in this guide
There is a website called sso.tax. It lists vendors who charge more for single sign-on, and it has been shaming them since 2018. In October 2026 it listed around 150 vendors, with the newest entry dated March 2026, so it is still maintained.
The examples are the reason people share it. Entries there include an infrastructure vendor at twenty dollars a month for the base plan and two thousand for the tier with SSO, a learning platform going from around two thousand a year to nearly fifty thousand, and an analytics tool going from twenty dollars to over eight hundred a month. A separate tracker, ssopricing.com, puts the median uplift across thirty-four vendors at 150%, which is two and a half times the base price.
That campaign has half worked. And in winning the argument about SSO, everybody stopped watching the two things that matter more.
the two features that decide everything
Single sign-on decides how people log in. It is worth having, and it is not the control that does the work in these guides.
SCIM provisioning decides whether removing somebody from your directory removes them from the tool. Without it, every deprovisioning is a human remembering to go into a console, which is the failure behind roughly half of these guides.
Audit logs decide whether you can answer any question afterwards. Without them the tool is evidence-free, which is the super admin guide arriving one application at a time.
Now look at how those are priced.
Stitchflow, which sells provisioning automation and therefore benefits from this finding, looked at 721 SaaS applications. It found that 42% gate SCIM behind an enterprise tier, 57% have no SCIM at any price, and around 1.2%, nine applications out of 721, include it on the base tier. Nobody independent has published a comparable count, so treat the exact percentages as Stitchflow’s and the shape as probably right.
If 57% do not offer it at all, the problem is bigger than pricing: most of your stack has no supported way to be told that somebody left.
There is a companion tracker for audit logs, audit-logs.tax, listing eighteen vendors, and the entries are the ones you would expect: chat platforms where audit logs need the top enterprise product, and a large CRM where they are a separate paid add-on.
the clean example
Notion, priced in July 2026: ten dollars a seat for Plus, twenty for Business, which is where SAML single sign-on appears, and Enterprise at a price you have to ask for, which is where SCIM and the audit log live.
Look at the shape of that.
You can pay double to get single sign-on. You still cannot automatically remove a leaver, and you still cannot see who did what. To get either of those you go to a tier with no published price, which at your size usually ends the conversation.
So the company that pays the SSO uplift on that tool has bought the feeling of centralised control. Its leavers keep working accounts, because nothing propagates. Its investigations have no evidence, because there is no log. And it pays twice the base price for that.
Here is the claim somebody could argue with: paying the SSO uplift on a tool that still withholds SCIM and audit logs is a bad purchase, and it can leave you worse off than not paying it, because it produces a belief in coverage that the configuration does not support.
Either buy the tier that carries all three, or classify the tool as unmanaged and compensate deliberately. Stop paying the middle price.
what each tier actually buys you
the SSO tier
what most companies pay for
- One login through your identity provider
- Leavers keep their accounts until someone deletes them
- No record of who did what
SSO, SCIM and audit log
what offboarding needs
- One login
- Removal in the directory removes them here
- Evidence when somebody asks
the vendor argument, made properly
The vendors are not simply extracting here, and the strongest version of their case deserves stating.
It goes like this. Non-standard SSO is extra work for the vendor. SAML is not one integration. It is a long tail of misconfigured identity providers, certificate rotations, just-in-time provisioning edge cases and clock-skew problems, each of which generates support tickets from customers who cannot log in and are therefore not calm. Enterprise buyers demand it in procurement, which is a genuine signal of willingness to pay. Free SSO would be subsidised by fifteen-seat customers who never open a ticket.
That argument is strong for SAML.
It is much weaker for SCIM, which is a REST API with a published specification and far less support surface than SAML.
And it is close to worthless for audit logs, because the vendor already generates the events. They are in the database. Withholding them is a decision to hide something that exists, and the cost of exposing it is an endpoint.
So one of the three has a real cost story and the other two do not.
the movement, in both directions
The picture is not static.
Cloudflare opened single sign-on to all plans in September 2025, having previously reserved it for enterprise, and made it self-serve. It announced no change for SCIM or audit logs, which is exactly the pattern this guide describes.
On the regulatory side, the closest thing to a position is the US Secure by Design pledge from CISA, which asks signatories to make multi-factor authentication available at no extra cost and to provide logs without additional charge. CISA’s own page says it does not enforce or verify adherence. No European regulator or procurement rule has taken a clear position on security features as paid add-ons.
So this is a market problem with no regulatory pressure behind it, and the only leverage anybody has is at renewal. Nobody is coming to fix it, no standard will force it, and the shaming site has been running for eight years without moving SCIM. What moves it is a buyer asking about provisioning early enough in a sales cycle that the answer costs the vendor something.
what to do about it
Score three things. For every tool in your stack: SSO, SCIM, audit log. Three columns, yes or no. It takes an afternoon for a stack of thirty, and you will rarely need to repeat it, because the answers change at renewal. That table is a better picture of your access surface than most inventories, because it tells you which tools can be offboarded automatically and which cannot.
Where SCIM is missing, make it a named line in the offboarding checklist. A specific line, naming the specific tool, with a named owner. “And the rest” is where leavers survive.
Where audit logs are missing, treat the tool as evidence-free and decide what it holds. That is a data decision more than a security one, and it is the only lever you have.
Ask for SCIM as a contract term. A pricing page is written for somebody else’s company, and a twelve-month commitment is something vendors value. The worst outcome of asking is a no.
And at renewal, price the whole thing honestly. The tool that costs less and has no SCIM has a recurring human cost attached to every departure, forever. That cost is real and nobody puts it in the comparison, because it lands on you instead of on the budget.
the market take
The SSO tax was the right campaign, and it is now the wrong fight to still be having. Vendors are conceding the visible thing while holding the two invisible ones, and the invisible ones decide whether the person who left in March still has an account in July.
Ask about SCIM before you ask about SSO. It tells you more about how the vendor thinks about your problem, and it is the question their pricing page is least prepared for.
A tool without provisioning is a tool you will be offboarding from by hand for as long as you own it, and that cost belongs in the comparison next to the licence fee. Nobody puts it there, because it does not arrive as an invoice. It arrives as a Friday afternoon, repeatedly, for years.
on the record
all myths →