The SSO Tax: When Security Features Cost Extra

The VP’s last day was Friday. On Monday, her account in the new analytics tool was still active. It was not because anyone forgot to file a termination ticket. It was because the tool’s provisioning API is an enterprise feature, and the department was on the Pro plan. She could still log in with the local password she set up during onboarding.

There are two prices for a SaaS application. The first covers the software. The second covers the way your company is allowed to use it.

A business unit finds a tool for fifteen dollars a month, runs a pilot, and proves the value. Information Security reviews the architecture and mandates single sign-on and automated offboarding. The vendor’s Enterprise tier, the only one that supports SAML and SCIM, costs sixty dollars a month. The security mandate just quadrupled the software budget.

People call this the SSO tax. That is a misnomer. The tax is not on login. It is on control. SAML gets your employees into the application. SCIM gets them out. Audit logs tell you what they did while they were inside. Vendors know you can live without custom branding or a dedicated customer success manager. They know you cannot survive a SOC 2 audit without SCIM. The tier boundary is a pricing decision, not a security decision. The product marketing team drew it to segment buyers by corporate structure and budget.

When organizations refuse to pay the SCIM tax, they rely on IT service desk tickets to manually deprovision users in the SaaS console. The mechanism breaks the moment a manager forgets to file the specific application ticket during an employee’s termination. The former employee retains access to the tool for months, bypassing the central identity provider entirely because they can still log in with a local password. SCIM is cheaper than the person you hire to click Deactivate four hundred times. But distributed labor never shows up as a budget line. The hours spent manually managing access are invisible. The SCIM license is visible. The visible cost loses the budget argument even when it is smaller.

You find out which tier you actually bought when the incident happens. It is 2 AM on a Saturday. A service account is compromised. Incident response asks the vendor for ninety days of login events to trace the lateral movement. The current plan retains seven days. The compromise started on day sixty. The analyst asks the incident commander to authorize a mid-breach credit card upgrade to the Enterprise tier. The upgrade goes through, but the vendor cannot recover the data. They overwrote it on day eight, exactly as specified in the Pro tier terms of service. An audit log that starts on the day of the upgrade is not an answer to yesterday’s incident. The logs you need during an investigation are the ones you chose not to buy.

The security review is the last thing that happens in the procurement cycle, and it is the only time the IT team has leverage. By the time the security architect shows up, the business unit has already built their workflow on the base tier and fallen in love with the interface. The vendor knows the buyer is committed. Sequence determines leverage. Bring the security requirements to the first call, not the security review. Ask for the full tier sheet on day one. Know what is above you and what it costs. Account executives will volunteer the ceiling when asked.

“SCIM supported” does not specify which operations work. Test a complete joiner, mover, and leaver cycle in a sandbox before signing. Remove a user from an identity provider group and check whether the application revokes their sessions, changes their role, disables their account, or just waits until its next sync. “Audit logs included” often means an admin activity page, not an exportable event stream. Ask for the audit log schema and the export API documentation. If they will not share them pre-sale, you have your answer. A CSV download is a compliance check. A streaming log API is an operational necessity.

Do not rely on plan names in the contract. A plan name is less useful than a list of the operations and events the team expects to receive. Name SAML 2.0, SCIM 2.0 provisioning and deprovisioning, a twelve-month audit log retention period, API export at no additional charge, and session revocation. Include a no-repackaging clause. Vendors drift features up-market. Without a contractual lock, your renewal quote will be two and a half times the original price because SCIM moved to an Enterprise Plus tier.

Some vendors possess the billing architecture to decouple these features and sell a standalone security add-on. A twenty percent uplift on the Pro tier for SAML and log export. Account executives rarely offer this custom SKU unless the buyer threatens to walk away over the bundled Enterprise price. Use the competitor quote. If a competitor includes SCIM on the tier you are evaluating, make it the primary negotiation wedge. Vendors hate losing on a checklist.

If the bundle is still too expensive, shift the cost to the business unit. If Marketing wants the tool, Marketing pays the SSO tax. When business units have to absorb the Enterprise tier pricing into their own profit and loss statement, they become very effective at finding alternative vendors who include security in the base price.

The identity provider is not the control plane. The applications are. Every SaaS application that gates its integration behind a premium tier is a gap in that control plane, and the gap stays open until someone decides the manual labor is cheaper than the license.