JumpCloud alternatives: 11 identity and access management tools compared
People look for a JumpCloud alternative when per-user product pricing adds up, when they want a directory they host themselves, or when they only need single sign-on and not device management. Others outgrow the 300-user ceiling of the Platform Essentials package or want a vendor that charges VAT-inclusive invoices in Europe. Most moves go to open source servers or to the suite of an existing productivity vendor.
Short answer: The first three alternatives to JumpCloud in our identity and access management software ranking are Keycloak, authentik and Zitadel. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Choose Keycloak if you want to stop paying per user and can staff the server. The 11 entries that follow are all ranked in Best Identity and Access Management Software in 2026; each one explains what sets it apart from JumpCloud.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
Pricing: Per user per month, published for single products; packages quoted; 30-day trial
Established in: United States
Built for: IT teams that manage laptops, logins and Wi-Fi from one console
Not for: Software vendors wanting login for their own customers
01
Why buyers look past JumpCloud
01
Products are priced one by one
JumpCloud lists packages and single products per user per month. On annual billing the SSO package costs 11 dollars, Device Management 9 and Device Identity Management 13, with monthly billing at 13, 11 and 15. Single products such as MFA or Cloud LDAP are 3 dollars annually. Adding several of them narrows the gap to a package quickly.
02
The bigger packages are quoted, with a cap
Platform Essentials, Platform and Platform Prime show no price on the page we read, and Essentials stops at 300 users. A growing company therefore moves to a negotiated plan at a size it cannot predict. Suspended users stay in the system and are billed as normal users, so a leaver costs money until you delete the account.
03
Billing terms suit a US buyer
Prices exclude VAT, and the page says JumpCloud is not VAT-registered. Payment is by card or ACH, with invoicing only for accounts billing over 2,000 dollars a month. A European finance team that wants an EU invoice and a local entity may prefer a vendor that sells that way.
your need is polished sign-in screens inside a web product, not workforce devices
#6
03
What each one does differently
1
Keycloak
Not stated by the vendor · See profile
Keycloak comes from the Cloud Native Computing Foundation under Apache 2.0, so no vendor can raise a seat price or end a plan. Your own staff install, upgrade and secure it. Its realm export guide says the export is not a backup and omits events and persisted sessions. It handles directory and sign-on only; endpoint management stays elsewhere.
Switch from JumpCloud if you want to stop paying per user and can staff the server.
authentik is a self-hosted identity provider whose MIT-licensed core covers OIDC, SAML, LDAP, SCIM and RADIUS, the protocols a JumpCloud directory typically serves. The vendor, Authentik Security Inc. of Delaware, pledges not to move open features behind its paywall. There is no hosted version, and paid support starts above a minimum yearly spend.
Switch from JumpCloud if you used JumpCloud mainly for LDAP, RADIUS and SSO and will run PostgreSQL yourself.
Zitadel is offered as a cloud service or as AGPL-3.0 code you run on PostgreSQL. The cloud free tier stops at 100 daily active users, while Pro charges a flat monthly sum with 25,000 included. It says it was founded in Switzerland, though the footer now lists a San Francisco address. It does not manage laptops.
Switch from JumpCloud if you want a hosted or self-hosted directory with a flat price rather than a per-seat charge.
FusionAuth is a proprietary server from Inversoft LLC that you download. Community edition costs nothing to run on your servers, with PostgreSQL and OpenSearch in the reference install. Breached-password detection and SCIM sit in paid tiers, and Starter carries community support only. It is aimed at application login more than at staff laptops.
Switch from JumpCloud if your main need is sign-in for your own applications on infrastructure you control.
Ory sells the same components as Apache 2.0 code and as the hosted Ory Network. Usage is metered per active user, machine token and permission check, and the developer tier has no production environment. B2B authentication starts at Growth, whose yearly fee is many times Production. It is a toolkit for engineers, not an admin console for staff.
Switch from JumpCloud if your developers will assemble identity into a product and want open components.
Entra ID is the natural next stop for a business already running Microsoft 365: the Free edition covers MFA, unlimited SSO and password self-service, though an Azure subscription is required. Conditional Access and passwordless arrive with Premium P1. Logs are kept for seven days on Free and 30 on P1. It assumes a Microsoft tenant.
Switch from JumpCloud if most of your staff and apps already sit inside a Microsoft tenant.
Okta, Inc. sells suites rather than single products. Starter bundles SSO, MFA and Universal Directory, while adaptive MFA, lifecycle management and access governance wait in Essentials. Every suite is billed annually and workforce identity carries an annual contract minimum, so a very small team pays a floor. Professional and Enterprise are priced on request.
Switch from JumpCloud if you want a broad set of integrations and can commit to a yearly contract.
Ping Identity, based in Denver, assumes large estates: Workforce Essential is shown per user per month but expects an annual contract with a minimum of 5,000 users. Customer identity is priced from a yearly floor. LDAP and Kerberos connect through gateways. A 30-day trial is offered, yet the minimum rules out most small firms.
Switch from JumpCloud if you run thousands of staff and need orchestration across mixed legacy systems.
Auth0 LLC is a subsidiary of Okta, Inc. and meters customer logins by monthly active users. The free plan allows 25,000, after which paid tiers are priced on a slider starting at 500 users, so the bill steps up. Self-service SSO and SCIM sit in separate B2B tiers. Password hashes leave through a PGP-encrypted support case.
Switch from JumpCloud if you are building a customer-facing app and have outgrown a simple staff directory.
WorkOS, Inc. of San Francisco sells to software vendors that must give business customers SAML single sign-on. AuthKit is free up to one million monthly active users, but each SSO or Directory Sync connection carries a monthly charge, unrelated to the customer's headcount. It is a developer service and not a staff directory.
Switch from JumpCloud if you ship software and need to offer enterprise SSO to your own customers.
Clerk, Inc. supplies drop-in sign-up and profile components and counts a user only once they return 24 hours or more after signing up. Hobby covers 50,000 such users per app but fixes sessions at seven days, and one SSO connection arrives only with Pro. Users leave as a CSV export, hashed passwords included.
Switch from JumpCloud if your need is polished sign-in screens inside a web product, not workforce devices.
Keycloak: It is Apache 2.0 under the CNCF, with no licence fee; your staff carry installation and upgrades.
02
You still need LDAP and RADIUS for network gear
authentik: Its MIT core covers LDAP and RADIUS beside OIDC, SAML and SCIM, and you run it on PostgreSQL.
03
You want a flat monthly price instead of a seat count
Zitadel: Pro bills a flat monthly sum with 25,000 daily active users included; the free cloud tier stops at 100.
04
Your company already runs on Microsoft 365
Microsoft Entra ID: The Free edition has MFA and unlimited SSO, but an Azure subscription is required and logs are kept seven days.
05
You are past 300 users and want a large vendor
Okta: Starter bundles SSO, MFA and Universal Directory, billed annually with a contract minimum.
04
When JumpCloud is still the right choice
JumpCloud remains a sound choice when one small IT team has to manage identity and laptops together. Its site lists a cloud directory, Cloud LDAP and RADIUS, SSO, and device management for Windows, Apple, Linux and Android in one console. Separate tools for each job would cost more effort than the per-seat price you save, and the 30-day trial gives full functionality to test that.
05
What moving off JumpCloud involves
01
Devices and directory are two migrations
JumpCloud holds both user accounts and enrolled devices. A replacement identity server will not manage those machines, so decide first which tool takes over patching and MDM. Unenrol devices in an order that never leaves a laptop without a working login.
02
LDAP and RADIUS clients need repointing
Printers, Wi-Fi controllers and Linux servers that authenticate against Cloud LDAP or Cloud RADIUS must be given the new server address and bind credentials. List them before the cutover and test each one with a pilot group.
03
Plan the billing overlap
Billing is monthly in arrears and the contract runs for its full period, so check your term before cancelling and keep the old tenant until the new one is verified.
06
Questions about replacing JumpCloud
6 answers
How much does JumpCloud cost per user?
On the pricing page we read, SSO is 11 dollars per user per month billed annually and 13 monthly, Device Management 9 and 11, and Device Identity Management 13 and 15.
Single products such as MFA, SSO, Cloud LDAP and Cloud RADIUS are 3 dollars annually and 4 monthly. Prices exclude VAT.
Is there a free JumpCloud plan?
The pricing page describes a 30-day trial with full platform functionality and Premium Support, and no permanent free tier. After the trial you pay per user.
What is the cheapest open source replacement?
Keycloak under Apache 2.0 and authentik with an MIT core carry no licence fee. The cost is the staff time to run, patch and back them up, and neither replaces device management.
Which alternatives cover LDAP and RADIUS?
authentik lists LDAP and RADIUS in its MIT core. The others are mainly sign-on and application login, so check protocol support in their documentation before you commit.
Does an alternative also manage laptops?
Not in this list on the evidence we checked. If you leave JumpCloud for an identity server, plan a separate endpoint management tool, or keep JumpCloud's Device Management product, listed at 9 dollars annually.
Which options suit a team over 300 users?
Entra ID, Okta and Ping Identity are built for larger estates, though Okta and Ping carry yearly contract floors. Ping's Workforce Essential assumes a 5,000 user minimum.
—
Sources
Checked 4 November 2026
JumpCloud pricing: Package and single-product prices, 300-user cap on Platform Essentials, 30-day trial, billing terms, VAT note, suspended users billed.
JumpCloud home: Cloud Directory, Cloud LDAP and RADIUS, SSO, device management for Windows, Apple, Linux and Android.
Founder of The Knowledge Engineers and of 2 Steps Ahead, an AI search visibility agency. Editorially responsible for every page on this site; research and drafting are AI-assisted.
Checked and edited by Sebastiaan Smits, last on 4 November 2026. The editorial process explains the method.
