The "SSO Tax": Why Some LMS Platforms Still Gate Security Behind Enterprise Plans
Single sign-on is a baseline security control, not an enterprise luxury. See which LMS platforms are quote-only for their whole plan (SSO terms included), and who publishes SSO as included by default.
Personal Academy, Security
A department of the team that builds Personal Academy
The "SSO Tax" refers to the practice some vendors follow of gating SAML 2.0 and OIDC single sign-on behind top-tier "Enterprise" plans. As of 19 Oct 2026, Docebo publishes no price at all and routes the whole plan (including any SSO terms) through a quote-only sales process, and Litmos publishes starting prices only (Foundation from $8K a year, Platinum from $15K a year) with SSO terms unlisted. TalentLMS, by contrast, lists SAML and OIDC single sign-on on every paid plan from its entry Core tier (talentlms.com/prices, checked 19 Oct 2026); SCIM is not mentioned on its pricing page. Personal Academy also includes SAML/OIDC SSO on every paid plan, with published per-active-user pricing.
Core Findings & Takeaways
- Some commercial LMS platforms route their entire plan, SSO included, through a quote-only sales process rather than publishing a price.
- Docebo publishes no price at all (minimum one-year contract, most customers sign three to five years); Litmos publishes starting prices only, from $8K a year.
- TalentLMS, notably, lists SSO as included on every paid plan from its entry tier - the same practice Personal Academy follows on every paid plan, which also includes SCIM 2.0 provisioning.
Source: docebo.com/pricing and litmos.com/pricing, checked 19 Oct 2026
The Single Sign-On Access Gap
Docebo publishes no price; Litmos publishes starting prices only; neither lists SSO or SCIM terms on a public pricing page.
SAML 2.0 and OIDC single sign-on and SCIM 2.0 provisioning included on every paid plan with published per-active-user pricing.
What is the "SSO Tax"?
Single sign-on (SSO) via SAML 2.0 or OIDC allows IT administrators to enforce multi-factor authentication (MFA), centralize password policies, and instantly revoke application access when an employee departs. It is the single most critical baseline control in enterprise identity hygiene.
Despite SSO costing virtually nothing in marginal server compute, some LMS vendors route it into a quote-only sales process alongside the rest of their plan. This practice is sometimes called the "SSO Tax", and it penalizes security-conscious startups and mid-market organizations who cannot get a straight answer without a sales call.
Vendor Breakdown: Who Publishes SSO Pricing in 2026?
TalentLMS: Lists SAML 2.0 and OIDC single sign-on on Core, Grow, Pro and Enterprise (not Free) with no separate SSO gate; SCIM is not mentioned on the pricing page (talentlms.com/prices, checked 19 Oct 2026).
Docebo: Does not publish standard pricing at all. The entire platform, SSO terms included, goes through a sales qualification process with a minimum one-year contract (docebo.com/pricing, checked 19 Oct 2026). Pricing not published, quote required.
Litmos: Publishes starting prices only (Foundation from $8K a year, Platinum from $15K a year; litmos.com/pricing, checked 19 Oct 2026) and routes the rest through a quote; SSO terms are not listed on the pricing page.
Why Personal Academy Includes SSO on Every Paid Plan
At Personal Academy, we believe security should never be a luxury upsell. An organization of 25 people deserves the exact same identity protection as an enterprise of 25,000. That is why SAML 2.0 (Okta, Azure AD, Google Workspace), SCIM 2.0 automated deprovisioning, and append-only audit logging are included on every paid tier, with published per-active-user pricing.
Written by
Personal Academy, Security
Identity, data isolation, audit, privacy and compliance. Nothing is claimed that the code does not do today.
Related Analyses in Security
View all articles →What an LMS Security Review Actually Asks: 30 Real CISO Questions & Our Answers
Preparing for an enterprise IT or CISO security review? Here are the 30 questions security teams ask most frequently, complete with verifiable architecture answers.
What is SCIM 2.0 Directory Sync, and Why IT Demands It for LMS Deprovisioning
System for Cross-domain Identity Management (SCIM) automates user onboarding and deprovisioning. Here is why security teams consider it essential for LMS governance.
Database Tenant Isolation: PostgreSQL Row-Level Security vs Shared Database Risks
How does modern multi-tenancy protect your employee data? An architectural analysis of PostgreSQL Row-Level Security (RLS) vs application-level filters.