# Auth Platforms With SSO and SCIM in the Base Tier - Part 2

> Part 2 of 2. Start with [Auth Platforms With SSO and SCIM in the Base Tier](https://clerk.com/articles/auth-platforms-with-sso-and-scim-in-the-base-tier.md).

This is Part 2 of a two-part series on auth platforms that include enterprise SSO and SCIM in their base tiers. In Part 1, we covered the core concepts, the shifting pricing landscape from the "SSO tax" to the "SCIM tax", and a high-level comparison matrix. In this part, we provide detailed provider-by-provider breakdowns, calculate total cost of ownership (TCO) with worked examples, and offer a decision framework to help you choose the best provider for your B2B SaaS.

## Provider-by-provider breakdown

The core six get full profiles; the developer-first options are summarized at the end. Each profile gives positioning, base or free tier, SSO and SCIM status, pricing model, per-connection treatment, and an honest "where it wins / where it doesn't."

### Clerk

Developer-first customer identity with predictable subscription pricing and SCIM bundled free on every enterprise connection.

The free Hobby tier includes 50,000 MRUs but does not include production enterprise SSO or SCIM (Clerk notes that "all of our Pro tier features are available to try in the development instance of your application," so you can test enterprise connections in development). Production enterprise connections require the Pro (base paid) or Business plan.

Pro is $25/mo ($20/mo annual) and includes 1 enterprise connection. The exact line item on the pricing page is "Enterprise connections (EASIE/SAML/OIDC)." Additional connections are $75/mo each for connections 2 through 15, then $60 (16–100), $30 (101–500), and $15 (500+). SSO covers SAML (Entra ID, Google Workspace, Okta Workforce, custom) and OIDC/EASIE.

SCIM (Directory Sync) is included free with each enterprise connection. It went generally available on [April 16, 2026](https://clerk.com/changelog/2026-04-16-directory-sync.md), with group-to-role mapping and custom attribute mapping following on [May 21, 2026](https://clerk.com/changelog/2026-05-21-directory-sync-groups-attributes-ga.md). In Clerk's words, "Directory Sync, including groups and custom attributes mapping, is included with your enterprise connection at no extra charge." It follows the SCIM 2.0 protocol, ships documented setup guides for Okta and Microsoft Entra ID, and revokes a user's active sessions immediately when they're deactivated in the IdP. Compatibility with other IdPs should be confirmed with Clerk: the docs note that "your identity provider (and how you configure it) may not match Clerk's implementation completely" and point you to Clerk's team for compatibility issues, so this isn't a self-serve "any IdP" promise.

Business is $300/mo ($250/mo annual); Enterprise is custom. The B2B Authentication "Enhanced" add-on is $100/mo ($85/mo annual).

Where Clerk wins: there's no per-connection SCIM surcharge, SSO connection pricing is flat with volume discounts, and the cost stays predictable as you scale. Where it's narrower: the SCIM provider list documented today (Okta and Entra ID) is shorter than WorkOS's 12+, and Clerk is SaaS-only with no self-hosting. See [enterprise connections](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/overview.md), [Directory Sync](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/directory-sync.md), [pricing](https://clerk.com/pricing), and [B2B billing](https://clerk.com/docs/guides/billing/for-b2b.md).

### Auth0 (Okta Customer Identity)

A mature customer identity platform, Okta-owned, that [reworked its B2B plans on February 12, 2026](https://auth0.com/blog/auth0-b2b-plans-upgraded/) to put 1 SSO connection plus SCIM on the free tier.

B2B Free is $0 for up to 25,000 MAU and includes 1 enterprise connection, Self-Service SSO, and SCIM (all marked "NEW" on the pricing page). It also allows unlimited Okta Workforce enterprise connections that don't count against the limit.

The paid B2B tiers are static line items on the [pricing page](https://auth0.com/pricing) (there's no calculator). B2B Essentials starts at $150/mo and includes 3 enterprise SSO connections; B2B Professional starts at $800/mo and includes 5; additional connections are $100/mo ($1,100/yr) each, capped at 30 total. Those "from" prices are MAU-tier floors, not the price at a given user count. The page also publishes a static "B2B Base Price by MAUs" table: at 500 MAU the base is $150 (Essentials) or $800 (Professional); at 10,000 MAU it's $2,100 or $2,400; the table tops out at 20,000 MAU ($3,800 Essentials, Professional "Contact us"), and 30,000+ MAU routes to contact sales for both. B2C Essentials starts at $35/mo and B2C Professional at $240/mo, with no enterprise connections (enterprise SSO is B2B-only). Auth0 renders these pricing tables client-side and revises its B2B plans periodically, so reconfirm the live figures in Auth0's pricing UI before budgeting.

Auth0's inbound SCIM requires an enterprise connection, which the Free tier now provides. It provisions both users and groups: the [docs](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim) document SCIM 2.0 operations for managing users and groups, and group provisioning reached general availability in June 2026, letting you map synced groups to Auth0 roles at the tenant level or scoped to a specific organization.

Where Auth0 wins: it genuinely offers SSO plus SCIM (users and groups) at $0, with a mature ecosystem. Where it's limited: the free tier is 1 connection on the B2B product, per-MAU base pricing climbs steeply (Essentials is $2,100/mo at 10,000 MAU), and scaling past Professional's 5 connections or the 30-connection ceiling means an enterprise quote. Third-party analyses describe sharp bill increases at scale and cost as a common migration trigger; treat those as illustrative context rather than primary Auth0 facts.

### Okta Workforce Identity

Enterprise workforce IAM for securing your own employees and internal directories. It's a different tool class from the customer-facing CIAM products in this guide: per-user, not per-connection, and aimed at your workforce rather than your app's B2B customers.

Okta is annual-only with a $1,500/yr minimum and [prices by suite](https://www.okta.com/pricing/), per user per month: Starter $6 (Single Sign-On, MFA, Universal Directory), Core Essentials $14, and Essentials $17. The higher suites add Lifecycle Management — Okta's SCIM provisioning — and Adaptive MFA, none of which are in the entry $6 Starter suite, so automating provisioning means stepping up to a higher suite. Okta doesn't publish standalone per-product (à-la-carte) prices on its pricing page; those require a sales quote, and real-world spend climbs well past the $1,500/yr floor once you add seats and the higher suites.

Where Okta fits: you need a workforce IdP, or you're already standardized on Okta. Where it doesn't: it's the wrong frame for "include SSO in your app's base tier for B2B customers." It's treated here as distinct from Auth0 despite shared ownership.

### WorkOS

B2B enterprise readiness as a standalone, pay-per-connection layer: SSO, Directory Sync (SCIM), and audit logs, sold as building blocks rather than a full CIAM.

AuthKit (the user-management layer) is free to 1,000,000 MAU, then $2,500 per additional million. [SSO is $125/connection](https://workos.com/pricing) (1–15), with volume discounts down to $100 (16–30), $80 (31–50), $65 (51–100), and $50 (101–200); 201+ is custom. Directory Sync (SCIM) is billed separately on the same per-connection schedule, so one customer who needs both SSO and SCIM counts as two connections (roughly $250/mo minimum for that customer). A custom domain is $99/mo. WorkOS [supports both SAML and OIDC](https://workos.com/sso) and advertises [12+ directory providers](https://workos.com/directory-sync), including Microsoft Entra ID, Okta, Google Workspace, BambooHR, Hibob, Workday, OneLogin, JumpCloud, Rippling, and PingFederate.

Where WorkOS wins: it's the strongest choice when you want SSO and SCIM as a standalone bolt-on with the broadest directory support and don't want a full CIAM, or when you have a few enterprise customers with high MAU (AuthKit is free to 1M). Where it costs more: the per-connection model compounds when you have many enterprise customers, and the SSO-plus-SCIM double-charge is real. This is the clearest "a competitor wins here" case in the guide.

### Supabase Auth

Auth bundled with the Supabase Postgres stack. Viable for SSO-only at small scale, not for SCIM.

The [tiers](https://supabase.com/pricing) are Free $0 (50,000 MAU), Pro $25/mo (100,000 MAU), Team $599/mo, and Enterprise (custom). [App SSO is SAML 2.0 only](https://supabase.com/docs/guides/auth/enterprise-sso/auth-sso-saml) (no OIDC) and requires Pro or higher; you get 50 SSO-MAU free, then $0.015 per SSO-MAU. There's no native SCIM at any tier. Two gotchas stand out: ["dashboard SSO"](https://supabase.com/docs/guides/platform/sso) (logging into Supabase itself) requires the Team plan ($599/mo) or higher and is easy to confuse with app SSO, and SSO users can't be linked to existing accounts. Single Logout isn't supported.

Honest verdict: fine for SSO-only workloads at small scale inside the Supabase ecosystem, and not recommended for teams that need SSO plus SCIM.

### Firebase Auth / Google Cloud Identity Platform

B2C-first authentication. Enterprise SSO is available only via the Identity Platform upgrade, and there's no customer-facing CIAM SCIM.

Firebase Auth on its own has no SAML or OIDC. Upgrading to Identity Platform (on the [pay-as-you-go Blaze plan](https://firebase.google.com/pricing)) adds them: the [SAML/OIDC tier](https://cloud.google.com/identity-platform/pricing) is free for the first 50 MAU, then $0.015/MAU, and the standard email/social tier is free to 50,000 MAU before dropping into per-MAU bands starting around $0.0055/MAU. There's no fixed monthly fee. There's no customer-facing SCIM; [Google's workforce SCIM](https://docs.cloud.google.com/iam/docs/workforce-identity-federation-scim) is for provisioning employees, not your app's users. Multi-tenancy exists via "tenants," but there's no first-class B2B organizations model.

Honest verdict: workable for specific SAML/OIDC use cases at small scale, and not designed for B2B enterprise SSO plus SCIM.

### Other developer-first options worth knowing

1. **[Stytch](https://stytch.com/pricing).** Free to 10,000 MAU with 5 SSO-or-SCIM connections from a shared pool; $125/connection after. The most generous free SSO + SCIM pool found.
2. **[Frontegg](https://frontegg.com/pricing).** Free to 7,500 MAU with 5 "Enterprise Connections (SSO/SCIM)" from a shared pool; per-connection overage isn't publicly disclosed.
3. **[Descope](https://www.descope.com/pricing).** Free to 7,500 MAU with 3 SSO connections. Free SCIM is disputed on Descope's own page, so don't assume it.
4. **[Kinde](https://www.kinde.com/pricing/).** Free to 10,500 MAU with 1 enterprise SSO connection; unlimited SSO on Plus ($75/mo). SCIM is listed on Scale ($250/mo) but marked "Coming soon" on Kinde's pricing page, so it isn't a live feature today.
5. **[PropelAuth](https://www.propelauth.com/pricing).** Unlimited SSO on Growth ($150/mo); SCIM on Growth Plus ($500/mo) at $100/connection.
6. **Microsoft Entra External ID.** [Free to 50,000 MAU](https://www.microsoft.com/en-us/security/pricing/microsoft-entra-external-id) with [free OIDC and SAML/WS-Fed customer authentication (both support self-service sign-up)](https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-saml-ws-federation-self-service-sign-up); [no inbound customer SCIM](https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers).

If you need more free connections than the core six offer, these are the names to weigh.

## Total cost of ownership: beyond the base tier

"Included in the base tier" can still get expensive. TCO is the real comparison, because per-connection and per-MAU models diverge sharply as you scale, and the provider that's cheapest at 2 connections is rarely cheapest at 20.

### Why TCO is the real comparison

Per-connection pricing wins when you have a few enterprise customers with high MAU, because you're not paying per user. Per-MAU plus per-connection charges compound as both grow. The model, not the sticker price, decides who's cheapest at your scale.

### Initial implementation cost

For managed providers, initial setup is small: most integrate in hours to days, and there are rarely onboarding fees for the base tiers. The detailed build-versus-buy math is in the implementation section below.

### Long-term scaling cost

This is where the models split. Per-connection providers that bill SSO and SCIM separately (WorkOS) double their per-customer cost when a customer needs both. Flat-bundled providers (Clerk, where SCIM is free per connection) don't. Per-MAU providers (Auth0) can exit self-service entirely once B2B MAU climb past the published table.

### The "cheap base tier" trap

A low base price plus per-connection or overage fees can overtake a higher flat tier fast. Auth0's per-MAU base reaching $2,100/mo at 10,000 MAU on Essentials, WorkOS's per-connection compounding, and Supabase's per-SSO-MAU overage are all examples of a cheap-looking entry point that grows.

### Worked TCO Example A: startup, 2 SSO connections, no SCIM, 10,000 MAU/MRU

| Provider                         | Calculation                                                | Est. monthly (USD)     | Notes                                                                                                                  |
| -------------------------------- | ---------------------------------------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Clerk**                        | Pro $25 + 1 extra connection ($75)                         | \~$100                 | 10,000 is under the 50,000 free MRUs; SCIM would be free if added                                                      |
| **WorkOS**                       | 2 × $125 (AuthKit free to 1M MAU)                          | $250                   | SSO only; adding SCIM would add 2 × $125                                                                               |
| **Auth0**                        | B2B Essentials base at 10,000 MAU (includes 3 connections) | \~$2,100               | From the static per-MAU table; 2 connections fall within the 3 included                                                |
| **Supabase**                     | Pro $25 + $0.015 per SSO-MAU over 50                       | \~$25–$174             | SAML only; no SCIM. Floor is the $25 Pro base; ceiling assumes all 10,000 are SSO-MAU ($25 + 9,950 × $0.015 = $174.25) |
| **Firebase / Identity Platform** | $0.015 per SAML/OIDC MAU over 50                           | \~$0–$149              | No SCIM; no base fee, so cost scales purely with SSO-MAU (all 10,000 as SSO-MAU = 9,950 × $0.015 = $149.25)            |
| **Okta**                         | Workforce per-seat, annual-only                            | N/A (wrong tool class) | \~$60k/mo if forced at 10,000 seats; not a per-connection B2B option                                                   |

At a startup's scale with a couple of enterprise customers, Clerk and WorkOS are the cheap, sensible options. Auth0's per-MAU base makes it markedly more expensive here even though SSO and SCIM are technically free on its tier below this MAU level.

### Worked TCO Example B: scaling B2B SaaS, 20 connections, all SSO + SCIM, 50,000 MAU

| Provider                         | Calculation                                                                                                            | Est. monthly (USD)           | Notes                                                                                                                                  |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **Clerk**                        | Pro $25 + connections 2–15 (14 × $75 = $1,050) + connections 16–20 (5 × $60 = $300)                                    | **\~$1,375** (SCIM included) | SCIM bundled free per connection; 50,000 MRUs at the free limit                                                                        |
| **WorkOS**                       | SSO (15 × $125 + 5 × $100 = $2,375) + SCIM (another $2,375)                                                            | **$4,750**                   | SSO and SCIM billed as separate connections                                                                                            |
| **Auth0**                        | Professional (5 conn.) + 15 add'l × $100 = $1,500 in connection add-ons; base at 50,000 MAU not in the published table | Enterprise quote             | 50,000 MAU exceeds the self-service table (tops out at 20,000; 30,000+ = contact sales); inbound SCIM here provisions users and groups |
| **Supabase**                     | n/a                                                                                                                    | Cannot (no SCIM)             | Disqualified for SCIM workloads                                                                                                        |
| **Firebase / Identity Platform** | n/a                                                                                                                    | Cannot (no SCIM)             | Disqualified for SCIM workloads                                                                                                        |
| **Okta**                         | Workforce per-seat                                                                                                     | N/A (wrong tool class)       | Per-seat workforce IAM, not per-connection B2B CIAM                                                                                    |

The takeaway: for SSO plus SCIM at scale, Clerk (\~$1,375, SCIM bundled) materially undercuts WorkOS (\~$4,750, SSO and SCIM billed separately), and Supabase and Firebase can't participate at all because they have no SCIM. That gap is driven by a real pricing-model difference, not opinion: WorkOS bills SSO and SCIM as separate connections, while Clerk bundles SCIM free on every connection.

A few assumptions to state plainly: these are list prices as of June 1, 2026; Auth0's B2B base at 50,000 MAU isn't a published self-service number, so its cell stays qualitative; Supabase and Firebase SSO cost depends on the SSO-MAU split; and Okta is per-seat workforce IAM, so it isn't directly comparable. Verify the live numbers before you commit.

## How to choose: a decision framework

Choose on three questions: do you need SCIM or only SSO, how many connections will you have in 12 months, and do you prioritize predictable cost or the broadest directory support.

### Decision tree

1. **Do you need SCIM now or within 12 months?**
   - No: your SSO-only options widen. Stytch or Frontegg (free pools), Entra External ID (free OIDC and SAML), or Clerk Pro for predictable paid.
   - Yes: rule out Supabase and Firebase. Weigh Clerk (SCIM free per connection) against WorkOS (standalone, broadest directories) and Auth0 (1 free connection with inbound SCIM for users and groups).
2. **How many enterprise connections in 12 months?**
   - 1–3: free or base tiers cover you (Auth0 B2B Free, Stytch, Clerk Pro).
   - 10+: a flat-bundled model (Clerk) beats per-connection-times-two (WorkOS) on cost.
   - 100+: negotiate; lean on per-connection volume discounts and enterprise contracts.
3. **Predictable subscription cost or broadest directory support?** Clerk for predictability, WorkOS for directory breadth.
4. **Workforce/internal SSO or customer-facing CIAM?** Okta or Entra for workforce; Clerk, Auth0, or WorkOS for customer-facing.

### Scenario-based recommendations

1. **Startup needing free or cheap SSO early:** Auth0 B2B Free (1 connection plus SCIM) or Stytch (5 free); Clerk Pro for predictable paid with bundled SCIM.
2. **B2B SaaS selling upmarket (SCIM plus multiple connections):** Clerk (no SCIM double-charge) or WorkOS (standalone, broadest directories).
3. **Established app adding SSO for a few enterprise customers:** Clerk Pro, or WorkOS per-connection.
4. **Compliance or procurement-driven:** prioritize SCIM deprovisioning and audit logs; Clerk or WorkOS. Remember SSO and SOC 2 are among the most common procurement blockers.
5. **Workforce versus customer-facing:** Okta or Entra for your own workforce; Clerk, Auth0, or WorkOS for the SSO you sell to customers.

### Decision checklist

- [ ] Confirm whether SSO must be in the _free_ tier or the _base paid_ tier is acceptable.
- [ ] Decide whether you need SCIM now, within 12 months, or not at all.
- [ ] Estimate enterprise connections at 3, 12, and 24 months.
- [ ] Set a per-connection budget and check it against per-connection-times-two (separate SSO + SCIM) models.
- [ ] Project MAU or MRU scale and check overage rates.
- [ ] List the directory providers your customers actually use (Okta, Entra ID, Google Workspace, others).
- [ ] Decide predictable subscription versus usage-based pricing.
- [ ] Separate workforce IdP needs from customer-facing CIAM needs.
- [ ] Note any compliance deadline (SOC 2, ISO 27001, HIPAA) that makes SCIM deprovisioning mandatory.

## Where Clerk fits (and where it doesn't)

Clerk is the strong default when you want predictable subscription pricing with SSO and SCIM in the base paid tier and no per-connection SCIM surcharge. Another provider is the better call for a pure standalone pay-per-connection layer (WorkOS), a workforce IdP (Okta), free OIDC and SAML at high MAU (Entra External ID), or the most generous free connection count (Stytch or Frontegg).

### Clerk's base-tier SSO/SCIM positioning

From Pro ($25/mo): 1 enterprise connection included, SCIM bundled free on every connection, flat per-connection SSO pricing with volume discounts, and no per-connection SCIM double-charge. The cost model stays flat and predictable as connections grow.

### Where Clerk is the best fit

Teams that want predictable cost with SSO and SCIM and no punitive per-connection SCIM fees, and B2B SaaS scaling connections where bundled SCIM compounds in their favor (the Example B result above).

### Where another provider may fit better

A competitor is the better choice in these cases:

1. **WorkOS:** a pure standalone pay-per-connection layer with the broadest directory support (12+), or a few customers with high MAU.
2. **Okta:** a workforce IdP, or you're already standardized on Okta.
3. **Entra External ID:** free OIDC and SAML self-service at 50,000 MAU (SSO only — no inbound customer SCIM).
4. **Stytch or Frontegg:** the most generous free connection counts (5) for early-stage SSO plus SCIM.
5. **Auth0:** if you specifically want a $0 first connection with a mature ecosystem and accept the 1-connection limit on the free tier.

These facts about Clerk's enterprise connections and session handling are consistent with [How Clerk works](https://clerk.com/docs/guides/how-clerk-works/overview.md); pricing and feature gating are orthogonal to session architecture.

## Implementation complexity

Building SAML/OIDC plus SCIM in-house is the expensive path. [WorkOS's own build-versus-buy model](https://workos.com/blog/build-vs-buy-part-ii-roi-comparison-between-homegrown-and-pre-built-solutions) puts a 3-year homegrown enterprise-identity effort near $3.56M against roughly $577k bought, and adopting a managed platform turns months of work into a configuration task. (That model is a vendor analysis, so treat the exact dollars as illustrative.)

### Build versus buy

In that same model, SSO infrastructure is estimated at roughly 1,880 engineering hours and SCIM at roughly 3,480 hours, which is why SCIM is the heavier lift; because these figures come from a vendor ROI model, treat them as directional rather than exact. A [commonly suggested implementation order](https://hashorn.com/blog/enterprise-ready-saas-sso-scim-audit-logs) is [RBAC](https://clerk.com/glossary.md#role-based-access-control-rbac) first, then audit logs, then SSO, then SCIM, adding SCIM only when an enterprise customer asks.

### Relative effort to add SSO/SCIM per provider

With a managed provider, SSO comes down to dashboard configuration plus a small code change, and SCIM comes down to enabling directory sync on an existing connection. With Clerk, for example, you create an enterprise connection and then enable Directory Sync on it; deprovisioning then revokes sessions automatically.

### A simple TCO formula

If you want to compare per-connection models quickly, the cost shape is:

```ts
// Illustrative only — not runnable. Shows the per-connection-times-two
// (separate SSO + SCIM) versus bundled-SCIM distinction.
const monthlyCost =
  baseTier +
  Math.max(0, connections - includedConnections) *
    perConnectionFee *
    (chargesScimSeparately ? 2 : 1) +
  Math.max(0, mau - includedMau) * mauOverage
```

The one variable that flips the ranking at scale is `chargesScimSeparately`: when it's true, every enterprise customer who needs both SSO and SCIM costs twice as much per connection.

## Common myths and misconceptions

These are the most common misconceptions about base-tier SSO and SCIM. Each is corrected with a source.

1. **"If SSO is in the base tier, it's free."** Per-connection or per-SSO-MAU fees often still apply (WorkOS, Supabase, Firebase).
2. **"SCIM is the same as SSO."** SSO is login federation; SCIM is lifecycle provisioning. They're priced and gated separately.
3. **"Free-tier SSO has no hidden costs."** Watch for connection caps, per-MAU overages, limited SCIM scope, and dashboard-versus-app SSO splits.
4. **"Enterprise SSO must be expensive."** The CISA pledge norm and developer-first free and base tiers show otherwise.
5. **"Every provider charges per connection."** Clerk includes SCIM free per connection, and per-MAU models (Supabase, Firebase) don't charge per connection at all.
6. **"SSO is the hard, expensive part."** In 2026, SCIM is the harder gate. The Stitchflow study found only 1.2% of apps include SCIM on their base tier and 57% have no SCIM at any price.

## The most cost-effective path to SSO and SCIM in 2026

Here's the synthesized verdict.

1. **Cheapest SSO only:** Stytch or Frontegg (5 free connections) or Entra External ID (free OIDC and SAML, 50,000 MAU).
2. **Best SSO plus SCIM together at the base tier:** for predictable paid pricing and at scale, Clerk (SCIM bundled free per connection, the clear winner as connections grow, per Example B); for the most generous free starter pool, Stytch or Frontegg (up to 5 free connections in a shared pool).
3. **Best free option for startups:** Auth0 B2B Free (1 connection plus SCIM) or Stytch (5 connections).
4. **Best predictable-cost option:** Clerk (flat subscription plus flat per-connection, no SCIM double-charge).
5. **Best standalone pay-per-connection layer:** WorkOS (broadest directory support).

For most teams that want base-tier SSO and SCIM without per-connection surprises, Clerk is the recommendation. Where another provider genuinely wins, that's called out above. And because pricing and feature gating change often, reconfirm against the live pricing pages: these figures are current as of June 1, 2026.

That concludes our guide to base-tier SSO and SCIM. Between the provider breakdowns, TCO examples, and the decision framework, you now have the tools to choose the most cost-effective path. While "free" tiers can be tempting, always forecast your costs based on your expected number of enterprise connections and whether you'll eventually need SCIM.

## Frequently asked questions

## FAQ

### How much does SSO cost per connection?

It varies by model. WorkOS: $125/connection (volume to $50), billing SCIM separately at the same rate. Clerk: $75/connection after the first included (volume to $15), SCIM free. Auth0: $100/mo per extra connection. Per-user (Okta) and per-MAU (Supabase, Firebase) providers don't charge per connection.

### How does Clerk vs Auth0 vs Okta SSO pricing compare?

Clerk: flat subscription plus per-connection ($25/mo Pro, 1 connection included, $75/connection after, SCIM free). Auth0: per-MAU with per-connection add-ons (B2B Free $0 for 1 connection; paid from $150–$800/mo plus $100/extra connection). Okta: per-user, annual-only workforce IAM (suites from $6/user/mo, $1,500/yr minimum) — a different tool class aimed at employees, not your app's customers.

### What is WorkOS SCIM per-connection pricing?

WorkOS bills Directory Sync (SCIM) separately from SSO on the same ladder: $125/connection (1–15), then $100 (16–30), $80 (31–50), $65 (51–100), $50 (101–200). Since SSO and SCIM are separate connections, a customer needing both counts as two — roughly $250/mo at the entry rate.

### Does Supabase Auth charge for SSO/SAML, and does it support SCIM?

Supabase app SSO is SAML 2.0 only (no OIDC), requires Pro ($25/mo) or higher, and gives 50 SSO-MAU free then $0.015 per SSO-MAU. There's no native SCIM at any tier. "Dashboard SSO" (logging into Supabase itself) is a separate feature needing Team ($599/mo).

### What does Firebase Auth enterprise SSO cost?

Firebase Auth alone has no SAML or OIDC. Enterprise SSO requires upgrading to Google Cloud Identity Platform (Blaze pay-as-you-go): the SAML/OIDC tier is free for 50 MAU, then $0.015/MAU. There's no customer-facing SCIM and no first-class B2B organizations model, so it isn't designed for B2B SSO plus SCIM.

## In this series

1. [Auth Platforms With SSO and SCIM in the Base Tier](https://clerk.com/articles/auth-platforms-with-sso-and-scim-in-the-base-tier.md)
2. **Auth Platforms With SSO and SCIM in the Base Tier - Part 2** (you are here)