Why Microsoft Entra SSO Is a Separate Keito Add-on

TL;DR — We originally intended to include Microsoft Entra SSO in the Keito Business plan. Once we understood the recurring cost of operating each enterprise identity connection, we could not do that sustainably. Instead of hiding the change, raising Business pricing for everyone, or charging per user, we are publishing SSO as a separate flat workspace add-on.

When we started building Microsoft Entra SSO, our intention was simple: add it to Business and include it in the existing price.

That felt consistent with the way we price Keito. Business is a flat workspace subscription with unlimited licensed users. We did not want enterprise sign-in to become an excuse for a per-seat charge or a “contact sales” price that changes from customer to customer.

But there was a cost we had not accounted for correctly.

What We Learned

Keito uses WorkOS for the enterprise identity layer behind our Microsoft Entra SAML connection. An enterprise connection is not just a one-time setup task. Each live connection carries a separate recurring provider cost, regardless of whether the workspace has five users or five hundred.

That left us with four choices:

1. Absorb the recurring cost and hope the numbers worked later.
2. Increase the Business plan price for every customer, including those who do not need SSO.
3. Charge per user or hide the price behind a sales conversation.
4. Publish the connection cost as a separate, predictable workspace add-on.

We chose the fourth option.

The Published Price

Microsoft Entra SSO for Keito Business costs:

• $139 USD/month per workspace; or
• $1,668 USD/year per workspace.

The annual amount is the exact total of twelve monthly fees, so there is no additional annual discount. The add-on is billed separately from Business and has no per-user charge.

A Business workspace on monthly billing therefore pays $199 USD/month per workspace for Business plus $139 USD/month per workspace for Entra SSO: $338 USD/month per workspace before tax. On annual billing, Business is $1,910 USD/year per workspace and the add-on is $1,668 USD/year per workspace: $3,578 USD/year per workspace before tax.

We publish those combined totals because customers should not have to assemble the real price from a sales call, a footnote, or a calculator.

Why We Did Not Raise Business Pricing

Many Business customers do not need enterprise SSO. Increasing the base price would make every one of them subsidise a connection they never use.

Keeping the charge separate preserves the original shape of the Business plan:

• one flat workspace price;
• unlimited licensed users;
• no headcount forecasting; and
• no penalty when the team grows.

The SSO add-on follows the same principle. The underlying cost is attached to the enterprise connection, so Keito charges once for the workspace rather than once for every person who signs in.

What the Add-on Includes

The first release provides Microsoft Entra SAML SSO for an existing Keito Business workspace. Owners and Administrators can complete the connection through Keito, test their own sign-in, and then require SSO for the workspace.

It does not currently include a separate OIDC connection or SCIM provisioning, deprovisioning, and directory synchronization. Team membership is still managed in Keito. For immediate offboarding, an administrator removes the user’s Entra application assignment and deactivates their Keito membership.

Existing Google-authenticated and email-code-authenticated users do not need new Keito identities. When Microsoft Entra returns the same verified email, the person keeps the same user, role, workspace access, and records. Our Microsoft Entra SSO configuration guide covers the migration test and safe enforcement process.

What Transparency Means to Us

Transparent pricing does not mean pretending every feature has the same cost to operate. It means explaining the boundary, publishing the price, and making the same offer to every customer.

We changed our original plan because the economics were different from what we first expected. We would rather say that plainly than quietly move the cost somewhere harder to see.

The add-on is currently available by invitation while we work with a small pilot group. The price is already public, the setup process is documented, and the product clearly states what is and is not included.

If Microsoft Entra SSO is important to your team, review the add-on and complete pricing, then contact us to join the rollout.