What is SSO tax?
The SSO tax is an informal name for the practice of making single sign-on, and often user provisioning, available only in a product’s most expensive plan. Organisations that need SSO for security are pushed into a higher tier, often at a large multiple of the standard price, even if they need no other feature of that tier.
How Personal Academy handles it
Personal Academy includes SAML and OIDC single sign-on and SCIM provisioning from its lowest paid plan at the published per-active-user price, with no separate enterprise tier.
A worked example
Suppose a 300-person fintech compares two learning platforms. The first offers SSO only in a custom-priced enterprise tier, so the security requirement alone moves the quote into a sales negotiation. The second includes SSO and provisioning on its entry paid plan. The fintech compares both on the cost of the plan that actually meets its security policy, not on the advertised starting price.
Single sign-on lets employees use one corporate identity to reach many applications, and lets IT enforce strong authentication and remove access centrally. For many organisations it is a security requirement, not an optional extra, and security frameworks and customer audits increasingly expect it.
Many software vendors nevertheless reserve SAML or OIDC sign-in for their enterprise tier. Because the enterprise tier bundles other features and is often priced through sales, the effective cost of SSO can be several times the standard per-user price. Security practitioners began calling this the SSO tax, and public lists track vendors by how much their SSO plan costs compared with their standard plan.
Vendors argue that SSO customers are larger, need more support and value other enterprise features. Critics reply that SSO is a basic security control, that charging heavily for it discourages smaller organisations from adopting good practice, and that it leaves accounts managed by passwords in tools that would otherwise be centrally controlled.
The same pattern often applies to SCIM provisioning, audit logs and role-based access control. Without provisioning, leavers may keep access until someone notices.
When evaluating software, list the security controls your policy requires, then find the cheapest plan that includes all of them. Compare vendors on that plan price, and check whether SSO is limited to particular identity providers, needs a paid add-on, or is charged per connection. A transparent price for the plan that meets your policy is a better comparison than the lowest advertised price. Ask whether provisioning, audit logging and role management sit on the same plan as single sign-on, or require a further upgrade.