midPoint Implementation Pricing
What a midPoint implementation costs, what drives the price, and what you never pay for.
A transparent cost model from a midPoint Gold Partner.
04
No licence fee.
Here is what you pay for instead
midPoint implementation pricing is simpler than commercial IGA pricing because one line is missing: the licence. midPoint is open source under Apache 2.0 and the EUPL, so there is no per-identity, per-year fee and no true-up when you grow. The budget has three parts — implementation services, an optional Evolveum subscription for support and maintenance releases, and operations.
Commercial identity governance is sold per identity per year. Third-party licensing benchmarks put SailPoint Identity Security Cloud at roughly 30 to 90 US dollars per identity per year at list price before discounts — a cost that grows with headcount whether or not you use more of the product. midPoint’s cost grows with complexity instead: the number of connected systems, the quality of your identity data, and how much governance you switch on. We compare the two platforms feature by feature in midPoint vs SailPoint.
That is why we quote midPoint implementations on the shape of your estate, not on your user count. The project sizes below come from implementations we have delivered as one of seven midPoint Gold Partners worldwide; your scoped estimate comes from a fixed-price discovery that inventories your sources, targets, roles and workflows in two to four weeks.
Everything on this page applies equally to a greenfield implementation and to a migration from Microsoft Identity Manager, SAP IDM, DirX or a home-grown system — a migration simply adds a parallel run and a decommissioning phase to the same cost model.
What drives the cost of a midPoint implementation
Connected systems
How many targets, which kind. Active Directory, LDAP, databases, SCIM and REST applications come with standard connectors; SAP, mainframes and bespoke systems need configuration or connector development. Each system adds discovery, mapping, testing and cut-over effort.
Identity data quality
Clean HR data with reliable identifiers correlates in days; duplicate, incomplete or multi-source data needs correlation rules, clean-up and exception handling before provisioning can be trusted. This is the most underestimated driver.
Role model and policies
A handful of birthright roles costs little; a business-role catalogue with inheritance, segregation-of-duties rules and role mining of an existing catalogue is a project in itself.
Workflows and self-service
Approval chains, access requests, delegated administration and manager self-service — each process is designed, configured and tested with the people who will use it.
Governance scope
Access certification campaigns, SoD enforcement, audit reporting and compliance evidence for NIS2, DORA or ISO 27001 are switched on in phase four; they add effort once, then run.
Deployment and operations
On-premises, private cloud, Kubernetes or our managed service IAM Factory in Germany — the choice sets the environment effort during the project and the running cost afterwards.
Typical midPoint implementation sizes and durations
Focused — HR to directory
HR source, Active Directory or LDAP, two to four further targets, birthright roles, basic self-service. Up to about 5,000 identities. 3–4 months.
Mid-size — roles and workflows
Five to fifteen systems, business-role model, approval workflows, access certification. 5,000–20,000 identities. 5–8 months.
Enterprise — full governance
Multiple entities or forests, 20 or more systems incl. SAP, full role catalogue, SoD, certification, audit evidence. 20,000+ identities. 8–14 months.
Managed — IAM Factory
midPoint operated by us on German infrastructure: hosting, monitoring, upgrades, second-line support, SLA. Monthly fee, sized by identities and systems.
05
Cost components of a midPoint implementation
| Component | How it is priced | When you get the number | Notes |
|---|---|---|---|
| Discovery and migration blueprint | Fixed price, 2–4 weeks | Fixed quote before we start | Inventory of sources, targets, roles, workflows and data quality; scope, calendar, risks and the estimate for the phases below. Credited against the implementation if we deliver it. |
| Implementation services | Fixed price per phase or time and materials, your choice | Estimate after discovery, then a fixed price per phase | Foundation, build and simulate, go-live and governance — delivered in phases with simulations before every cut-over. |
| midPoint licence | — | € 0 | Open source, Apache 2.0 and EUPL. No per-identity fee, no true-up, no edition upgrade. |
| Evolveum subscription (optional) | Annual, priced by Evolveum according to deployment size | Quoted with the project | Vendor support, maintenance releases, security fixes on the LTS line. Recommended for production; not required to run midPoint. |
| Operations | In-house · Inalogy support retainer · IAM Factory managed service | Monthly fee, quoted with the project | Upgrades, monitoring, second-line support. Scales with systems and identities, slowly. |
| Training | Per course, on-site or remote | Price list on request | Administrator and architect courses in English, Slovak or Czech, built on your own configuration. |
A worked example: an organisation with 5,000 identities paying a list price of 50 US dollars per identity per year for a commercial IGA subscription spends about 250,000 dollars a year on licences before any implementation — roughly 1.25 million over five years, rising with every hire. The same organisation on midPoint pays for one implementation, an optional subscription and operations, and its cost does not move when headcount does. The benchmark figures come from independent licensing analysts, not from the vendor; actual commercial discounts vary. See our comparison of open source IGA platforms and the midPoint implementation page for how the phases run.
06
Frequently asked questions about midPoint pricing
Is midPoint really free?
The software is. midPoint is published under Apache 2.0 and the EUPL, so you can download, run, modify and distribute it without a licence fee. What costs money is the work to make it fit your organisation — connectors, data model, roles, workflows — plus optional vendor support and operations.
Do we need an Evolveum subscription?
Not to run midPoint. A subscription buys vendor support, maintenance releases and security fixes on the long-term-support line, which we recommend for production systems in regulated environments. Evolveum prices it by deployment size; we quote it together with the implementation so you see the whole number.
Fixed price or time and materials?
Both. Discovery is always fixed price. After discovery we offer a fixed price per phase for a defined scope, or time and materials with a ceiling if you expect scope to move. Most customers choose fixed price for foundation and go-live and time and materials for the governance phase.
Does the cost grow with the number of users?
Only marginally. Implementation effort depends on systems, data and processes, not on headcount. Operations grow slowly with volume. This is the structural difference from per-identity commercial subscriptions, where every new employee, contractor or service account adds to the annual bill.
What does a migration from MIM or SAP IDM add to the price?
A parallel run — midPoint reconciling against production read-only while the old platform keeps provisioning — and a phased decommissioning. Both are included in the MIM migration and SAP IDM migration scopes; the cost drivers are the same as for a new implementation.
How do we get an exact number?
Send us the shape of your estate — HR and other sources, target systems, approximate identity count, governance requirements, where the platform should run — and we reply with an indicative range within a week. The exact figure comes from discovery.
Want an indicative price for your estate? Tell us your sources, systems and identity count — let’s talk. Want to know more about our services?
