Microsoft Entra ID alternatives: when to replace it, and what to replace it with

Short answer: Microsoft Entra ID is free at the base tier, $7 per user per month for P1 and $10 for P2 with annual billing. Whether you need an alternative depends on why you are looking: cost at scale, data residency, on-premises or hybrid requirements, or the need to cover applications that are not Microsoft-centric. The strongest alternatives are Casdoor, Keycloak, Okta, Zitadel, authentik and Logto, and they are not interchangeable.

This article separates the reasons people leave Entra ID from the reasons they stay, then compares the options on the facts that decide the migration.

What Entra ID costs

Microsoft publishes these prices per user per month with annual billing:

Two things matter for budgeting:

• P1 is included in Microsoft 365 E3 and Business Premium; P2 is included in Microsoft 365 E5. If you already pay for those bundles, the marginal cost of Entra ID is zero, and replacing it means paying twice unless you also drop the bundle.
• External ID is metered separately: the first 50,000 monthly active users are free, then pay-as-you-go. That makes Entra ID competitive for customer-facing login at small scale.

Why teams look for alternatives

Per-user cost at scale. At $7 to $10 per user per month, 5,000 employees cost $420,000 to $600,000 per year before any add-ons. Organizations with many frontline or occasional users often want a cheaper model.

Data residency and sovereignty. Entra ID is a Microsoft cloud service. Teams that need EU-only, on-premises or air-gapped identity look for self-hosted options. Searches for "Entra ID alternative Europe" reflect this.

Hybrid and non-Microsoft estates. Linux servers, network devices, Kubernetes and custom applications often fit an open-source identity provider more naturally than a Microsoft-centric one.

Customization. Entra ID's login pages and flows are configurable within Microsoft's boundaries. Products that need deep branding, custom flows or embedded identity sometimes hit those boundaries.

Vendor concentration. Some organizations deliberately avoid putting identity, email and productivity in the same vendor.

Why teams stay

• Microsoft 365 integration. Teams, SharePoint, Outlook and Windows Hello all assume Entra ID.
• Conditional Access maturity. Entra's policy engine and risk signals are deeply integrated with Microsoft's security products.
• Compliance evidence. Auditors and insurers often recognize Entra ID controls without extra work.
• No operations. There is no cluster, database or upgrade to run.

A migration is rarely all-or-nothing. Many organizations keep Entra ID for Microsoft 365 and add a second identity provider for customers, partners or non-Microsoft applications.

The alternatives

Casdoor

Casdoor is an Apache-2.0 identity provider with OIDC, SAML 2.0, CAS, SCIM and LDAP. It can replace Entra ID for application SSO while keeping users, groups and application assignments in a system you run. Self-hosting is free with no user cap; managed instances start at $9 per month with unlimited users.

It is the closest open-source match for teams that want an admin console, organization model, MFA, social login and enterprise SSO in one product, without per-user pricing.

Keycloak

Keycloak is the reference open-source identity server, Apache-2.0 and a CNCF incubating project. It is the most common replacement for Entra ID in organizations that already run Kubernetes, and it has the widest ecosystem of adapters and extensions.

The cost is operational: upgrades, database, backups and high availability are yours unless you use a managed provider. See managed Keycloak hosting.

Okta

Okta is the commercial alternative most often shortlisted against Entra ID. Workforce plans are $6, $14 and $17 per user per month with a $1,500 annual minimum; Customer Identity is priced as a platform plus usage. Okta is a fit when you want a mature commercial product and are willing to pay per user.

Zitadel

Zitadel is AGPL-3.0 and prices by daily active users: free up to 100 DAU, $100 per month for 25,000 DAU, custom above that. DAU pricing favors B2B products where users sign in occasionally; it is less attractive for consumer apps with daily sign-ins.

authentik

authentik's core is MIT-licensed and self-hosted, with a visual flow editor that makes custom login and policy flows easier than Keycloak's forms. Enterprise features are licensed separately. There is no first-party managed cloud, so you operate it yourself.

Logto

Logto is MPL-2.0 with a free cloud tier up to 50,000 MAU and Pro from $24 per month. It targets consumer apps that want a modern sign-in experience without building it, and it can also be self-hosted.

How to choose

If you are staying in the Microsoft stack, keep Entra ID and add a second IdP only for the applications it does not serve well. Replacing it entirely usually means replacing Microsoft 365 assumptions too.

If cost at scale is the driver, compare the Entra bill at your actual user count with a flat-price managed instance (Casdoor from $9 per month) or a self-hosted deployment. Include the cost of running it.

If data residency is the driver, self-host Casdoor or Keycloak in the region you need, or choose a provider that can deploy there. Verify where the database and backups live, not just where the compute runs.

If you need customer-facing login, compare Entra External ID (first 50,000 MAU free) with Auth0, Logto and Casdoor. The free tiers are close at small scale; the difference appears at growth.

If you are migrating, plan for the parts that do not export cleanly: password hashes, Conditional Access policies, device compliance and Windows Hello. Entra ID does not export password hashes, so most migrations combine directory sync with a password reset or a staged cutover.

Migration notes

• Users and groups can be synchronized from Entra ID through Microsoft Graph. Casdoor's Azure AD syncer reads users through Graph and is read-only.
• Applications need to be reconfigured with new metadata: entity ID, ACS URL, client ID and secret, or OIDC endpoints.
• Conditional Access has no direct equivalent. Map each policy to MFA, session lifetime, IP allowlists or risk-based rules in the new IdP.
• Password hashes are not available. Plan for a reset campaign or a gradual migration by application.
• Pilot first. Move a non-critical application and a small group, then expand.

For the application-level steps, see Entra ID SSO. For the B2C side, see Azure AD B2C alternatives and migrate from Azure AD B2C.

FAQ

Is Entra ID free? The Free tier is $0 and includes MFA, unlimited SSO and self-service password reset, but it requires an Azure subscription. P1 is $7 per user per month and P2 is $10 with annual billing.

What is the cheapest Entra ID alternative? Self-hosted Keycloak or Casdoor has no license fee. For managed hosting, Casdoor Cloud starts at $9 per month with unlimited users.

Can I replace Entra ID but keep Microsoft 365? It is possible to federate Microsoft 365 with a third-party IdP, but it adds complexity and is rarely worth it unless you have a strong reason. Most organizations keep Entra ID for Microsoft 365 and use a second IdP for other applications.

Does Entra ID export password hashes? No. Plan for password resets or a staged migration.

Which alternative is best for Europe or on-premises? Self-hosted Casdoor or Keycloak gives you full control over where data lives. Cloud-IAM and other EU providers are options for managed Keycloak.

See Active Directory alternatives for the on-premises directory side, and Okta pricing for the commercial comparison. Casdoor Cloud plans are on the pricing page.