For a UK enterprise already running Microsoft 365 E3 or E5, Microsoft Entra ID Governance is the cheapest route into automated joiner-mover-leaver processes, at £5.40 per user a month on top of licences most enterprises already own. SailPoint and Saviynt cost far more: third-party procurement benchmarking puts typical mid-market contracts at $100,000 to $250,000 a year for SailPoint and $75,000 to $200,000 for Saviynt, before implementation. The gap narrows once non-human identities enter the count.
Key pointers
- Microsoft Entra ID Governance costs £5.40 per user a month (£64.80 a year) as an add-on to Entra ID P1 or P2, which most enterprises already hold through Microsoft 365 E3 or E5.
- SailPoint and Saviynt do not publish per-identity rates. Get a written quote before budgeting either one.
- Expect professional services to add a large share of first-year cost on top of either vendor's licence; ask for licence and services quoted as separate lines (see Pricing and Cost Model for the benchmark figures).
- The three platforms count "identity" differently. Entra ID Governance licenses member users in scope of the feature; SailPoint and Saviynt price per managed identity, which can include contractors, service accounts and bots.
- Microsoft's actual joiner-mover-leaver engine, Lifecycle Workflows, needs the Governance add-on or the Entra Suite. Entra ID P1 or P2 alone will not run it.
- Ask every shortlisted vendor for its exact identity-count definition in writing before comparing quotes line by line.
- A UK enterprise can run Entra ID Governance for Microsoft 365 and Entra-connected apps while keeping SailPoint or Saviynt for SAP and legacy systems, rather than picking one platform for everything.
What Joiner-Mover-Leaver Governance Actually Buys
Joiner-mover-leaver (JML) is the set of rules that decide what access a person gets on day one, what changes when they move teams, and what gets switched off the moment they leave. Done by hand, it means an IT admin working from a spreadsheet or a ticket queue, and it is the most common source of orphaned accounts an auditor finds.
An identity governance and administration (IGA) platform automates that decision. It watches an HR system for a hire, a transfer or a termination, works out the access that role should carry, requests or removes it in every connected system, and keeps a record for the next audit. Microsoft calls this capability Lifecycle Workflows, built around the same three phases: "Joiner: when an individual enters the scope of needing access... Mover: when an individual moves between boundaries within an organization... Leaver: when an individual leaves the scope of needing access." Running it requires an Entra ID Governance or Entra Suite licence; Entra ID P1 or P2 on their own do not include it.
SailPoint and Saviynt do the same job with a wider remit. Both were built to sit in front of on-premises systems, SAP, mainframes and hundreds of SaaS applications at once, running access certifications and separation-of-duties (SoD) checks as well as JML automation. Saviynt describes its platform as helping organisations "accelerate Zero Trust for all human and machine identities in hybrid and multi-cloud environments," including HR-driven onboarding from systems such as Workday and SAP. SailPoint's Identity Security Cloud ships in three tiers, Standard, Business and Business Plus, each adding workflow capacity and AI-driven access recommendations on top of the last.
For a UK enterprise with manual offboarding today, the real decision is not which platform has more features. It is whether the extra reach SailPoint or Saviynt offers over a broader estate of applications and non-human identities is worth several times the annual cost of an add-on most Microsoft shops already qualify for.
Pricing and Cost Model
Microsoft Entra ID Governance, published prices
Microsoft is the only one of the three that lists a price. On its UK pricing page, checked live on 29 September 2026, the figures are:
| Product | List price | Billing | Prerequisite |
|---|---|---|---|
| Entra ID P1 | £5.40/user/month | Paid yearly | None (or included in Microsoft 365 E3, Business Premium) |
| Entra ID P2 | £7.70/user/month | Paid yearly | None (or included in Microsoft 365 E5) |
| Entra ID Governance (add-on) | £5.40/user/month | Paid yearly | Requires P1 or P2 |
| Entra Suite | £9.20/user/month | Paid yearly | Requires P1 |
These are ex-VAT list prices; UK business customers pay 20% VAT on top at invoicing, as with any commercial software purchase. There is no published monthly-rolling rate at these prices; all four are annual-commitment terms.
The practical arithmetic for a UK identity and access management (IAM) lead:
- Already licensed for Microsoft 365 E3 or E5 (which include P1 or P2): the incremental cost of turning on Lifecycle Workflows and entitlement management is the Governance add-on alone, £5.40/user/month, or £64.80 a year per licensed identity.
- Starting from nothing: buying P1 plus the Governance add-on comes to £5.40 + £5.40 = £10.80/user/month, or £129.60 a year.
- Buying the full Entra Suite instead (which also adds Internet Access, Private Access, Identity Protection and Verified ID premium capabilities) costs £9.20/user/month on top of the P1 you would still need, or £110.40 a year for the Suite add-on alone, taking the combined P1-plus-Suite cost to £175.20 a year. That is worth it only if the enterprise also wants those network-access and identity-protection features; for governance alone, the standalone add-on is cheaper.
One licensing detail matters for the "per identity" question in this comparison. Microsoft's own licensing guidance states that "there needs to be as many licenses to include all member users in scope of, or who configures, the Identity Governance features," using the example that 2,000 employees eligible to request access packages need 2,000 licences even if only 150 ever use them. That is a licence count based on eligible human users, not a count of every service account, script or bot Entra also happens to manage.
SailPoint and Saviynt, quote-only
Neither vendor lists a price. SailPoint's own suites page and Saviynt's own IGA capabilities page each end in a demo request, not a price table. Both price per managed identity, a figure that, per IdenHQ's buyer research, "include[s] every entity requiring access governance - employees, contractors, service accounts, RPA bots, and increasingly, AI agents," which is why two enterprises with the same headcount can receive very different quotes.
Buyers should expect a genuine quote to break into at least four components: the base per-identity licence (which varies by suite tier and identity volume), implementation and professional services, ongoing support, and any add-on modules such as non-employee risk management, machine identity security or cloud infrastructure entitlement management. None of these line items has a public rate card for either platform, so a quote that arrives as one bundled number is worth pushing back on.
For scale, one benchmark is public. Vendr, a procurement platform that negotiates SaaS contracts and publishes anonymised buyer data, reports a median SailPoint contract of $109,835 a year across 39 tracked purchases, ranging from $21,086 to $528,594. Converted at $1 = £0.75 (the mid-market rate xe.com published on 18 September 2026), that median is about £82,000, with tracked deals spanning roughly £15,800 to £395,000. The same benchmark's SailPoint-versus-Saviynt comparison lists a "typical contract minimum" of $100,000 to $250,000 a year for SailPoint at mid-market (about £75,000 to £187,000) and $75,000 to $200,000 for Saviynt (about £56,000 to £150,000), with professional services commonly adding 30-60% of first-year cost for SailPoint and 25-50% for Saviynt. On a $250,000 SailPoint licence, that is a further $75,000 to $150,000 in year one before training, connector development or premium support. Treat these as one data point on market scale, not a quote: a real UK enterprise negotiation will be priced in GBP directly and will move on identity count, module scope and contract length.
Neither vendor's published material states a per-identity rate, so do not accept a headline "£X per identity" figure from a reseller without first agreeing, in writing, exactly which identities that figure counts.
Vendor and Option Comparison
| Criterion | Microsoft Entra ID Governance | SailPoint Identity Security Cloud | Saviynt Enterprise Identity Cloud |
|---|---|---|---|
| List price | Published: £5.40/user/month add-on | Not published; quote only | Not published; quote only |
| Typical UK enterprise entry cost | £64.80/identity/year on top of existing P1/P2 | About £75,000-£187,000/year (mid-market range, plus 30-60% services) | About £56,000-£150,000/year (mid-market range, plus 25-50% services) |
| Identity model | Per licensed member user in scope | Per managed identity, humans and machines together | Per managed identity, humans and machines together |
| Non-human identity governance | Limited; built around Entra-registered users and workload identities licensed separately | Machine Identity Security and Agent Identity Security available as paid add-ons | Native converged coverage across human and machine identities |
| Best fit | Microsoft-centric estates already on E3/E5, with most access sitting in Entra-connected apps | Complex, legacy or on-premises estates (SAP, mainframe) needing deep certifications and SoD | Cloud-first or hybrid estates wanting IGA, cloud entitlement and third-party access in one platform |
| Weak fit | Heavy on-premises legacy systems, deep SoD across ERP, non-Microsoft-heavy estates | Organisations under about 5,000 identities without a dedicated IAM team | Organisations that need SailPoint's deeper SAP/ERP-specific certification depth |
| UK presence | Delivered through the standard Microsoft CSP/EA channel | SailPoint has UK sales and public-sector teams; Currys deployed SailPoint Access Risk Management across AD, ServiceNow and SAP SuccessFactors in the UK | Saviynt has a London office; its UK & Ireland regional VP has cited a large-scale governance rollout for The Adecco Group covering "over 10,000 users" |
Do not read the Currys or Adecco Group examples as an endorsement of either platform's superiority: both come from vendor-published customer stories and a sponsored interview, not an independent comparison, and neither claims to have run all three platforms side by side. They confirm live UK enterprise use, nothing more.
For an identity and access management lead currently running manual offboarding, the shape of the decision is this. If most of the workforce's access already sits inside Microsoft 365, SharePoint, Teams and Entra-connected SaaS apps, the Governance add-on is very likely to cover the joiner-mover-leaver problem at a fraction of SailPoint or Saviynt's cost, and it is worth trialling before signing anything larger. If a meaningful share of access sits in SAP, a mainframe, or other systems Entra does not reach natively, or the organisation needs to govern tens of thousands of service accounts and bots to the same standard as employees, the wider reach of SailPoint or Saviynt starts to justify the extra spend, and the choice between those two comes down to on-premises depth for SailPoint against cloud-native breadth and faster deployment for Saviynt.
Editorial analysis
None of the three vendors will hand a UK enterprise a like-for-like number without a scoping call, and that is by design: per-identity IGA pricing is a negotiation, not a list price. The one hard number in this comparison is Microsoft's own £5.40 add-on, because Microsoft chose to publish it. That asymmetry should shape how an IAM lead runs the process, not the outcome. Take the Entra ID Governance cost as the floor to beat, get SailPoint and Saviynt to quote against the same identity count and the same scope of applications, and insist that both break out licence and professional services as separate lines, because market benchmarking on professional services shows it can add more to year one than the licence itself. A quote that bundles them together is harder to negotiate down later.
Sources
- Microsoft Entra Plans and Pricing (UK) - Microsoft
- Microsoft Entra ID Governance licensing fundamentals - Microsoft Learn
- What are lifecycle workflows? - Microsoft Learn
- Microsoft Entra licensing - Microsoft Learn
- Suites - Identity Security Cloud - SailPoint
- Currys customer story - SailPoint
- Identity Governance & Administration (IGA) Capabilities - Saviynt
- Q&A with Daniel Wicks of Saviynt - Computing (sponsored content)
- SailPoint Software Pricing & Plans 2026 - Vendr
- IGA Pricing 2026: True Cost, SCIM Tax & TCO Guide - IdenHQ
- Currency Table: USD - XE.com
