What Duende IdentityServer costs a multi-tenant SaaS in 2026, and the alternatives

If you run a multi-tenant B2B SaaS on .NET, your customers are organizations, some will ask for SSO with their own identity provider, and sooner or later someone asks what the identity server costs. For many .NET teams that server is Duende IdentityServer. This post sets out what Duende charges in 2026 for that shape of product, then looks at four alternatives: OpenIddict, Keycloak, Microsoft Entra External ID and Auth0.

A note on fairness first. This is written by the team that builds Vord, which is one of the options at the end. Identity pricing changes often, so every price and licence statement below is quoted from the vendor's own page, with the link and the date we read it. If a number matters to your decision, open the link and check it again.

Duende IdentityServer: the 2026 price list

Duende publishes four plans, all "Billed annually" (source: duendesoftware.com/pricing, as of 2026-10-08):

The same page defines a deployment: "A single deployment acts as a single OpenID Connect / OAuth authority hosted at a single URL."

Add-ons are priced separately on that page (as of 2026-10-08): Automatic Key Management "$2,000/year", SAML "$4,000/year", Financial-Grade Security & Conformance "$1,500/year", and Multi-Tenancy "$7,500/year". Duende describes Multi-Tenancy as: "Serve isolated tenants and multiple issuer URLs from a single deployment. Multi-issuer support: a distinct OIDC issuer per context, fully spec-compliant. Spaces, now in preview, brings native .NET multi-tenancy: isolated users, configuration, and clients per space."

Which add-ons you can buy changed on 2 June 2026

The pricing FAQ answers "Can existing customers use add-ons without changing their plan?" with (as of 2026-10-08): "Yes. Customers with plans purchased before June 2, 2026 can add any available add-on while keeping their historical plan. This exception applies only to historical plans. Customers purchasing a plan on or after June 2, 2026 can only use add-ons available with their selected plan."

So since 2 June 2026, a new buyer's plan decides which add-ons are available. On the plan cards above, Multi-Issuer appears only on Advanced.

What multi-issuer tenancy costs a new buyer

Our arithmetic, not a Duende quote: a team buying today that wants a distinct issuer per tenant from one deployment needs Advanced plus the Multi-Tenancy add-on, which is $24,900 + $7,500 = $32,400 per year at list price (prices from duendesoftware.com/pricing, as of 2026-10-08). A team that needs more than 30 client IDs or more than two production deployments moves to Custom, which has no published price.

You do not need multi-issuer to run a multi-tenant SaaS. Many teams use one issuer and carry the tenant in a claim. If that works for you, the relevant numbers are the plan prices and the client ID limits in the table.

The Community Edition, and why it may not cover a SaaS

Duende's Community Edition is free for qualifying organizations. The eligibility rule reads (source: duendesoftware.com/products/communityedition, as of 2026-10-08): "If you're a for-profit with under $1M USD projected annual gross revenue and under $3M USD in capital access, or a non-profit or registered charity with a published annual budget under $1M USD, you qualify." The same page says it "is mostly feature-equivalent to the Standard Edition", and that "Evaluation, development, test environments, and personal projects do not require a license."

The limit that matters for a SaaS is in the FAQ. "Can I use Community Edition to build software I sell to other companies?" is answered: "No. Community Edition is for running IdentityServer on your own infrastructure for your own use. Redistribution and customer-facing deployments require different licensing." Read literally, a B2B product whose customers sign in through your IdentityServer looks like the case that answer describes. If you are relying on the Community Edition for a SaaS, get Duende's answer for your situation in writing.

OpenIddict: a library, so you build the server

OpenIddict describes itself as "a free and open source framework for building flexible and standard-compliant OAuth 2.0/OpenID Connect clients and servers in .NET" (source: documentation.openiddict.com/introduction, as of 2026-10-08). It is licensed under the Apache License 2.0 (source: openiddict-core LICENSE.md, as of 2026-10-08), so there is no licence fee at any revenue.

The project is direct about what that means. Its README says "OpenIddict is not a turnkey solution but a framework that requires writing custom code to be operational (typically, at least an authorization controller)" (source: openiddict-core README, as of 2026-10-08), and the introduction says it "exclusively focuses on the OAuth 2.0/OpenID Connect protocol aspects of the authorization process and leaves user authentication up to the implementer."

For a multi-tenant SaaS, OpenIddict gives you the protocol layer. Login and registration UI, organizations, invitations, per-customer SSO, SCIM and admin screens are yours to build and maintain. The README points developers who want "a simple and turnkey solution" to Volo.OpenIddict.Pro, a commercial ABP module with "a powerful applications/scopes management GUI."

Keycloak: a full server you operate

Keycloak is an open source identity and access management server, licensed under the Apache License 2.0 (source: keycloak LICENSE.txt, as of 2026-10-08). Its home page lists single sign-on, identity brokering with "existing OpenID Connect or SAML 2.0 Identity Providers", LDAP and Active Directory federation, and an admin console (source: keycloak.org, as of 2026-10-08).

For B2B, Keycloak has an Organizations feature, which "enables multi-tenancy within a realm so that users can have access to protected resources from a realm but with a more restricted and controlled context, that context being the organization to which they belong" (source: Keycloak Server Administration Guide, as of 2026-10-08).

The trade-off for a .NET team is the runtime. Keycloak is a Java server: the zip getting-started guide says "Make sure you have OpenJDK 25 installed" (source: keycloak.org/getting-started/getting-started-zip, as of 2026-10-08). You get a complete product with no licence fee, and you take on running, upgrading and extending a JVM service next to your .NET stack.

Microsoft Entra External ID: hosted, billed per monthly active user

Entra External ID is Microsoft's hosted customer identity service. Microsoft's pricing page says (source: microsoft.com Entra External ID pricing, as of 2026-10-08): "The Microsoft Entra External ID Basic tier includes the first 50,000 Monthly Active Users (MAU) at no cost." Premium add-ons, such as SMS phone authentication and ID Governance for External Identities, are billed on top. Microsoft's billing overview adds that "External ID requires an Azure subscription for billing" (source: learn.microsoft.com External ID pricing, as of 2026-10-08).

Above 50,000 MAU you pay per monthly active user. The pricing page does not print that rate, so check it in Azure's pricing calculator for your region before you compare.

Auth0: hosted, with Organizations as the B2B model

Auth0's pricing page has a B2C/B2B toggle. In the default view served in the raw page (B2C, monthly), the Free plan lists "Up to 25,000 monthly active users", "5 Organizations", "1 Enterprise Connection", "Self-Service SSO" and "SCIM". The Essentials plan shows "$35 / month" for "Up to 500 monthly active users", with the footnote "Upgrade to B2B to continue using EC, Self-Service SSO, and SCIM." (source: auth0.com/pricing, as of 2026-10-08). Auth0 describes Organizations as "how we model your business customers."

With the B2B toggle selected, monthly billing and 500 monthly active users, the page shows Essentials at "$150 / month" with "Unlimited** Organizations" and "3 SSO Enterprise Connections", and Professional at "$800 / month" (source: auth0.com/pricing, B2B view, as of 2026-10-08). Both prices rise with the monthly active user count you select.

For a B2B SaaS, the B2B plans are the relevant ones, and Enterprise, with "Custom User & SSO Tiers", is priced through sales. Auth0 and Entra both remove the operations work entirely. In exchange, your users live in a vendor's tenant, and cost grows with monthly active users.

A summary

(Prices as quoted above, from each vendor's page, as of 2026-10-08.)

One more option: Vord

Vord is the identity service we build, and it is in early access, releasing 1 December 2026. It is aimed at the gap between the rows above: a .NET-native server with the B2B parts already built, which you can use hosted or run yourself.

• It is built on OpenIddict for the protocol layer and ASP.NET Core Identity for the user store, so it is .NET all the way down.
• Organizations, memberships with Owner, Admin and Member roles, and invitations are part of the product.
• Enterprise SSO is per organization: upstream SAML or OIDC connections, users created on their first SSO sign-in, group-to-role mapping, and an option to force SSO for a connection.
• A SCIM 2.0 endpoint for user and group provisioning.
• Self-hosting with a Docker Compose quickstart or a Helm chart, with a signed licence that is validated offline.

Vord is not a drop-in IdentityServer replacement: it is a different server, so moving to it means pointing your clients at a new authority. It is also new, and it has no track record yet. If that matters for your procurement, weigh it.

If you want to try it before the release, join the early-access list.

Sources

All pages read on 2026-10-08 from the raw HTML or raw files:

• duendesoftware.com/pricing
• duendesoftware.com/products/communityedition
• documentation.openiddict.com/introduction
• github.com/openiddict/openiddict-core (README and LICENSE.md)
• keycloak.org, Keycloak getting started (zip), Keycloak Server Administration Guide, github.com/keycloak/keycloak (LICENSE.txt)
• Microsoft Entra External ID pricing, External ID pricing and billing overview
• auth0.com/pricing