Tenure
Scheduled Sep 12, 2026Joiners, movers and leavers, provisioned on day one.
Replaces
- Okta Lifecycle Management · Okta, Inc. — no published list price
- Microsoft Entra ID Governance · Microsoft Corporation — $7 per seat per month (Microsoft Entra ID Governance), about $33,600/yr at 400 seats
Rented, per year
$33,600
Microsoft Entra ID Governance list price at 400 seats.
Owned, per year
$10,320
AWS infrastructure only. Azure is $10,980.
Build
14 weeks
3 engineers. To parity on the ten core features above, including HRIS feed integration, ten named provisioning targets, migration of existing birthright rules with a side-by-side dry run against live population, and AD write-back agent deployment.
Difficulty
4/5
Substantial. Compliance or realtime depth involved.
Reference organisation: 15,000 workers including 2,500 contractors, ~40,000 lifecycle events/year, 22 provisioning targets, single region, prod + non-prod. 3-year Compute Savings Plan on Fargate, 3-year reservation on Container Apps and PostgreSQL Flexible Server. Includes Step Functions Standard at the stated event volume and seven-year audit retention on immutable storage. Excludes the on-prem AD agent host, vendor support plans and LLM gateway token spend. Figures are infrastructure only and exclude the build.
What it is
Tenure automates the identity lifecycle: it reads worker events from the HR system of record, computes birthright access from position, department, location and cost centre, and provisions, changes or revokes accounts in every downstream system on the effective date. It is for organisations of 3,000 to 40,000 workers with meaningful contractor populations, where onboarding still involves a ticket queue and offboarding leaves accounts alive for weeks. Tenure keeps the rules that decide who gets what as reviewable code, running against your own data.
Why this one stops making sense
- Entra ID Governance is $7 per user per month but requires Entra ID P1 or P2 underneath, so the honest number is $14 to $17. At 15,000 workers that is $2.5 million to $3.1 million a year.
- Okta stopped publishing a standalone Lifecycle Management price, which means the only way to know what it costs is to enter a sales cycle.
- The measurable failure is termination latency. Every day an account outlives the worker is an audit finding, and the SLA on that is set by your own automation, not by a licence tier.
- Birthright access rules encode your organisational design. They change every reorg, and they should be a pull request with a diff, not a rule builder nobody has permission to touch.
- Downstream provisioning breaks quietly. When it is your code, a failed provisioning task pages someone; when it is a platform, it lands in a report you read next quarter.
What ships
- Worker event ingestion from Workday, SAP SuccessFactors, BambooHR or a generic HRIS feed, with effective dating
- Birthright access computed from position, department, location, cost centre, manager and employment type
- Pre-hire provisioning: accounts created and staged before day one, activated on the effective date
- Mover handling that computes the difference between old and new entitlement sets and applies both grants and revocations
- Termination orchestration with immediate session revocation, credential disable and staged data handover
- Contractor and non-employee lifecycle with sponsor, expiry date and mandatory re-attestation
- Downstream provisioning over SCIM 2.0, native APIs, LDAP and CSV drop for systems with no API
- Dry-run mode that simulates a reorg or rule change against live population before anything executes
- Per-target reconciliation that detects drift between intended and actual state and repairs it
- Full lifecycle audit: what was granted, when, by which rule version, and on which HR event
Data model
Stack
- frontend
- Next.js 15 App Router + Tailwind + TanStack Query, with a rule-impact preview that renders the affected population before apply
- backend
- NestJS on Node 22 — REST, plus a rules engine and a per-target provisioning worker pool
- database
- PostgreSQL 16 with Row Level Security and bitemporal worker records so any past state is reconstructable
- cache
- Redis 7 for target rate limiting, in-flight task deduplication and rule evaluation memoisation
- queue
- BullMQ with per-worker FIFO ordering so a hire, transfer and exit for the same person never execute out of sequence
- auth
- OIDC against the customer IdP, with step-up required to publish a rule change
- search
- PostgreSQL tsvector across workers, rules and provisioning history
- ai
- Optional rule-drafting assistance that proposes a birthright rule from an existing population, reviewed by a human before merge
Parity, honestly
What we match, and what we do not.
The rows marked No are the important ones. If one of them is the reason you bought Okta Lifecycle Management, keep buying it — and we will tell you that on the first call rather than the fifth month.
| Capability | Okta Lifecycle Management | Ours | Note |
|---|---|---|---|
| HRIS-driven joiner, mover and leaver automation | Yes | Yes | — |
| Birthright access from worker attributes | Yes | Yes | Rules are TypeScript with a test suite; a reorg is a pull request with a diff of who gains and loses what. |
| SCIM 2.0 outbound provisioning | Yes | Yes | — |
| Effective-dated future events (pre-hire, planned transfer, planned exit) | Yes | Yes | — |
| Contractor lifecycle with sponsor and expiry | Yes | Yes | Expiry is enforced, not advisory. Access ends on the date unless a sponsor re-attests. |
| Drift reconciliation against downstream targets | Partial | Yes | Runs nightly per target and produces a repair plan you can approve or apply automatically. |
| Dry-run simulation of a rule change against live population | Partial | Yes | The single most useful feature during a reorg, and the one most platforms make hardest. |
| Pre-built provisioning connectors for thousands of SaaS applications | Yes | No | Okta's integration network and Entra's gallery cover thousands of applications with maintained provisioning schemas. Tenure ships SCIM plus native connectors for the ten systems in your critical path. If you provision into eighty applications, the gallery is what you are paying for. |
| Vendor-run SOC 2 Type II and ISO 27001 attestation | Yes | No | Tenure inherits your own compliance posture. A system that creates and destroys accounts across the estate attracts auditor attention, and if a third-party attestation is the control your auditor accepts, keep buying it. |
| On-premises Active Directory write-back | Yes | Partial | Tenure ships an agent for AD account creation, group membership and disable. Exchange on-premises mailbox provisioning is a separate scope. |
| Access request and approval front end | Yes | Partial | Tenure handles birthright and rule-driven access. Discretionary request-and-approve belongs in Warden, and the two share one entitlement model. |
| Entitlement management with access packages and time-bound assignment | Yes | Yes | — |
| Termination latency measured and alerted | Partial | Yes | Time from HR termination event to last credential disabled is a first-class SLO with an alert, not a report. |
Reference architecture
Built twice, on purpose.
Every application in Techtons ships with a production architecture for AWS and one for Azure, using the same diagram grammar so you can read them side by side. Your cloud, your account, your bill.
Amazon Web Services
- Compute
- ECS Fargate services (api, rules, provisioner) behind an ALB, with a separate Fargate task per high-volume target
- Data
- Aurora PostgreSQL, ElastiCache Redis
- Storage and edge
- S3 for HR feed archives and CSV drops to systems without an API, with Object Lock on the audit archive
- Identity
- Cognito federated to the customer IdP
- Observability
- OpenTelemetry to CloudWatch and X-Ray, with termination latency as a published SLO
- Infrastructure as code
- Terraform, one module per environment, remote state in S3 with a DynamoDB lock
Services
The decision worth arguing about
The non-obvious decision is running the lifecycle workflow on Step Functions Standard rather than as application code in the worker, and accepting that it is slower and more expensive. A termination fans out to eleven targets, three of which need a human decision — who inherits the mailbox, who takes the open approvals, what happens to the shared credentials — and can therefore sit unresolved for days. Express workflows cap at five minutes, so Standard is the only option, and Standard bills per state transition: about 25 transitions per worker event at $0.000025 each, which at 15,000 workers and 40,000 events a year is trivial in money and significant in latency, roughly 60ms added per step. What you buy is that every state transition is durably recorded by AWS outside your own database, so when an auditor asks why a contractor's Salesforce account survived their end date by nine days, the execution history answers it without anyone trusting our own logging. For a system whose entire purpose is proving that access ended when it should have, an independent record of the workflow is worth more than the milliseconds.
Microsoft Azure
- Compute
- Azure Container Apps (api, rules, provisioner) with a dedicated app per high-volume target, plus a Container Apps job for nightly reconciliation
- Data
- Azure Database for PostgreSQL Flexible Server, Azure Cache for Redis
- Storage and edge
- Blob Storage with immutable policy for audit archives and CSV drops
- Identity
- Microsoft Entra ID, with the AD write-back agent running on a customer-managed VM in the on-prem network
- Observability
- Azure Monitor with Application Insights, termination latency as a Log Analytics alert rule
- Infrastructure as code
- Bicep in an azd-compatible layout
Services
The decision worth arguing about
Azure's ordering guarantee is the thing to get right, and it is easy to get wrong because Service Bus makes the wrong option look correct. A worker can be hired, transferred and terminated inside the same HR export batch — this is normal for seasonal and contract populations — and applying those three events out of order leaves an active account for someone who has left. Service Bus sessions give per-worker FIFO, so the obvious design keys sessions on worker ID. The catch is that a session is locked to one consumer for its duration, and Container Apps scales replicas on queue depth: KEDA sees a 40,000-message backlog after a nightly HR export, scales to thirty replicas, and twenty-nine of them sit idle because the messages belong to sessions already held. The fix is to scale on active session count rather than message count, which KEDA supports but which no example shows, and to cap prefetch at one per session. The trade is that a large batch drains in about 25 minutes instead of the four an unordered fan-out would take, which is the right side of the trade when the alternative is a live account for a terminated worker.
Sources
Every price on this page, with the page we read it from and the date we read it.
| Product | Plan | List price | Checked | Source |
|---|---|---|---|---|
| Okta Lifecycle Management | Lifecycle Management (add-on) | Not published | 2026-09-05 | www.okta.com/pricing/ Okta no longer publishes a standalone list price for Lifecycle Management; its pricing page sells it inside the Workforce Identity Core Essentials suite at $14 per user per month, bundled with Adaptive MFA and SSO, and directs buyers to sales for individual product pricing. |
| Microsoft Entra ID Governance | Microsoft Entra ID Governance | $7 / seat/month | 2026-09-05 | www.microsoft.com/en-us/security/business/mi Priced per user per month on an annual commitment, and sold as an add-on that requires Entra ID P1 or P2 underneath, so the real cost per user is $14 or $17. |
Should you still be paying for Okta Lifecycle Management?
Two weeks, fixed price. We audit what you actually use, map it against Tenure, cost the replacement on your own AWS or Azure account, and give you a delivery plan. If the honest answer is to keep the licence, that is what the report will say.