On this page
Short answer: Customer identity and access management (CIAM) is identity software that handles sign-up, sign-in, MFA, consent and profile data for your customers and partners, not your employees. Most CIAM decisions come down to four things: price per monthly active user (MAU) at your real scale, support for passkeys and federation, bot and account-takeover defenses, and whether you can export users if you leave.
Key takeaways
- CIAM platforms are priced per monthly active user, not per seat: Amazon Cognito gives 10,000 free MAUs on its Lite and Essentials tiers, Microsoft Entra External ID gives 50,000, and Auth0's Free plan covers 25,000 (vendor pricing pages, checked September 22, 2026).
- Federated business users can cost extra: Cognito charges $0.015 per SAML or OIDC federated MAU after the first 50, on every tier.
- Auth0's B2C Essentials and Professional plans do not include enterprise connections; its B2B plans start at $150 per month with three enterprise connections.
- NIST SP 800-63B-4 (August 2025) requires verifiers to offer at least one phishing-resistant authentication option at AAL2, which in practice means passkeys or security keys.
- User export, especially password hashes, decides whether you can ever switch vendors without forcing every customer to reset a password.
Who this guide is for
This guide is for an IT admin, security engineer or engineering manager who has been asked to own login for a customer-facing app, a partner portal or a B2B SaaS product. It fits a retailer adding accounts to an ecommerce site, a SaaS company whose customers now demand SSO with their own Okta or Entra ID tenant, and a team outgrowing homegrown password tables.
If you are buying sign-in for employees, you need workforce IAM instead; see the identity and access management category hub.
CIAM vs workforce IAM: what is different
Customer identity and access management and workforce IAM use the same protocols (OIDC, OAuth 2.0, SAML) but solve different problems. Workforce IAM controls which employees reach which internal apps. CIAM serves strangers who sign themselves up, at volumes that can swing by orders of magnitude. Okta, for example, sells Auth0 as its separate customer identity product (Okta, checked September 22, 2026).
| Attribute | Workforce IAM | Customer identity and access management |
|---|---|---|
| Users | Employees and contractors | Customers, consumers, partner staff |
| Who creates accounts | HR or IT, via provisioning | The user, through self-registration |
| Typical pricing unit | Per user per month (Entra ID P1 lists $7) | Per monthly active user |
| Priority | Access control, governance, least privilege | Low-friction sign-up, conversion, privacy consent |
| Sign-in options | Corporate directory, MFA, device posture | Social login, email, passkeys, customer SSO |
| Main threats | Phishing of staff, excess privilege | Credential stuffing, fake sign-ups, account takeover |
| Branding | Vendor or corporate login page | Fully branded, on your own domain |
Watch out: Microsoft counts external users differently from staff. In Entra, B2B guests in a workforce tenant and every user in an external tenant are billed as External ID MAUs, combined across all tenants linked to one subscription (Microsoft Learn, updated June 2026).
Requirements that separate the options
The requirements below decide most customer identity and access management purchases. Weight them by whether your app is consumer (B2C) or business (B2B).
| Requirement | Why it matters | Must-have for | How to verify in a trial |
|---|---|---|---|
| MAU pricing at your scale | Cost grows with active users, and tiers change rates | Everyone, especially consumer apps | Model cost at today's MAU and at 10 times that |
| Passkeys and phishing-resistant MFA | NIST now expects a phishing-resistant option at AAL2 | Finance, health, any app holding payment data | Register and sign in with a passkey on iOS, Android and Windows |
| Enterprise federation (SAML, OIDC) | B2B customers want to sign in with their own IdP | B2B SaaS | Connect a test Entra ID or Okta tenant |
| Organizations and delegated admin | Customer admins manage their own users | B2B SaaS | Create two orgs and confirm isolation |
| Bot and credential-stuffing defense | Consumer logins are a constant attack target | Consumer apps | Check rate limiting, breached-password and risk-based features by tier |
| Branding and custom domain | Login on a vendor domain hurts trust and conversion | Consumer apps | Deploy the hosted login page on your own domain |
| Consent and profile data | Privacy laws require tracked consent and deletion | Apps with users in regulated states or the EU | Record consent, then delete a user through the API |
| User import and export | Decides migration effort in and out | Everyone | Export users and confirm whether password hashes are included |
| Data residency | Some regulators require in-region storage | Regulated or non-US apps | Confirm available regions in writing |
| Extensibility | Custom sign-up logic, webhooks, token claims | Apps with complex flows | Add a custom claim and a post-registration hook |
Deployment models
Customer identity and access management comes in three forms.
- Managed SaaS (Auth0, Microsoft Entra External ID): the vendor runs the service, patching and scaling. You pay per MAU and accept the vendor's regions and limits.
- Cloud provider service (Amazon Cognito): priced per MAU inside your cloud bill, close to your other AWS workloads. Advanced threat protection sits on the higher Plus tier (AWS, checked September 22, 2026).
- Self-hosted open source (Keycloak): Keycloak supports SSO, social login, identity brokering to OIDC and SAML providers, and LDAP or Active Directory federation, and is a CNCF incubation project (Keycloak, checked September 22, 2026). No license fee, but your team owns uptime, patching, scaling and security of the login tier.
Self-hosting makes sense when data location or cost at very high MAU outweighs the staffing cost. For a lean team, a managed service usually fits better.
Pricing models and hidden costs
CIAM pricing is per monthly active user, with free tiers that differ widely. Prices below are list prices from each vendor's page, checked September 22, 2026.
| CIAM platform | Free tier | Paid pricing | Notes |
|---|---|---|---|
| Auth0 (Okta) B2C | Free plan, 25,000 MAU | Essentials from $35/month, Professional from $240/month (500 MAU base) | Price rises with MAU tier; no enterprise connections on paid B2C self-service plans |
| Auth0 (Okta) B2B | Free plan, 25,000 MAU | Essentials from $150/month (3 enterprise connections), Professional from $800/month (5) | Annual billing is 11 times the monthly price |
| Amazon Cognito Lite | 10,000 MAU | $0.0055 per MAU for the next 90,000, then $0.0046 | Password-based sign-in |
| Amazon Cognito Essentials | 10,000 MAU | $0.015 per MAU | Managed login, passkeys, email or SMS passwordless |
| Amazon Cognito Plus | None | $0.020 per MAU | Adaptive authentication, compromised-credential detection |
| Microsoft Entra External ID | 50,000 MAU (core features) | Per MAU above that, see Microsoft's page | SMS, M2M and Go-Local are paid add-ons |
Sources: Auth0 pricing, Amazon Cognito pricing, Microsoft Entra pricing.
Pricing note: at 100,000 direct-sign-in MAUs, Cognito list prices work out to $495 a month on Lite (90,000 billable at $0.0055), $1,350 on Essentials (90,000 at $0.015) and $2,000 on Plus (no free tier), checked September 22, 2026.
Hidden costs to budget for:
- Federated users: Cognito bills SAML and OIDC federated MAUs at $0.015 after 50 free, on top of direct users.
- SMS: Entra External ID charges per SMS authentication event; passkeys avoid this cost.
- Tier jumps: threat protection (Cognito Plus) or enterprise MFA (Auth0 Professional) often sits one tier up.
- Quote-only scale: Auth0 Enterprise is "Contact us", so high-MAU pricing is not published.
How to evaluate CIAM, step by step
- Count real MAUs. Pull 12 months of login data and note the peak month. Output: MAU baseline and growth estimate. Owner: product or engineering.
- Split B2C and B2B needs. List how many customers need their own SSO. Output: federation count. Owner: product.
- Set assurance levels. Map each app to a NIST AAL and decide where passkeys are mandatory. Owner: security.
- List privacy duties. Confirm consent, deletion and residency obligations with counsel. Owner: legal and security.
- Shortlist two or three platforms using the requirements table. Owner: IT or security.
- Run the trial plan below on each finalist. Owner: engineering.
- Model three-year cost at baseline, two times and 10 times MAU, including add-ons. Owner: finance with IT.
- Confirm exit terms in writing before signing. Owner: procurement.
Run a trial that proves something
| Test | How to run it | Pass criteria |
|---|---|---|
| Passkey sign-up | Register a new user with a passkey on phone and desktop | No password required; account recovery path documented |
| Customer SSO | Connect a test Entra ID or Okta tenant via SAML or OIDC | Users sign in and land in the right organization |
| Credential stuffing | Script repeated failed logins from one IP in a test tenant | Rate limiting or blocking triggers; event appears in logs |
| Account linking | Sign up with email, then sign in with Google using the same address | One account, not two, per your chosen policy |
| Branded login | Host login on your own domain with your styling | No vendor domain visible to users |
| User deletion | Delete a user through the API | Profile and consent records removed; audit event logged |
| Export | Export all test users | File includes profiles and, ideally, password hashes |
Questions to ask vendors
Pricing and contract
- How exactly do you define a monthly active user, and are federated or M2M logins counted separately?
- What happens to price if we pass the next MAU tier mid-term?
- Which features from our trial sit on a higher tier?
Security
- Which phishing-resistant methods do you support, and on which tier?
- What bot, breached-password and anomaly detection is included?
- Which independent audit reports (SOC 2 Type 2, ISO 27001) can we see?
Integration
- How many enterprise connections are included, and what does each extra one cost?
- What are the documented API rate limits?
- How do hooks or custom code run, and what are the limits?
Support
- What support channels and response times come with our plan?
- Is there a published uptime SLA?
Exit and data
- Can we export password hashes, and in what format?
- How long is data kept after cancellation, and how is deletion confirmed?
- Which regions can store customer data?
Mistakes to avoid
- Using workforce IAM for consumers: Entra's own pricing treats external users as separate MAU billing, so plan the tenant model up front (Microsoft Learn).
- Pricing only today's users: per-MAU pricing grows with success; model 10 times your baseline.
- Ignoring federation fees: B2B customers on SAML can add a separate meter, as on Cognito.
- Relying on SMS codes: SMS is billed per message on Entra External ID and is not phishing resistant.
- Skipping the export test: without password hashes, a migration forces every customer to reset.
- Leaving consent to the app team: consent and deletion records belong in the identity layer where audits can find them.
Shortlist by scenario
| Scenario | Consider | Why |
|---|---|---|
| App already on AWS, cost-sensitive | Amazon Cognito Lite or Essentials | 10,000 free MAUs, low per-MAU rates, billing in your AWS account |
| Microsoft-centric shop with up to 50,000 external users | Microsoft Entra External ID | Core features free for the first 50,000 MAUs |
| B2B SaaS needing customer SSO and organizations | Auth0 B2B plans | Enterprise connections and unlimited organizations on B2B Essentials and up |
| Strict data location or very high MAU, with ops staff | Keycloak, self-hosted | No license fee; you run the service |
To weigh these against your own constraints, use the shortlist builder.
FAQ
What is CIAM?
CIAM, or customer identity and access management, is software that manages registration, sign-in, MFA, consent and profiles for customers and partners. It differs from workforce IAM, which manages employee access to internal systems.
What is the difference between CIAM and IAM?
IAM usually means workforce identity: employees provisioned by IT and billed per user. CIAM handles self-registered customers at large, variable scale, billed per monthly active user, with more focus on sign-up friction, branding and privacy consent.
Can we use Microsoft Entra ID for customers?
Yes, through Microsoft Entra External ID, which uses external tenants for consumer and business customers. Microsoft states the core features are free for the first 50,000 monthly active users, with paid add-ons such as SMS authentication.
Is Keycloak a CIAM platform?
Keycloak is an open-source identity server that supports social login, SSO, OIDC, SAML and directory federation, so it can serve customer identity use cases. It has no license fee, but your team runs and secures it.
Do customer logins need passkeys?
NIST SP 800-63B-4 requires verifiers to offer at least one phishing-resistant option at AAL2, and passkeys are the common way to meet that for customers. They also avoid per-message SMS charges.
Bottom line
If you already run on AWS and need basic sign-in, price Cognito first; if you are a Microsoft shop under 50,000 external users, start with Entra External ID. B2B SaaS teams that need customer SSO should compare enterprise connection limits before anything else. The verdict flips at high MAU with a capable ops team, where self-hosted Keycloak can win on cost.
Next step: build your requirements into a scored list with the shortlist builder.
Sources (7)
- Pricing, Auth0, https://auth0.com/pricing, accessed September 22, 2026
- Amazon Cognito pricing, AWS, https://aws.amazon.com/cognito/pricing/, accessed September 22, 2026
- Microsoft Entra plans and pricing, Microsoft, https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing, accessed September 22, 2026
- External ID pricing, Microsoft Learn, https://learn.microsoft.com/en-us/entra/external-id/external-identities-pricing, accessed September 22, 2026
- SP 800-63B-4 Digital Identity Guidelines: Authentication and Authenticator Management, NIST, https://pages.nist.gov/800-63-4/sp800-63b.html, accessed September 22, 2026
- Customer Identity and Access Management (CIAM), Okta, https://www.okta.com/identity-101/ciam/, accessed September 22, 2026
- Keycloak, https://www.keycloak.org/, accessed September 22, 2026