Okta and its alternatives in 2026: what each costs and what stays manual
Okta, OneLogin, Rippling, JumpCloud and Google Workspace for a Google Workspace company on Macs: 2026 list prices, which tier unlocks lifecycle, and what stays manual.
TL;DR
- Okta lists three public suites: Starter at $6, Core Essentials at $14 and Essentials at $17 per user per month. All are billed annually, with a $1,500 annual minimum (Okta pricing).
- Okta's joiner, mover and leaver automation (Lifecycle Management) starts at Core Essentials. Access requests and reviews start at Essentials. Device Access for Macs is included only from Professional, and it needs an MDM.
- OneLogin's pricing page could not be read. Two third-party price sets exist and they disagree. Governance is a separate One Identity product.
- Rippling publishes no IT prices, and its pricing FAQ says each product is bought alongside the core Rippling Platform.
- JumpCloud is the only one here with public list prices for every self-serve plan, and it includes a Mac MDM.
- Google Workspace already includes SAML sign-in in every Business edition and provisioning for up to 100 apps from Business Standard. It does not manage Macs.
- Everywhere, three things stay manual: apps without SCIM, SCIM that sits on a vendor's top plan, and Macs, unless the suite includes an MDM.
This article is for a company that runs Google Workspace and gives its people Macs. Facts were checked on 15 and 16 October 2026. Prices are list prices, in the currency each vendor uses. Negotiated prices are often lower. Caspian publishes this article and sells a product in this space. Where we give an opinion, we say so.
Okta in depth
Plans and list prices
| Suite | List price per user per month | Lifecycle Management | Access requests and reviews | Device Access (Macs) | Workflows |
|---|---|---|---|---|---|
| Starter | $6 | Add-on | No | Add-on | 5 active flows |
| Core Essentials | $14 | Included | No | Add-on | 5 active flows |
| Essentials | $17 | Included | Included | Add-on | 50 active flows |
| Professional | Price on request | Included | Included | Included | Unlimited |
| Enterprise | Price on request | Included | Included | Included | Unlimited |
Source: Okta pricing, checked 16 October 2026. The page says "All suites are billed annually" and lists a "$1,500 annual contract minimum". All products in a suite share one licence count, so an upgrade for one feature is paid for every user. A 30-day trial is offered.
Adaptive MFA is included in Essentials. Whether Core Essentials includes it is unclear: the plan card reads as included, and a third-party guide lists it as an add-on (Costbench, medium confidence). Confirm with Okta.
Okta used to sell modules one by one. It now sells bundled suites. We found no dated Okta announcement of the change (AccessOwl, medium confidence).
What each tier unlocks
- Single sign-on: from Starter.
- Joiner, mover and leaver automation: Lifecycle Management "automates the entire joiner, mover, leaver process by connecting your HR system" (Okta Lifecycle Management). It is included from Core Essentials and is an add-on on Starter. It provisions users into "SCIM-enabled app integrations" (Okta help).
- Access requests and reviews: included from Essentials. Below that, only through the Identity Governance add-on.
- Device Access for Macs: Okta sign-in at the Mac login window, device-bound SSO and posture checks. Included in Professional and Enterprise, an add-on below. Okta's setup guide requires that "devices are enrolled in an MDM solution" (Okta help, Desktop MFA).
Okta also finds unsanctioned apps and AI agents through ISPM. It is not available on Starter or Core Essentials, is an add-on on Essentials, and is included from Professional (Okta pricing; Okta blog).
What stays manual with Okta
- Apps without SCIM. Okta provisions only apps with a provisioning connector. Okta Workflows can script some others, at build effort.
- SCIM on a vendor's top plan. Slack, for example, offers SCIM provisioning on Business+ and Enterprise only (Slack help).
- Macs. Okta is not an MDM. Enrolment, OS updates, app installs, FileVault keys and wipe stay in a separate MDM.
- Google Workspace accounts, if you buy Starter without Lifecycle Management. An admin then creates and suspends them by hand in the Google Admin console.
- Access requests below Essentials. They go through a ticket or Slack, and someone grants access by hand.
Our view: Okta is a strong and well-understood choice for a company with several identity sources, strict sign-in policy needs, or a dedicated identity admin.
OneLogin in depth
Two conflicting price sets
OneLogin's own pricing page did not load for us. Both public price sets below come from third parties, and they disagree. Confirm with OneLogin before you budget.
| Price set | Plans, per user per month | What unlocks lifecycle | Source and confidence |
|---|---|---|---|
| Newer set (March 2026) | Basic $3, Essentials $6, Business $10, Enterprise on request. Workflows add-on $2 | Essentials: provisioning for unlimited apps. Basic covers 5 apps | Federated Directory, a competitor blog with no source cited. Medium to low |
| Older set | Advanced $4, Professional $8, Expert $10 | Professional: identity lifecycle management and HR-driven identity | Cloudwards, TrustRadius. Medium |
Billing terms and minimums are not published. One review site says there is no minimum contract commitment (Siit, medium confidence). Vendr reports a median spend of $29,704 a year (Vendr, OneLogin, medium confidence).
Governance and Macs
We found no public OneLogin tier for access requests or reviews. Governance is One Identity Manager, a separate product with its price on request. On Macs, OneLogin offers SmartFactor device signals on its higher plans and Desktop machine login. We found no MDM.
Ownership
One Identity, then part of Quest Software, acquired OneLogin in 2021 (Infosecurity Magazine). On 24 June 2026 One Identity announced it will spin out of Quest as an independent company, with headquarters in Cork, Ireland (ITPro). The new owner was not disclosed. We found no confirmation that the deal has closed (Start with Identity).
The 2025 AD Connector flaws
In June 2025 SpecterOps disclosed three chained flaws in the OneLogin AD Connector. One, CVE-2025-34063, allowed an attacker to impersonate any user and was rated CVSS 10 (NVD). Belgium's Centre for Cybersecurity (CCB) told users to patch immediately (CCB). The fix is AD Connector 6.1.5, with advice to rotate signing keys. Only tenants that use the AD Connector were affected. A Google Workspace company typically does not run it.
Rippling
Rippling publishes no IT prices. Its pricing page says "Rippling plans start at $8 per employee per month, with a monthly base fee" and quotes everything else on request (Rippling pricing). Its pricing FAQ says each HR, Finance and IT product is bought "alongside the core, required Rippling Platform" (medium confidence: we saw this text in a search result, not on the page itself). Rippling's own blogs give starting points of $8 per user per month for identity and "around $8" for device management (medium confidence).
One estimate built from buyer quotes, published by AccessOwl as of May 2026: a $420 yearly platform base plus $6 per user per month, identity from $6 per user per month, and $2,000 for implementation (AccessOwl). Low confidence: AccessOwl competes with Rippling, and the page dates are inconsistent. Contract terms and minimums are not published.
What Rippling covers, from its own blogs (medium confidence):
- Single sign-on, MFA and access rules based on device, location and time.
- Provisioning "across 650+ business apps", driven by role, department and location. Offboarding revokes apps, locks devices and transfers files.
- Apps without single sign-on: a password manager, RPass, with shared logins hidden from employees. For apps without SCIM, an API to build your own workflows.
- Macs: zero-touch enrolment through Apple Business, disk encryption policy, OS updates, silent app installs, and remote lock and wipe.
JumpCloud
JumpCloud is the only vendor here with public list prices for every self-serve plan (JumpCloud pricing).
| Plan | Annual billing, per user per month | Monthly billing | What it includes |
|---|---|---|---|
| Device Management | $9 | $11 | MDM, patching, software management, remote access. No SSO |
| SSO | $11 | $13 | SSO, MFA, directory, lifecycle, password manager. No MDM |
| Device Identity Management | $13 | $15 | MFA, directory, MDM, patching, device identity. No SSO, no lifecycle |
Add-ons cost $3 to $6 per user per month each. The Platform tiers are priced on request. No minimum is stated, annual billing saves "up to 18%", and there is a 30-day trial. The plan contents are medium confidence, because the comparison table did not read cleanly.
JumpCloud has managed Apple devices since 2020: zero-touch enrolment, App Store apps, custom packages and FileVault policies (JumpCloud MDM, medium confidence). It provisions apps over prebuilt connectors and a custom SCIM 2.0 template. For apps without SCIM we found only its REST API and HR integrations. It syncs users, not groups, with Google Workspace (JumpCloud help, medium confidence).
Google Workspace on its own
Every Business edition includes 200+ preconfigured SAML apps, custom SAML apps and sign-in through a third-party identity provider (Google, compare editions). Business editions cost €6.80 (Starter), €13.60 (Standard) and €21.10 (Plus) per user per month, and are capped at 300 users (Google Workspace pricing).
Automatic provisioning covers up to 3 apps on Business Starter and up to 100 on Business Standard and above (Google Workspace help). The compare page says "Unlimited" for Standard and Plus, so the two Google pages disagree. It works only for catalogue apps that support it. We found no HR-driven joiner, mover and leaver workflows and no access requests in the Business editions.
On Macs, Google offers Endpoint Verification: a Chrome extension and helper app that report OS version, encryption, screen lock and firewall, plus sign-out and blocking (Google help). Windows has its own device management row on Business Plus. macOS has none. We conclude, with medium confidence, that Google Workspace cannot push profiles, FileVault settings or apps to a Mac, or wipe one. A Google Workspace company on Macs needs a separate MDM.
Comparison
| Okta | OneLogin | Rippling | JumpCloud | Google Workspace | |
|---|---|---|---|---|---|
| List price per user per month | $6, $14, $17; top two tiers on request | $3 to $10, two conflicting third-party sets | Not public. Blogs say from $8 | $9, $11, $13; add-ons $3 to $6 | €6.80, €13.60, €21.10 (you already pay it) |
| Billing and minimum | Annual only, $1,500 a year minimum | Not published | Not published. Core Rippling Platform required | Monthly or annual, no minimum stated | Your Workspace plan |
| SSO | Yes, from Starter | Yes | Yes | Yes, SSO plan | SAML in every Business edition |
| SCIM provisioning | From Core Essentials | From Essentials ($6) or Professional ($8) | 650+ apps | Prebuilt and custom SCIM 2.0 | 3 apps on Starter, up to 100 from Standard |
| Joiner, mover, leaver from HR | From Core Essentials | Business ($10) or Professional ($8) | Yes | In the SSO plan, or as an add-on | No |
| Apps without SCIM | Manual, or build a Workflow | Manual, or a custom REST connector | Password vault or API | Manual, or REST API | Manual |
| Mac management | No. Device Access needs an MDM | No | Yes | Yes | Endpoint Verification only |
| What you still buy | An MDM | An MDM, and One Identity Manager for governance | The core platform | Nothing extra for Macs | An MDM, and lifecycle tooling |
Sources: the vendor sections above. Checked 15 and 16 October 2026.
Worked example: 150 people on Macs, at list price
This is an example, not a recommendation. It is our arithmetic on public prices, before any discount, for a company already paying for Google Workspace.
| Option | Per year | Confidence |
|---|---|---|
| Google Workspace Business Standard, as is | €24,480 (already paid). No Mac MDM | High |
| Okta Core Essentials (cheapest with lifecycle) | $25,200, plus an MDM | High |
| Okta Essentials (adds access requests) | $30,600, plus an MDM | High |
| OneLogin Essentials, newer price set | $10,800, plus an MDM | Medium to low |
| OneLogin Professional, older price set | $14,400, plus an MDM | Medium |
| JumpCloud Device Management only, Google for sign-in | $16,200 | High on price |
| JumpCloud Device Identity Management plus SSO and lifecycle add-ons | $34,200 | Medium |
| Rippling platform, identity and MDM | About $38,420 in year one, including $2,000 implementation | Low: an estimate from buyer quotes, not a quote |
Every option except Google Workspace comes on top of the Google Workspace seats.
What stays manual everywhere
- Apps without SCIM. No vendor here creates or removes accounts in an app that has no provisioning connector. Some offer a scripting route, at build effort.
- SCIM on a vendor's top plan. Many SaaS vendors put SCIM, and often SAML, only on their enterprise plan. The identity provider licence does not remove that upgrade.
- Macs. Okta, OneLogin and Google Workspace do not manage Macs. You need an MDM next to them, unless the suite includes one, as Rippling and JumpCloud do.
Our view: in a company of this size, the apps without SCIM are where most leaver accounts survive. Someone still has to log in and remove them.
Where Caspian fits
This section describes our own product. Caspian is not an identity provider. You keep Google Workspace or Okta for sign-in and MFA, and Caspian works alongside them (Caspian pricing).
- See, free: every app, AI tool and account on every laptop, and who has access to each. Requests and rules land as tasks you do yourself.
- Act, €10 per active user per month: Caspian does the work on your rules. Joiners and leavers across apps, including apps without SCIM, and Macs managed, set up together with a founder. Free for 30 days from install.
Prices are in euros, excluding VAT, billed monthly per active user, with no minimum.
Our view: if Google Workspace already covers your sign-in, the gaps left are lifecycle in the apps without SCIM and the Macs. That is the work Caspian is built for.
Questions to ask any vendor
- Which of our apps can you provision, and on which of their plans?
- What happens to an app with no SCIM and no API when someone leaves?
- Do we need an MDM next to you for our Macs?
- Is the price annual or monthly, and is there a minimum?
- Which features in the demo are add-ons?
Sources
| Source | Publisher | Date | Confidence |
|---|---|---|---|
| Pricing | Okta | Checked 16 Oct 2026 | High |
| Lifecycle Management | Okta | Checked 15 Oct 2026 | High |
| About SCIM | Okta help | Checked 15 Oct 2026 | High |
| Desktop MFA for macOS | Okta help | Checked 16 Oct 2026 | High |
| ISPM AI agent discovery | Okta blog | 1 Sep 2026 | High |
| Okta pricing guide | Costbench | Checked 16 Oct 2026 | Medium |
| Okta cost | AccessOwl | Apr 2026 | Medium |
| SCIM provisioning plans | Slack help | Checked 15 Oct 2026 | High |
| OneLogin pricing | Federated Directory | 7 Mar 2026 | Medium to low |
| OneLogin review | Cloudwards | Checked 16 Oct 2026 | Medium |
| OneLogin pricing | TrustRadius | Checked 16 Oct 2026 | Medium |
| OneLogin review | Siit | Checked 16 Oct 2026 | Medium |
| OneLogin buyer data | Vendr | Checked 16 Oct 2026 | Medium |
| One Identity acquires OneLogin | Infosecurity Magazine | Oct 2021 | Medium |
| One Identity spins out | ITPro | 24 Jun 2026 | Medium |
| One Identity alternatives | Start with Identity | Checked 16 Oct 2026 | Medium |
| CVE-2025-34063 | NIST NVD | 1 Jul 2025 | High |
| OneLogin AD Connector warning | CCB Belgium | 2025 | High |
| Pricing | Rippling | Checked 16 Oct 2026 | High (page), medium (FAQ text) |
| Identity and access management review | Rippling blog | 30 Oct 2025 | Medium |
| MDM review | Rippling blog | 29 Oct 2025 | Medium |
| The true cost of Rippling SSO | AccessOwl | May 2026 | Low |
| Pricing | JumpCloud | Checked 16 Oct 2026 | High (prices), medium (plan contents) |
| Apple MDM | JumpCloud | Checked 16 Oct 2026 | Medium |
| Google Workspace directory integration | JumpCloud help | Checked 16 Oct 2026 | Medium |
| Pricing | Checked 16 Oct 2026 | High | |
| Compare Business editions | Google Workspace help | Checked 16 Oct 2026 | High |
| Automated user provisioning | Google Workspace help | Checked 15 Oct 2026 | High |
| Endpoint Verification | Google Workspace help | Checked 16 Oct 2026 | High (Mac support), medium (no Mac MDM, by absence) |
| Pricing | Caspian | Checked 16 Oct 2026 | High (our own page) |
