged Access for 2 admins and 50 flows.

• Professional (quote). Adds Device Access, Identity Threat Protection, Identity Security Posture Management with 2 integrations, a sandbox and the maximum Workflows allowance.

• Enterprise (quote). Adds API Access Management, Secure Partner Access, Access Gateway for on-premises apps and 50 posture-management integrations.

Identity Threat Protection is an add-on on Core Essentials and Essentials and not offered on Starter. Okta's footnote says its Identity Governance add-on bundles Access Governance, Lifecycle Management and Workflows. Okta describes Lifecycle Management as automating onboarding, offboarding and profile updates, and Identity Governance as automating access reviews and access requests.

The $1,500 minimum. At $6 a user, Starter costs $72 a user a year, so it crosses $1,500 at 21 users (21 × $72 = $1,512). On Core Essentials ($168 a user a year) the minimum stops mattering at 9 users (9 × $168 = $1,512).

Customer identity is a different product. Okta's Customer Identity pricing starts with a required Enterprise base at $3,000 per month, billed annually. This article covers employees and contractors signing in to work apps.

Best for: organisations with a mix of Microsoft, Google and other SaaS apps that want a vendor-neutral directory, and teams that want joiner, mover and leaver automation across many apps without building it themselves.

Microsoft Entra ID: Free, P1, P2, ID Governance and Entra Suite

Entra ID Free comes with Microsoft 365, Azure and other commercial Microsoft online services. Microsoft says it covers user and group management, on-premises directory synchronisation, basic reports, self-service password change for cloud users, and SSO across Azure, Microsoft 365 and many popular SaaS apps. Microsoft Learn adds that Free offers MFA through security defaults but only with Microsoft Authenticator, and that automated user provisioning to SaaS apps works on Free.

Entra ID P1 ($7.00, £5.40) adds Conditional Access, passwordless and phishing-resistant authentication, hybrid identity administration, employee self-service, cross-tenant delegated access, backup and recovery, advanced security and usage reports, and verifiable credentials. Conditional Access, the policy engine that decides when to demand MFA or a compliant device, needs P1, as does HR-driven provisioning.

Entra ID P2 ($10.00, £7.70) adds Entra ID Protection with risk-based Conditional Access and adaptive risk remediation, premium risk detections, Privileged Identity Management (PIM), and basic entitlement management and access reviews. Microsoft says P2 carries select PIM capabilities, with full PIM in ID Governance and Entra Suite.

Entra ID Governance ($7.00, £5.40) is the standalone product for full identity governance. Lifecycle Workflows, which automate joiner, mover and leaver tasks, need ID Governance licences, and Microsoft Learn caps a tenant at 50 workflows.

Entra Suite ($12.00, £9.20) requires Entra ID P1 or a plan that includes it, and Microsoft says special pricing is available to P2 and Microsoft 365 E5 customers. Microsoft Learn lists Private Access, Internet Access, ID Governance, ID Protection and Verified ID premium capabilities in the suite. It is also part of Microsoft 365 E7, which lists at $99.00 per user per month.

What you may already own. Microsoft Learn lists Entra ID P1 in Microsoft 365 Business Premium, Microsoft 365 E3, E5 and E7, F1 and F3, and Enterprise Mobility + Security E3. P2 is in Microsoft 365 E5 and E7, Microsoft Defender Suite, and the Defender Suite for Microsoft 365 Business Premium. Our Microsoft 365 Business Premium vs E3 vs E5 comparison sets out what else each plan includes.

Best for: organisations that run Microsoft 365, Windows and Intune, where Conditional Access can check device compliance and the licence may already be paid for.

Google Cloud Identity: Free and Premium

Cloud Identity is Google's identity and endpoint management service for users who do not need Google Workspace apps such as Gmail and Calendar.

Cloud Identity Free gives 50 user licences by default, and admins can request more at no cost through a Google Workspace support form. Google's editions table lists 2-Step Verification with security keys, password strength controls, self-service password recovery, SSO with Google as the identity provider for SAML apps or with a third-party identity provider into Google, Google Cloud Directory Sync from Active Directory or LDAP, basic mobile device management, and admin and user log events. Support comes through Google Cloud community forums.

Cloud Identity Premium ($7.20 Flexible or $6 Annual; £6 a month or £60 a year) adds Context-Aware Access based on user and device, automated user provisioning, advanced mobile and Windows device management, Secure LDAP for LDAP-based apps, the security centre, device log events, export of log events to BigQuery, 24x7 chat and email support, and a 99.9% SLA.

Gaps to know. Google's editions table lists no access reviews, certifications or privileged access management, and automated provisioning is Premium-only. If you need governance evidence for SOC 2 or ISO 27001 audits, plan to produce it another way.

The Annual plan trade-off. On the Annual/Fixed-Term Plan you commit to a year for the licences bought at the start, can add licences at any time, and can only reduce them at renewal. Cancel early and you still pay for the year.

Best for: Google Workspace customers, Google Cloud teams that need managed identities for engineers, and small teams that want free SSO and 2-Step Verification. Google says customers on Workspace Enterprise, Frontline Standard or Plus, or Enterprise Essentials Plus may not need a separate Premium licence. Our Microsoft 365 vs Google Workspace pricing guide compares the suites themselves.

Passkeys and phishing-resistant MFA on each platform

A passkey replaces the password and one-time code with a cryptographic credential that a fingerprint, face scan or device PIN unlocks, and it only works on the site it was created for, which is why it resists phishing.

• Okta. Okta lists Passkey (FIDO2 WebAuthn) and Okta FastPass, which comes with Okta Verify, as phishing-resistant authenticators. Admins enable them, set enrolment policies, then write app sign-in policies that require a phishing-resistant factor. Okta warns that blocking syncable passkeys stops iPhone users from using the passkey authenticator, so plan FastPass or NFC or USB-C security keys for them.

• Microsoft Entra. Passkeys, synced or device-bound on security keys and in Microsoft Authenticator, are available in every Entra ID edition, including Free, with no extra licence. Requiring them for sensitive resources uses a Conditional Access authentication strength, and Conditional Access needs P1.

• Google. Admins turn on skip passwords under Security, Authentication, Passwordless in the Admin console, and users then add a passkey. Turning it on does not remove the user's password, and admins can restrict passkeys to hardware security keys. Tracking passkey enrolment in the security investigation tool needs an edition such as Cloud Identity Premium or a Workspace Enterprise plan.

For UK firms, Cyber Essentials requires MFA on every cloud service that offers it, and since April 2026 an applicant that leaves it off fails automatically, whether the MFA is free, included or a paid option. The NCSC's v3.3 requirements count FIDO2 authenticators as passkeys and as MFA. Our Cyber Essentials Danzell guide explains the rule.

Head-to-head comparison

Sources: the vendor pricing pages and documentation cited above, checked on 13 November 2026.

Which to choose

Microsoft 365 Business Premium lists at $22.00 (£16.90) per user per month for up to 300 employees and includes Entra ID P1, Defender for Business and Intune P1.

Worked cost: a 200-person company

Assume 200 people in the US or the UK, every employee licensed, list prices on 13 November 2026, annual terms unless marked, and no tax. Prices come from the vendor pages cited above.

With UK VAT at the 20% standard rate, Entra ID P1 for 200 users is £12,960 × 1.2 = £15,552, and Cloud Identity Premium Annual is £12,000 × 1.2 = £14,400.

Like for like. The entry tiers do different jobs: Okta's Adaptive MFA starts at Core Essentials, Entra's Conditional Access is in P1, and Cloud Identity Premium adds device management and Context-Aware Access. For automated provisioning plus access reviews, compare Okta Essentials ($40,800) with Entra ID P1 plus ID Governance ($33,600) or P1 plus Entra Suite ($45,600).

The bundle effect. If the same 200 people are on Microsoft 365 Business Premium, Entra ID P1 costs nothing extra, so adding Okta Starter means paying $14,400 a year for a second directory. If they are on Business Standard at $14.00, moving to Business Premium at $22.00 costs ($22.00 - $14.00) × 200 × 12 = $19,200 a year, or (£16.90 - £10.80) × 200 × 12 = £14,640 in the UK, and also brings Defender for Business and Intune. Our CrowdStrike vs SentinelOne vs Defender for Business comparison prices the endpoint side.

Small-team check. At 15 users, Okta Starter would be 15 × $6 × 12 = $1,080, but the $1,500 minimum applies. Entra ID P1 for 15 users is 15 × $7.00 × 12 = $1,260, and Cloud Identity Premium Annual is 15 × $72 = $1,080, with no minimum on Google's billing page.

US and UK buying notes

UK. Microsoft's sterling prices exclude VAT, which is 20% at the standard rate. Google publishes sterling rates for Cloud Identity Premium. Okta shows only dollar prices on its UK page, so a UK buyer carries the exchange-rate risk unless a reseller quotes in sterling. If you are working towards Cyber Essentials, switch on MFA for every cloud service that offers it, including where it is a paid option, before you apply.

US. These are pre-tax list prices, so ask for sales tax on the quote. Microsoft 365 E3 already includes Entra ID P1, and E5 includes P2.

Both. Okta and Microsoft bill these products yearly, and Google's Annual plan only lets you cut licences at renewal. If headcount is volatile, Google's Flexible Plan can cost less over a year despite the higher monthly rate.

Implementation and migration checklist

1. Inventory your apps and mark which support SAML or OIDC for SSO and SCIM for provisioning.

1. List licences you already own in Microsoft 365 or Google Workspace, and check for Entra ID P1 or P2 and Cloud Identity Premium features.

1. Choose one source of truth for people data, such as the HR system.

1. Turn on MFA everywhere first, then move admins and finance staff to passkeys or hardware keys before everyone else.

1. Plan for unmanaged phones, including the fallback if you block syncable passkeys.

1. Pilot SSO with five low-risk apps, then migrate the rest in batches, keeping a break-glass admin account outside SSO.

1. Write the leaver process: disable in one place, confirm deprovisioning in every connected app, and record it for auditors.

1. Review endpoint security in the same project, since device compliance feeds sign-in policy.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can inventory your apps and licences, design SSO, MFA and passkey policies on Okta, Entra ID or Cloud Identity, and build provisioning and leaver workflows. Talk to us at /contact-us/.

Last updated: 13 November 2026.

References

1. Plans and pricing (US) — Okta

1. Compare Cloud Identity billing plans, updated 10 November 2026 — Google Cloud Documentation

1. Microsoft Entra pricing (US) — Microsoft Security

1. Microsoft 365 Packaging and Pricing Updates Public FAQ, 24 March 2026 — Microsoft Licensing Resources

1. Microsoft Entra pricing (UK) — Microsoft Security

1. Plans and pricing (UK) — Okta

1. Cloud Identity editions — Google Cloud Documentation

1. Microsoft Entra licensing — Microsoft Learn

1. Microsoft Entra ID — Microsoft Security

1. Microsoft Entra pricing, archived 24 December 2025 — Internet Archive Wayback Machine

1. Cloud Identity pricing — Google Cloud

1. Microsoft Entra Suite — Microsoft Security

1. Cloud Identity Premium — Google Workspace Admin Help

1. Phishing-resistant authentication — Okta Help Center

1. Configure the Passkey (FIDO2 WebAuthn) authenticator — Okta Help Center

1. How to enable passkeys (FIDO2) in Microsoft Entra ID — Microsoft Learn

1. Allow users to skip passwords at sign-in — Google Workspace Admin Help

1. Important update: changes to Cyber Essentials for April 2026 — IASME

1. Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026 — NCSC

1. Microsoft 365 security pricing for business (US) — Microsoft Security

1. Microsoft 365 security pricing for business (UK) — Microsoft Security

1. VAT rates — GOV.UK