Best European Alternatives to Okta

Why people leave Okta

Okta is bought by an IT department, not by a developer, and that shapes every complaint about it. It is the directory that employees log into, the place where joiners and leavers are processed, and the thing sitting in front of the forty SaaS products the company already pays for. When it works nobody notices, which is why the objections are almost never about features.

The first objection is the licence. Suites are billed annually with a $1,500 minimum annual contract, starting at $6 per user per month for single sign-on, multi-factor and the directory. The tier that carries adaptive MFA, lifecycle management, privileged access and governance is $17 per user per month. A sixty-person company that decided it wanted adaptive MFA has committed to roughly twelve thousand dollars a year, up front, for a year.

The second is harder to price. On 20 October 2023 Okta disclosed that someone had got into its support case management system and viewed files customers had uploaded to support cases — HAR files, which can carry session cookies and tokens.

Okta’s own account is clear that this system is separate from the production service and that production was unaffected, and that matters: the lesson is not carelessness. It is that when identity is a subscription, the vendor’s help desk is part of your attack surface, and nothing you configure in your own tenant changes that.

• The security features are in the expensive tier Single sign-on, multi-factor and the universal directory arrive at $6 per user per month. Adaptive multi-factor, lifecycle management, privileged access and access governance arrive at $17. The gap is exactly the set of controls a security team asks for after its first audit, so the upgrade is not optional in practice, and the bill nearly triples for the same headcount doing the same work.
• You commit for a year before you start Every suite is billed annually, with a $1,500 minimum annual contract for Workforce Identity. That is a floor rather than a fortune, and it still rules out the way most technical decisions now get made: run it for a month, see whether the team adopts it, cancel if it does not. An open-source identity server can be stood up on a Thursday and thrown away on a Friday.
• Your vendor’s support desk is in scope In October 2023 the files customers had attached to support tickets were readable by an intruder, and HAR captures routinely contain live session material. Okta revoked the embedded session tokens and stated that the production service was separate and untouched. Take that at face value and the structural point survives: outsourcing identity means a second organisation holds artefacts about your logins, and its ticketing system is now part of your threat model.
• The corporate jurisdiction does not move Okta, Inc. operates from 100 First Street in San Francisco and certifies under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. framework alongside it. There is a European cell, so European storage is real and available. Legal reach follows incorporation rather than hosting, which is why a company with a European establishment requirement ends up on a page like this one regardless of which cell its org runs in.

What you have to replace, not just match

Okta does four separate jobs and the alternatives here cover them unevenly, so the first task is deciding which of the four you are actually paying for.

One is the employee directory and the federation into it, usually Active Directory or Entra ID, which everything on this page can do. Two is single sign-on into third-party SaaS applications, which depends almost entirely on how many of those applications speak SAML or OIDC. Three is lifecycle management: accounts created when someone is hired and removed when they leave, pushed outwards into those SaaS products. Four is governance — access reviews, certification campaigns, privileged sessions.

The honest picture is that jobs one and two are well covered by open-source identity servers, job three is covered thinly and by extension rather than by default, and job four is barely covered at all. If your Okta subscription exists because an auditor asked for quarterly access certification, no tool on this page replaces it, and you should say so internally before starting.

The alternatives compared

How each alternative compares to Okta

What actually breaks when you switch

Second factors are the visible cost and they land on everyone on the same day. Push approvals, authenticator secrets and registered security keys stay with the identity provider that issued them, so every employee enrols again on the new system.

Run the two providers side by side for a fortnight, enrol people as they arrive, and keep the old tenant alive until the stragglers are through — a single hard cutover produces a queue at the service desk that nobody forgets.

The quieter failure is provisioning. If accounts are currently created in connected applications when somebody is hired and disabled when they leave, that mechanism does not come across, and its absence is invisible until a leaver still has a mailbox three weeks later. Write down every system that is currently provisioned automatically, and decide for each one whether it becomes a script, a separate provisioning tool, or a manual step on a checklist.

Then there is the audit programme. Access reviews, certification campaigns and the reports produced for them are usually built around whatever the incumbent exports, and none of the tools here produces them. Talk to whoever signs off those reviews before the contract renewal date rather than after, because the answer may be that you keep a governance product and replace only the login.

Does self-hosting actually reduce risk, or just move it?

It moves it, and the direction is the whole argument. Running your own identity server removes an external organisation that holds material about your logins, keeps support tickets about your configuration, and has a help desk that can be targeted instead of you. The 2023 incident is the clean illustration: the production service was fine and the support system was the way in.

What you take on instead is patching. An identity server exposed to the internet and left on an old release is a worse outcome than any managed service, and the failure mode is silent. Okta patches on a Tuesday whether or not your team is busy.

The decision therefore rests on one question that has nothing to do with software: is there a named person whose job includes this system, with a deputy. If the answer is no, the subscription is buying something real.

Will I keep single sign-on into all our SaaS tools?

Mostly, with two caveats worth checking before you sign anything. The first is protocol support: any application offering SAML 2.0 or OpenID Connect federates with Keycloak, Authentik or Zitadel without special handling, which today covers the large majority of business software.

The second is the catalogue. Okta ships thousands of pre-built application integrations, so connecting a given product is often a search box and two fields rather than reading its documentation and mapping claims by hand. With an open-source server you do the mapping. It is an hour per application rather than a blocker, but multiply it by the number of applications before you estimate the project.

The applications that genuinely resist are the ones with no federation at all. That is where Authentik’s proxy earns its place, because it puts a login in front of something that never had one.

What about joiners, movers and leavers?

This is where the comparison gets uncomfortable. Okta’s lifecycle management pushes account creation, attribute updates and deactivation outwards into connected applications, and it is a large part of why organisations with real HR churn stay.

Keycloak and Authentik are both strong at the inbound half — reading from LDAP or Active Directory, keeping the existing directory authoritative — and they differ on the outbound half. Authentik speaks SCIM, so pushing accounts into an application that also speaks SCIM is configuration. Keycloak has no equivalent by default, so outbound provisioning is extension work or a separate provisioning tool, and neither of them matches the breadth of connectors Okta sells as lifecycle management.

If someone leaving the company currently loses access to thirty systems automatically, write down what replaces that mechanism before you cancel, because the day this quietly stops working is the day a former employee still has a mailbox.

Is the European cell enough for our compliance team?

It depends which requirement you are answering, and the two are often confused in the same meeting. If the requirement is that employee records are processed in Europe, the EMEA cell answers it, and the org URL on okta-emea.com is the evidence.

If the requirement is that no company outside the union can be ordered to produce those records, the cell does not answer it. Okta, Inc. is in San Francisco and relies on the EU-U.S. Data Privacy Framework for transfers, so the obligation attaches to the company rather than to the data centre.

A useful test: ask whether the rule was written by procurement or by risk. Procurement rules about location are satisfied by the cell. Risk assessments about foreign compulsion are not, and no configuration setting will change that.

Which one to pick

If you have a real directory and a mixed estate of applications, Keycloak is the replacement that was built for your shape of organisation, and the money it saves is the difference between a per-employee suite and a server.

If a meaningful share of what Okta does for you is putting a login in front of internal software that has none, Authentik does that specific job better than anything else here, and it removes the vendor SSO surcharge on anything you host yourself.

If the conclusion is that nobody in the building should be running the identity server, Zitadel keeps the managed relationship and moves the supplier to St. Gallen. That is a smaller change than it sounds and it answers the jurisdiction question honestly.

And if your obligation is quarterly access certification, none of this replaces Okta. Move the authentication if you want to, keep a governance product, and be clear with your auditor that you have split one subscription into two things rather than removed it.