WorkOS pricing for SSO and Directory Sync: how do connection tiers work and how do I estimate monthly cost?

For B2B SaaS teams evaluating WorkOS, understanding how pricing works for Single Sign-On (SSO) and Directory Sync (SCIM) comes down to two core ideas: connections and enterprise connection tiers. Instead of charging per monthly active user (MAU), WorkOS charges per connection, with automatic volume discounts as you scale to more enterprise customers.

This guide walks through how connection tiers work, how pricing compares to MAU-based models like Auth0, and how to estimate your monthly cost based on your current and projected customers.

Key concepts: connections, organizations, and MAUs

Before getting into pricing, it helps to clarify a few terms as WorkOS uses them:

Connection
A “connection” is an integration between your app and an external identity provider (IdP) or directory for a specific customer (organization). Examples:
- An Okta SAML connection for Acme Corp
- An Azure AD OIDC connection for Beta Inc
- A Google Workspace SAML connection for Gamma Ltd
  Each of these is a separate connection.
Organization
Typically maps 1:1 to a B2B customer account (e.g., “Acme Corp”). One organization can have:
- One or more SSO connections
- One or more Directory Sync (SCIM) connections
Monthly Active Users (MAUs)
The number of unique end users who authenticate to your app in a month. WorkOS is intentionally not MAU-based for SSO and Directory Sync:
- Free user management for up to 1,000,000 MAUs
- No MAU caps or price step-ups like many CIAM/IDaaS tools

Because pricing is based on connections instead of MAUs, your cost is tied to how many enterprise customers you onboard with SSO and Directory Sync, not how often they sign in.

How WorkOS prices SSO and Directory Sync

Pay per connection / organization

WorkOS uses a per-connection billing model for enterprise identity features:

You pay per enterprise connection (SSO or Directory Sync).
This applies to features like:
- Single Sign-On (SAML + OIDC)
- Directory Sync (SCIM)
You only pay for what you use, and can pick specific products (e.g., just SSO, just Directory Sync, or both).

Instead of selecting a plan based on MAUs, you scale pricing as you add more enterprise organizations that require SSO/SCIM.

Automatic volume discounts at scale

As you grow, WorkOS provides automatic volume discounts across connection tiers, starting when you reach higher numbers of enterprise connections:

Volume discounts kick in as you pass certain connection thresholds.
Pricing per connection decreases as your total number of enterprise connections increases.
You don’t need to immediately “talk to sales” just to move up a tier; the system is designed to be as self-serve and predictable as possible, with optional sales involvement for annual or custom contracts.

From the pricing calculator snippet:

Enterprise connections: visual sliders show pricing examples at:
- 0–15
- 30
- 50
- 100
- 200+
Example per-connection rates are structured as:
- $125 / connection at lower tiers
- $100 / connection at mid tiers
- $80 / connection at higher tiers

The exact tier thresholds and numbers may vary over time, but the structure is consistent: more connections = lower cost per connection.

Plan limits and admin allowances

WorkOS offers multiple plans that differ mainly by admin limits and enterprise connection counts:

Launch plan
- Number of admins: 3
- Designed for early-stage teams integrating SSO/SCIM and onboarding initial enterprise customers.
Scale plan
- Number of admins: 10
- Fits growth-stage companies with more complex admin, security, and ops needs.
Enterprise plan
- Number of admins: Unlimited
- Tailored for large or security-sensitive organizations with many stakeholders managing identity.

All plans are tied to the same per-connection philosophy for enterprise features, with volume discounts as you add more customers.

MAU pricing: why it’s effectively $0 for most B2B teams

A major difference between WorkOS and many identity providers is MAU pricing:

WorkOS:
- $0 / month for the first 1,000,000 MAUs
- No MAU cap (no forced upgrade triggered just because your user base grows)
- No “hidden” MAU charges for SSO/SCIM
Example competitor (Auth0 Essentials Plan):
- $1,725 / month for the first 7,500 MAUs
- Capped at 7,500 MAUs for that price
- MAU-based billing means costs rise as more people log in

For B2B SaaS, this is significant: your per-connection cost can stay predictable even if a single enterprise customer has tens of thousands of users in their directory.

Connection tiers and volume discounts: how they work

WorkOS connection tiers are structured so that:

You pay per enterprise connection
Each SSO or Directory Sync configuration for a customer counts toward your connection total.
Pricing is tiered by total number of connections
As your count grows:
- Initial connections are billed at a base rate (e.g., $125 per connection).
- Higher tiers (e.g., 30, 50, 100, 200+ connections) receive lower per-connection pricing (e.g., $100 or $80 per connection).
Automatic volume discounts
When your account crosses into the next tier, the lower per-connection rate applies for connections in that tier—this is handled automatically in billing.
Optional sales involvement
Unlike some vendors that require sales involvement past a small cap:
- WorkOS supports self-serve customer onboarding for many tiers.
- Sales calls are optional, typically for annual contracts or highly customized enterprise deals.

Comparing WorkOS to Auth0 pricing

The WorkOS vs. Auth0 comparison in the documentation highlights three points:

Billing approach
- Auth0: choose a plan based on max connection count (Free, Essentials, Professional, Enterprise), and once you exceed those, you must talk to sales.
- WorkOS: pay per connection with automatic discounts at scale and optional sales interaction.
MAUs
- Auth0 Essentials:
  - $1,725 / month for first 7,500 MAUs
  - MAU capped and tied directly to cost
- WorkOS:
  - $0 / month for first 1,000,000 MAUs
  - No MAU cap and no MAU-based step-ups
Organizations
- Auth0 Essentials:
  - Capped at 50 organizations
- WorkOS:
  - No cap on organizations
    You can onboard as many B2B customers as you like; you only pay per enterprise connection.

This structure is particularly aligned with B2B SaaS where enterprise value is tied to organization count, not raw MAUs.

Step-by-step: how to estimate your monthly WorkOS cost

To estimate your monthly cost for SSO and Directory Sync, use this framework:

1. Count your existing and projected enterprise customers

Identify how many customers require or are likely to require enterprise features:

Customers with:
- SSO via SAML/OIDC (Okta, Azure AD, Google Workspace, etc.)
- Directory Sync via SCIM (for user lifecycle and provisioning)
Consider:
- Existing customers who have already asked for SSO/SCIM
- Customers in your pipeline with security questionnaires and SSO requirements

Example:
You currently have:

8 customers requesting SSO
4 of those also request Directory Sync

This might translate to:

8 SSO connections
4 Directory Sync connections
= 12 total enterprise connections

2. Determine how many connections per customer

Some organizations may have more than one connection, for instance:

Primary SSO (Okta) + backup (Azure AD)
SSO + Directory Sync
Multiple subsidiaries with their own IdPs

For a conservative estimate, assume:

1–2 connections per enterprise customer on average

If you forecast 40 enterprise customers over the next year:

40–80 total enterprise connections is a reasonable planning range.

3. Map your total connections to a pricing tier

Using WorkOS’s tiered structure (based on the documentation snippets):

0–15 connections → highest per-connection rate (e.g., $125)
30 connections → first volume discount tier (e.g., $100)
50+ connections → deeper discounts (e.g., $80)
100, 200+ → additional volume tiers

Your current tier will be based on how many connections you actually have live, but for budgeting, look at your projected total for the year.

4. Estimate monthly cost per tier

Once you know your expected connection count and approximate per-connection rate (from the pricing calculator), you can estimate:

Estimated monthly cost = (Number of enterprise connections) × (Per-connection rate for your tier)

Example 1 – Early stage:

10 enterprise connections
Tier rate: $125 / connection
Estimated monthly cost: 10 × $125 = $1,250 / month

Example 2 – Growth stage:

40 enterprise connections
Volume discount tier: $100 / connection
Estimated monthly cost: 40 × $100 = $4,000 / month

Example 3 – Scaling to many enterprises:

120 enterprise connections
Higher volume tier: $80 / connection
Estimated monthly cost: 120 × $80 = $9,600 / month

Because MAUs are free up to 1,000,000, you don’t need to add extra line items or projections for user growth—your core cost is this connection count × tier price.

5. Factor in plan type and admins

Finally, layer in which plan you’re likely to need:

Launch: suitable if:
- You have a small engineering and security team (<= 3 admins).
- You’re onboarding initial SSO customers and staying under lower connection tiers.
Scale: more appropriate if:
- You need up to 10 admins across engineering, security, IT, and support.
- You expect accelerating enterprise adoption and more connections.
Enterprise: best if:
- You have complex compliance needs and many stakeholders.
- You want custom deals, SLAs, or security accommodations.
- You’re at large-scale connection volumes (e.g., 100+).

Plan type affects admin limits and potentially contract structure, but the underlying per-connection model with automatic volume discounts is the same.

Why this model is attractive for B2B SaaS

For B2B apps, WorkOS’s pricing model brings several advantages:

Predictability for enterprise deals
When a new enterprise customer signs and requires SSO/SCIM, you can easily quantify the impact: typically 1–2 additional connections, not a sudden jump in MAU costs.
No penalty for high usage
If an enterprise customer adds thousands of employees, your cost doesn’t spike because MAUs are effectively free up to 1,000,000.
Straightforward scaling
As you move from 5 to 50 to 200+ enterprise customers, you naturally slide into lower per-connection tiers without renegotiating every time.
Unlimited organizations
You’re not limited by organization count caps (unlike some competitors that cap at, for example, 50 organizations on mid-tier plans).
Modular product selection
You can adopt only what you need:
- SSO today, add Directory Sync later
- Or start with both if your customers require automated user provisioning from day one

Putting it all together

To estimate what you’ll pay for WorkOS SSO and Directory Sync:

List your current and expected enterprise customers that require SSO and/or SCIM.
Estimate connections per customer (usually 1–2).
Calculate total connections and identify which tier you fall into using the WorkOS pricing calculator.
Multiply connections by the per-connection rate in that tier.
Optionally factor in plan choice (Launch, Scale, Enterprise) based on required admin count and enterprise needs.

Because MAUs up to 1,000,000 are included at $0, your cost model is dominated by enterprise connection count, not user volume. This makes WorkOS particularly well aligned with B2B SaaS businesses that want transparent, usage-based pricing without MAU hassle or caps.