Bitwarden Review: Self-Hosting, SSO and Real Costs

Short answer: Bitwarden fits budget-conscious businesses and MSPs that want SSO, SCIM or self-hosting without paying enterprise-only prices elsewhere. Teams costs $4 and Enterprise costs $6 per user per month, both billed annually. SSO requires Enterprise; SCIM works on both plans. It does not fit teams that need a published support SLA or that cannot run their own self-hosting infrastructure.

Bitwarden at a glance

Who Bitwarden is for

Bitwarden fits a 40-person accounting firm on Microsoft 365 that needs SCIM-based offboarding but cannot justify a $9-per-user identity-heavy password manager. SCIM directory sync with Entra ID, Okta, Google Workspace, OneLogin or Ping Identity is available on the $4 Teams plan, not gated to the top tier (bitwarden.com/help/directory-sync/).

See password managers for small businesses for how that fits alongside other SMB-priced options.

It also fits a lean IT team at a 150-person software company that wants SSO through Entra ID or Okta and is willing to pay the $6 Enterprise rate to get it, along with enterprise policies, self-hosting flexibility and a free Bitwarden Families subscription for each employee.

A third fit is an MSP managing 60 client tenants that wants a free-to-join provider portal with consolidated billing and no platform fee (bitwarden.com/blog/secure-password-management-for-msps/). Bitwarden reported 97% year-over-year growth in MSP-managed seats and 62% more onboarded organizations in 2025, evidence the program is actively used at that scale.

Compliance-driven teams that need control over where vault data lives also fit, since the self-hosted server is open source and free to run, with US or EU cloud regions available for teams that prefer not to self-host.

Who should not buy Bitwarden

Teams that need a contractual, published support response-time SLA should look elsewhere: Bitwarden does not publish one for any paid plan (see Support below).

Organizations that need FedRAMP or GovCloud-level authorization should not shortlist Bitwarden on that basis. Its published compliance set is SOC 2 Type II, SOC 3 and ISO 27001; a FedRAMP authorization is not listed on Bitwarden's own compliance or audit pages.

Teams that want self-hosting without any ongoing vendor billing relationship should also look elsewhere, or consider LastPass alternatives that include fully license-free self-hosted options. Bitwarden's self-hosted server code is free, but organization and sharing features on a self-hosted instance still need an active paid Teams or Enterprise license, retrieved from the cloud billing account and reapplied within 60 days of each renewal (bitwarden.com/help/licensing-on-premise/).

Teams that want to avoid that recurring dependency often look at Vaultwarden instead, an unofficial, fully free self-hosted server. It has no SCIM support and only added SSO (OIDC only, no SAML) in August 2025, with no vendor support behind it (github.com/dani-garcia/vaultwarden).

Anyone comparing self-hosted Kubernetes deployments should also read the August 2026 disclosure covering Helm chart installs before making that decision; see Security and reliability record below.

Features that matter

Security architecture and independent assurance

Bitwarden documents a zero-knowledge encryption model and publishes third-party audit reports. Its 2025 audit slate includes:

• Cure53 assessments of the browser extension and autofill overlay, the core application, the desktop application and the web vault
• A cryptography report from the Applied Cryptography Group at ETH Zurich
• A mobile app assessment by Unit 42 (Palo Alto Networks)
• A web app and network assessment by Fracture Labs (bitwarden.com/help/is-bitwarden-audited/)

Bitwarden also holds SOC 2 Type II, SOC 3 and ISO 27001 certifications, with reports available on request.

SSO, MFA and directory integration

SSO (SAML or OIDC) is Enterprise-only, with named guides for Entra ID, Okta, OneLogin, Duo, Ping Identity, Auth0, AWS, Cloudflare Zero Trust, Google, JumpCloud, Keycloak and ADFS, plus generic SAML and OIDC for unlisted providers (bitwarden.com/help/about-sso/).

SCIM directory sync, by contrast, is available on both Teams and Enterprise, documented for Entra ID, Okta, Google Workspace, OneLogin and Ping Identity (bitwarden.com/help/directory-sync/).

Admin controls and policy enforcement

Teams and Enterprise organizations get these admin policy controls:

• Master password, two-factor enforcement, password generator, vault timeout and Send options policies
• An SSO-required policy (Enterprise only)
• Custom roles, collections-based access control and groups for role-based access
• Access Intelligence for weak, reused and exposed password remediation (Enterprise only)

Secure sharing and vault structure

Sharing works through collections with group and individual permission levels, plus Bitwarden Send for one-time secure sharing outside the vault. Passkeys can be stored and shared the same way as passwords.

Reporting, audit logs and breach monitoring

Event logs are available on Teams and Enterprise for tracking admin and member actions. Access Intelligence, Bitwarden's weak, reused and exposed password reporting, is an Enterprise-only feature.

Deployment options and platform coverage

Apps cover Windows, macOS, Linux, iOS, Android and a CLI, plus browser extensions for Chrome, Firefox, Edge, Safari, Brave, Opera and Vivaldi (bitwarden.com/products/). Cloud data residency is a US or EU regional choice made at account creation; Bitwarden states it cannot migrate an account between regions, so moving later means exporting data and creating a new account in the target region (bitwarden.com/help/server-geographies/). Bitwarden does not publish guidance for managed deployment through Intune, Jamf or GPO specifically; that is not documented on the pages reviewed.

API, CLI and developer secrets

A public API and CLI support automation. Bitwarden's published pages do not state a specific API rate limit or restrict CLI access by plan tier.

MSP and multi-tenant support

The Provider Portal is free to join with no platform fee and no minimum seat requirement, offering consolidated billing across client organizations (bitwarden.com/blog/secure-password-management-for-msps/).

Day-to-day admin and scale

Rollout starts with creating an organization under the owner's account, then inviting members by email or provisioning them through SCIM. For SCIM-connected directories, adding or removing a user in Entra ID or Okta automatically invites or revokes their Bitwarden access, which removes a manual offboarding step for admins (bitwarden.com/help/microsoft-entra-id-scim-integration/).

Bulk actions run through collections and groups rather than a single organization-wide toggle: admins assign members to groups, then grant collection-level permissions to the group. This scales reasonably for a few dozen groups but adds setup work for large, deeply segmented organizations. RBAC granularity comes from custom roles plus collection permissions rather than a fully custom policy builder.

Reporting is limited to event logs (who did what, when) on Teams and Enterprise, and Access Intelligence's weak, reused and exposed password findings on Enterprise. There is no published API rate limit, bulk provisioning limit or SCIM sync interval on the pages reviewed; treat those as not documented rather than unlimited.

Self-hosted organizations must also reapply their license within 60 days of each cloud billing renewal or the instance is disabled, an ongoing task for the admin to track (see Who should not buy Bitwarden above).

The fine print

Licensing tiers and feature gates: Free (individual, unlimited passwords and devices, basic sharing with one other user), Teams ($4/user/month annual, centralized ownership, secure sharing, event logs, SCIM, 2FA policies), Enterprise ($6/user/month annual, adds SSO, enterprise policies, self-hosting flexibility, Access Intelligence, a free Bitwarden Families subscription per employee).

SSO/SCIM plan requirements: SSO is Enterprise-only. SCIM is available on Teams and Enterprise.

Agent or extension footprint: Browser extensions plus native desktop and mobile apps; Bitwarden does not publish a separate background agent beyond the browser extension and app processes.

API access by plan: A public API and CLI exist; access is not stated as plan-gated on the pages reviewed.

Key integrations: SSO and SCIM cover Entra ID, Okta, Google Workspace, OneLogin, Ping Identity, Duo and others; Intune, Jamf or GPO-managed deployment is not documented.

Data residency and hosting regions: US or EU, chosen at account creation and not migratable directly between regions.

Compliance reports: SOC 2 Type II, SOC 3 and ISO 27001, available on request.

MSP multi-tenancy: Free-to-join Provider Portal, no platform fee, no minimum seats, consolidated billing.

Trial realities: 14-day trial for Teams and Enterprise organizations; Bitwarden's help pages describe billing starting when the trial ends, meaning a payment method is required to start (bitwarden.com/help/enterprise-free-trial/).

Contract terms: Teams and Enterprise are billed annually with no published month-to-month option; subscriptions auto-renew unless canceled; a specific minimum seat count is not published on the pages reviewed.

Support

Bitwarden states support is available 24/7/365 for paid plans, through a ticket-based support portal and email, with priority support called out for Premium, Teams and Enterprise customers (bitwarden.com/products/business-support/). Enterprise adds a dedicated account manager with onboarding and change-management guidance. Free-tier and individual users get community forum access instead of ticketed support. Bitwarden does not publish a response-time SLA for any paid tier.

Exit and lock-in

Vaults export as .json (plaintext, including cards, identities, passkeys and SSH keys), .csv (logins and notes only), encrypted .json, or a .zip with attachments (bitwarden.com/help/export-your-data/). Organization-level exports are restricted to admins, owners and some custom roles; members can export only the collections they have permission to see.

Canceling a subscription does not delete the account or organization immediately. Access to paid features ends when the subscription expiration date is reached, and Bitwarden's cancellation documentation does not describe an automatic deletion timeline separate from that (bitwarden.com/help/cancel-a-subscription/). Export before a subscription lapses; Bitwarden's own guidance does not commit to a grace period for exporting after expiration.

Self-hosting keeps the underlying data on infrastructure the customer controls, which is the strongest exit position Bitwarden offers, though organization features on that self-hosted instance still depend on a valid paid license as covered in the fine print above.

Bitwarden pricing

Pricing note: figures below are per Bitwarden's pricing page, checked September 17, 2026.

Bitwarden's pricing page does not publish a minimum seat count for either paid plan or a month-to-month billing option; Teams and Enterprise are billed annually only.

What Bitwarden costs for your team

Both plans are billed annually, so the yearly cost is the per-user monthly price multiplied by 12 and by your seat count.

Watch out: SSO sits on Enterprise only, so a 10-person team that needs Entra ID or Okta sign-in pays $720 a year instead of $480, a difference of $240 driven entirely by the SSO requirement, not seat count.

Costs beyond the license

Bitwarden's pricing page does not list separate add-on charges for SCIM, event logs or Bitwarden Send; those are included in the Teams and Enterprise prices above. It also does not publish infrastructure costs for self-hosting, since that depends on the customer's own server or cloud spend.

MSP partners can negotiate volume pricing through the free Provider Portal, but Bitwarden does not publish specific discount percentages on its public pricing pages.

Free plan and trial

The Free plan is built for individuals: unlimited passwords and devices across apps, with basic sharing limited to one other user. It is not a business or organization plan. Teams and Enterprise organizations instead get a 14-day free trial; Bitwarden's help documentation says billing starts once the trial ends, which means a payment method is required to begin the trial (bitwarden.com/help/enterprise-free-trial/, bitwarden.com/help/upgrade-from-individual-to-org/).

Renewal pricing

Teams and Enterprise subscriptions renew automatically at the published annual rate unless canceled; Bitwarden's documentation does not describe a separate first-year promotional rate for business plans. Bitwarden raised its individual Premium plan price from $9.99 to $19.80 per year in January 2026, but Free, Teams and Enterprise published per-seat prices were reported unchanged at the same time, according to a Bitwarden marketplace listing on Vendr.

Pricing note: Vendr, a third-party software spend-benchmarking service, reported that actual SMB spend on Bitwarden rose about 3.45% year over year and enterprise spend rose about 5.74%, even as list price per seat held steady, pointing to volume or contract changes rather than list-price increases (vendr.com/marketplace/bitwarden, checked September 17, 2026). This is a third-party spend report, not a Bitwarden-published figure.

For how that stacks up against other vendors at the same seat counts, see the business password manager pricing index.

Security and reliability record

Bitwarden does not publish an uptime figure for its cloud service on the pages reviewed for this article.

Bitwarden vs the alternatives

Bitwarden's Enterprise plan, at $6 per user per month, sits below 1Password Business ($8.99) and matches Keeper Enterprise ($6), while offering self-hosting that neither 1Password nor NordPass publishes. See 1Password vs Bitwarden for Business for a full criteria-by-criteria comparison, and 1Password Business pricing explained for 1Password's plan breakdown.

Bottom line

Choose Bitwarden Teams if your team needs SCIM-based offboarding on a tight budget and does not need SSO. To score it against your own requirements rather than this verdict, start from the shortlist builder or the wider password management category hub. Choose Enterprise if SSO through Entra ID, Okta or another IdP is a requirement, since that moves you to the higher-priced plan covered above. Look elsewhere if you need a published support SLA or FedRAMP-level compliance backing your purchase decision. For a full criteria comparison against the plan that includes SSO on a lower tier, see 1Password vs Bitwarden for Business.