IdRa vs Okta, row by row.
A plan price instead of a per-person bill. Here’s how the two line up.
The short version.
Why people look at IdRa
- It’s free up to 100 users, apps and servers per org, and no feature is held back on any plan
- It’s open source under the MIT license, and you can run it on your own infrastructure
- Each organization has its own database
- Every feature is on every plan
What carries over
- Your apps, over OIDC, SAML and SCIM
- Okta’s SDKs and Terraform provider
- Your scripts for users, groups, apps, policies and logs, under
/api/v1
The full matrix.
Audited on October 30, 2026. IdRa’s status comes from reading its code, and Okta’s from Okta’s public documentation. It covers the features most likely to shape a decision. Okta’s plans vary, so check what yours includes.
| Capability | Okta | IdRa | What you get |
|---|---|---|---|
| Sign-on | |||
| OIDC: code + PKCE, refresh, client credentials, device | Yes | Included | We run the OpenID conformance suite ourselves, with no failures. |
| SAML 2.0 SP- and IdP-initiated sign-on | Yes | Included | As the identity provider, for any standards-based app. |
| SAML signed requests, ForceAuthn, NameID formats, extra ACS URLs | Yes | Included | Opt-in per app, in the console and the API. |
| SAML encrypted assertions, per-app signing keys | Yes | Included | Opt-in per app, with AES-GCM and RSA-OAEP. |
| SAML Single Logout | Yes | Included | Opt-in per app in the console and admin API, when the app starts it. |
| private_key_jwt and DPoP | Yes | Included | JWKS or a JWKS URL per app, and per-app DPoP. |
| PAR, JAR, token exchange, JWT bearer, dynamic registration | Yes | Included | PAR, signed request objects with private_key_jwt, on-behalf-of token exchange, JWT bearer with the app’s own keys, and dynamic registration with admin-issued tokens. |
| External OIDC and SAML identity providers | Yes | Included | With Google and Microsoft presets. |
| Identity provider routing | Yes | Included | By domain, network zone, app and platform. |
| Linking existing accounts to a provider | Yes | Included | Opt in per provider with a domain allow-list, proven with a DNS TXT record. |
| Attribute and group mapping on federated sign-in | Yes | Included | By claim name. |
| Pre-integrated app catalog | Thousands of apps | Included | 14 templates, plus any standards-based app by hand. |
| Authenticators | |||
| Passkeys (WebAuthn) | Yes | Included | For sign-in and step-up, and phishing-resistant. |
| TOTP, SMS, voice, security question | Yes | Included | SMS and voice go through Twilio. |
| YubiKey OTP, Duo | Yes | Included | Built in, if you already run them. |
| Custom OTP tokens | Yes | Included | Any time-based token whose seed you hold. |
| Push with number challenge | Okta Verify | Included | IdRa Verify, an installable web app. |
| Self-service recovery | Yes | Included | Never says whether an account exists, and clears a lockout. |
| Policies and threat | |||
| App sign-in rules by group, zone, risk and device | Yes | Included | Also by person, app, app type and expression, with an allowed-method list. |
| Organization-wide session policy | Yes | Included | Applies each time a session reaches an app, with user targets, per-rule idle timeout and a primary factor rule. |
| IP and dynamic network zones | Yes | Included | IP zones, plus location zones with Cloudflare or GeoIP files. |
| Blocking known-bad networks from threat data | ThreatInsight | Included | Public feeds and a local detector. |
| Behavior detection and risk scoring | Yes | Included | A fixed set of signals and weights. |
| Risk-driven response and global sign-out | Entity Risk Policy, Universal Logout | Included | From one rule: end sessions, revoke tokens and sign out of connected apps. |
| Shared Signals transmitter | Yes | Included | CAEP and RISC, push and poll. |
| Shared Signals receiver | Yes | Included | By push. Signals change risk. |
| Policy simulation | Yes | Included | In the console, admin API and Okta-shaped API. |
| Directory and lifecycle | |||
| Users, groups and custom attributes | Yes | Included | Typed attributes with uniqueness and per-attribute access for the person. |
| Group rules | Yes | Included | Assign people to groups by attribute. |
| User types and linked objects | Yes | Included | In the console and admin API. |
| Inbound SCIM | Yes | Included | Users and groups, PATCH and deprovisioning. |
| Outbound SCIM | Yes | Included | Create, update, deactivate, reactivate, and delete if you opt in. |
| App imports | Yes | Included | Over SCIM, on request or read daily. An admin chooses each link, create and removal. |
| API access | |||
| Authorization servers, scopes and claims | Yes | Included | An issuer per tenant, with custom scopes and claims. |
| Token preview | Yes | Included | Access tokens. |
| Management API | Yes | Included | 185 SDK operations on core resources, with Okta’s error, paging and rate-limit shapes. |
| OAuth-scoped API tokens | Yes | Included | okta.* scopes for service apps, acting with the granting admin’s role. |
| Terraform provider | Yes | Included | Yes, the Okta Terraform provider works with IdRa, using an API token. |
| Administration | |||
| Standard admin roles | 12 roles | Included | 12 roles. Group, Group Membership and Application admins can be limited to chosen groups, apps or OAuth clients. |
| Custom roles and resource sets | Yes | Included | Built from people, group and app permissions, over a set of groups and apps. |
| Audit log | System Log | Included | Search, filters, CSV export, API, retention and tamper evidence. |
| Log streaming | Yes | Included | Splunk HTTP Event Collector or any HTTPS endpoint. |
| Devices | |||
| Device checks in sign-in policy | Yes | Included | OS version, disk encryption and managed state, plus screen lock and firewall where your MDM reports them. |
| Jamf, Intune, Kandji, Fleet | Varies | Included | Device signals from each, in sign-in rules. |
| Beyond sign-on | |||
| Privileged access: SSH certificates and a vault | Yes | Included | For SSH. |
| Access requests | Yes | Included | For groups, with one approval step. |
| Posture management | Yes | Included | 9 connectors and 26 checks. |
| Partner access portal | Yes | Included | Invitations, bring-your-own IdP and expiry. |
| Header-based app gateway | Yes | Included | Forward-auth at host level, with identity passed in headers you configure. |
| How it’s delivered | |||
| Run it on your own infrastructure | Not on Okta’s listed plans | Included | One Bun process and Postgres. |
| Database per tenant | Isolated orgs | Included | Each organization gets its own Postgres database. |
| Published price | $6 to $17 per user per month on listed plans, higher plans by quote | Included | Hosted IdRa is free forever up to 100 users, apps and servers per org. Growth is $249/mo up to 500 users, Business is $699/mo up to 2,000, and Enterprise starts at $25k/yr. No feature is ever held back on any plan. |
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.
