Okta licensing is the set of terms under which Okta, Inc. sells subscriptions to its identity and access management cloud services: the Okta Workforce Identity products for employees and contractors, Okta Customer Identity for external users, and the Auth0 platform that Okta also sells for customer identity. One contract, the Master Subscription Agreement (MSA), governs paid Services whether they are bought directly or through an Okta Partner.[1] The MSA grants a limited, non-transferable right during the Term to let Users access the Service solely for the customer’s own internal business purposes.[1] It does not itself define units of measure. Instead it requires the quantity of Users on an Order Form to follow the Product Subscription Reference Guide (PSRG), which lists every SKU and “a short description of how the product activation is measured”.[1][2] For a software asset manager the PSRG is therefore the metric booklet, in the way license definition booklets work for other vendors. For the general models, see named user licensing and subscription and consumption licensing.
Editions
Okta sells two product families on its own platform and a third on Auth0. Workforce Identity is sold mainly as suites. Okta describes them as “sold as suites on a per-user, per-month basis and are billed annually”.[3]
| Family | Editions and tiers named by Okta | Unit |
|---|---|---|
| Workforce Identity | Starter (from USD 6), Core Essentials (USD 14), Essentials (from USD 17), Professional and Enterprise (price on request), per user per month[3] | User ID in an Active Status[2] |
| Workforce add-ons | Single Sign-On, Adaptive MFA, Device Access, API Access Management, Secure Partner Access, Access Gateway, Universal Directory, Privileged Access, Identity Security Posture Management, Identity Threat Protection, Lifecycle Management, Identity Governance, Workflows[3] | Mostly per User; Privileged Access in Resource Units[2] |
| Okta Customer Identity | Enterprise base platform (from USD 3,000 per month), B2C Suite, B2B Suite and add-ons[3] | MAU per Year[2] |
| Auth0 | Free, Essentials, Professional (self-service) and Enterprise[10] | Monthly Active User per tenant[5] |
| Agentic identity | Okta for AI Agents, Okta for AI Agents - Core[4] | Users per Month[4] |
The PSRG says the Workforce Identity Suites “are currently only available to new customers” and must be bought as a complete Suite.[2] Existing customers may therefore hold individual product SKUs (Single Sign-On, Universal Directory, MFA and so on) rather than a Suite. Okta also renames SKUs from time to time. A May 2026 customer notice lists old and new names, for example “Unlimited Workforce Identity Workflows” becoming “Workforce Identity Workflows (Maximum flows)” from 2026-05-14. Okta states that it has “not changed product capabilities or pricing in concert with these name changes”.[9] Catalog SKUs include the Starter Suite, Essentials Suite, Enterprise Suite and the Okta Customer Identity Enterprise base platform. Product detail is in Okta Workforce Identity licensing, Okta Customer Identity and Auth0 licensing and Okta Privileged Access and AI agents licensing.
Metrics
| Okta term | Catalog row | Where it applies |
|---|---|---|
| User (Okta Workforce Identity User) | Workforce Identity User | Workforce Identity suites and products; Okta for AI Agents (Users per Month)[2][4] |
| MAU per Year | MAU per Year | Okta Customer Identity[2] |
| Monthly Active User (Auth0) | Auth0 MAU | Auth0 enterprise and self-service plans[5] |
| Resource Unit | Resource Unit | Okta Privileged Access[2] |
| Servers per Month | Servers per Month | Advanced Server Access[2] |
| Machine-to-Machine Tokens; NHI Authentication Tokens | M2M Token; NHI Authentication Token | API Access Management, Core Enterprise Platform[2] |
| Active org | Active org | Multi-Org Deployment[2] |
The MSA’s definition of Users is broad. Users are “individuals (including non-human devices, such as applications or services)” authorised by the customer and for whom a subscription has been procured, and they may include employees, contractors, clients, external users and third parties.[1] Service accounts and application identities stored in Universal Directory can therefore count, a point the PSRG repeats when it counts User IDs.[2] Catalog: Users include non-human identities and quantities follow the PSRG.
Counting / floors
Workforce Identity. Okta “determines subscription compliance based on the count of User IDs” in Universal Directory with any Active Status: Active, Recovery, Locked-Out, Password Expired or Suspended.[2] Each User ID is counted separately. A person who needs two user types, or who is assigned to two non-sandbox orgs, needs two subscriptions.[2] Individual SKUs then narrow or widen the count. Single Sign-On counts only Users with at least one assigned application, while Lifecycle Management, Workflows, Identity Governance and Identity Threat Protection can activate every User in an org once the feature is switched on.[2] Catalog: Compliance is measured by User IDs in an Active Status; Each User ID and each org is counted separately.
Customer Identity. Okta Customer Identity is bought in MAU per Year, the sum of each month’s Monthly Active Users over the subscription year. A user who signs in every month counts as 12.[2] Auth0 counts MAU per calendar month and per tenant instead.[5] The two are not interchangeable: 10,000 users who each sign in monthly are 120,000 MAU per Year on Okta Customer Identity and 10,000 MAU a month on a single Auth0 tenant.
Floors. Okta publishes two minimums. Workforce Identity carries a “$1,500 annual contract minimum”.[3] Okta Customer Identity starts with the required Enterprise base product “at $3,000 per month, billed annually”, and the Enterprise platform and all add-ons “require an annual contract”.[3] Within the Workforce suites, Okta says “all products share the same number of subscriptions”, so customers normally add licences for the whole suite. Workflows, Okta Privileged Access and Machine-to-Machine tokens are the exceptions.[3] Catalog: Okta Workforce Identity has a USD 1,500 annual minimum; Extra licences are added to the whole suite.
Virtualization & partitioning
Okta’s Workforce and Customer Identity services are multi-tenant cloud services. There are no processor, core or partitioning rules. Two infrastructure metrics exist. Advanced Server Access is licensed in Servers per Month, counted as the median of a daily count of enrolled servers over a rolling 30 days. Okta Privileged Access counts servers as the average number of actively managed servers.[2] Both approaches smooth out short-lived virtual machines and containers in elastic environments. See Okta Privileged Access and AI agents licensing and virtualization and partitioning.
Cloud / BYOL
Okta has no bring-your-own-licence model. The service is hosted by Okta. Auth0 is offered on a multi-tenant Public Cloud by default or as a dedicated Private Cloud deployment on AWS or Azure. Private Cloud is sold per deployment, sized in Performance Multiples where 1X is 100 requests per second.[5] Okta Customer Identity orgs get default rate limits. Okta “will require” the purchase of DynamicScale where usage stays above the purchased rate limit.[2]
Programs
- Workforce Identity Suites and Customer Identity Suites. Pre-packaged sets of products for new customers, bought whole. Components of a Suite cannot also be bought alongside it.[2]
- Premier Success Plans. Silver is “required for all customers with annual product subscription spend of $20,000 or higher”, and Gold for USD 200,000 or more.[2] Basic support is included when the Order Form names no level.[1] Basic offers 24x5 support with a two-hour Priority Level 1 response. Silver and Gold offer 24x7 support with one hour and 30 minutes.[7]
- Okta Platform Free Trial. Up to ten users may use listed products for 30 days. Workflows is capped at five active flows, no support is provided, and the trial is not available to public sector customers.[8] The Okta Integrator Free Plan gives a non-production Customer Identity environment for up to 10 active users.[3]
- Auth0 Self Service Plans. Plans bought on the Auth0 website or a marketplace, and the Startup, Growth and Open Source Software plans, follow a Product Specific Schedule that amends the MSA.[6]
Contract terms
Restrictions. The customer may not resell, sublicense or transfer the Service, “including without limitation by using the Service as part of a service bureau or managed service”, nor make it available to anyone other than its Users.[1] Managed service providers therefore need a partner arrangement rather than an ordinary customer subscription. Catalog: No service bureau or managed service use.
Affiliates and assignment. An Affiliate can buy under the MSA by signing its own Order Form, which creates “a new and separate agreement”.[1] Either party may assign the whole Agreement on notice to an Affiliate or to a successor in a merger, acquisition, reorganisation or sale of substantially all assets, provided the customer has paid all fees due. Other assignments need consent.[1] Okta for AI Agents is narrower. Only the customer itself, and none of its Affiliates or related entities, may use it.[4]
Fees, renewal and precedence. Fees are non-cancelable and non-refundable except as the MSA provides.[1] Subscriptions renew automatically for a term equal to the expiring one unless either party gives notice at least 30 days before the end, and Okta gives reasonable advance notice of the renewal.[1] In a conflict the Order Form prevails, then the MSA, then the Documentation. Okta may update the Documentation, which includes the PSRG, by posting new versions.[1] The PSRG itself defers to the Agreement and the Order Form.[2] Catalog: Subscriptions auto-renew unless notice is given 30 days before term end; Order Form prevails over the MSA, which prevails over Documentation.
Audits and compliance
The MSA contains no licence audit clause. Its “Audit Report” refers to Okta’s own SOC 2 report, not to an inspection of the customer.[1] Compliance comes from the service itself, because Okta sees how many User IDs are active, how many MAUs authenticated and how many tokens were issued. The PSRG states that Okta “determines subscription compliance” from Active Status counts.[2] Okta owns the usage data derived from operating the Service.[1] Overage is handled commercially. Advanced Server Access and Auth0 enterprise customers agree to sign an additional Order Form for the next tier, and Auth0 self-service customers upgrade to the next pricing tier.[2][5][6] For AI agents, the Service-Specific Terms let Okta monitor use and forbid any attempt to “undercount” usage.[4]
A licence manager can reconcile Okta from its own tenant. The practical steps are to deactivate leavers, so that their User IDs leave the Active Status set, to remove duplicate and test User IDs in production orgs, and to note which org-wide features are switched on. See true-up, license compliance and effective license position.
Out of scope
- Negotiated enterprise agreements, public sector addenda and reseller terms, which override the online MSA and were not reviewed.
- Prices for Professional, Enterprise and add-on SKUs, which Okta quotes on request.
- The Okta Legacy SKUs and Fine Grained Authorization reference guides, and early access terms for Okta for AI Agents (Advanced).
- Okta’s on-premises connectors, mobile apps and Okta Verify, which are covered by order form supplements.
- Earlier MSA versions listed on Okta’s prior agreement versions page.