Per managed employee, billed monthly or annual (−15%). No platform fee, no SSO tax, no implementation fee. The free tier actually disables accounts.
Local-first / privacy-first
Core SMB · annual · min $150/mo
Compliance-driven · annual
Volume · annual
Billed per active employee whose lifecycle you manage in the period — not per IT seat. Annual billing −15%.
The honest version. Same $6–$13 real-JML band — but device return, portable evidence, and no SSO tax come included, not as extra modules or not at all.
| Capability | Passage | Rippling (IT) | Okta Lifecycle | BambooHR + IT |
|---|---|---|---|---|
| Headline price for real JML | $7.50 Pro / $13 Teamper managed user/mo · no base | ~$8 platform base+ Device ~$8 + App ~$7 modules | ~$4 LCM add-onrequires ~$14 Core base (SSO tax) | $10–$25 Core–EliteIT onboarding is an add-on |
| Implementation / onboarding fee | None — self-serve | $2k–$20k+ | Pro services common | 5–15% of annual |
| Free tier that actually disables accounts | Yes | No | No | No |
| Real deprovisioning (disable + revoke sessions) | Yes — core | Yes | Yes (mature SCIM) | Checklist, not real provisioning |
| Ends access in non-federated SaaS (seat and OAuth token revoke) | Yes — both halves, both critical | SCIM seat; token revoke uneven | Federated only; non-fed left open | No |
| OAuth-grant discovery (finds shadow apps) | Yes — covered/uncovered | No | No | No |
| Residual-token closure gate (can't close with token live) | Yes — hard block | No | No | No |
| License-reclamation savings in the evidence | Yes — $/mo & /yr rollup | Seat reports, separate | No | No |
| Automated provisioning + human tasks in one run | Yes — both, gated | Provisioning-led | Provisioning only | Tasks only (no real provisioning) |
| Device-return enforced as a closure gate | Yes (via Cairn) | Device mgmt, not gated to offboarding | No device return | No device return |
| Mover diff — revoke stale access on role change | Yes — critical revoke steps | Role-based | Partial | No |
| Scheduled & bulk JML runs | Yes | Yes | Via policies | Manual |
| Hash-anchored, portable audit evidence | Yes — exportable | Logs inside the platform | Logs inside the platform | No |
| Cross-framework compliance push (SOC 2 / HIPAA / NIST 800-171 / CMMC) | Yes — built in | Indirect | No | No |
| No SSO tax / no platform fee | Yes | Platform fee | SSO tax (Core base) | HR platform required |
| BYO-key AI (no inference markup) | Yes | No | No | No |
| MSP multi-tenant console | Yes — $6/user | Limited | Enterprise motion | No |
| Full HR / payroll / benefits | No — by design | Yes | No | Yes |
Rippling charges $2k–$20k+ and BambooHR 5–15% of annual just to onboard. Passage is self-serve from the free tier — your first leaver run takes minutes.
Okta's $4 Lifecycle Management add-on only runs on top of a ~$14/user Core Essentials base. Passage's $7.50 Pro is the whole price — nothing to buy underneath it.
Device-return enforcement and hash-anchored, portable audit evidence are part of Pro — Rippling bills device mgmt as a separate module, and Okta/BambooHR don't return devices at all.
Pricing reflects publicly reported 2026 list figures: Rippling base + module PEPM and $2k–$20k+ implementation (PeopleManagingPeople, costbench); Okta LCM ~$4 add-on on ~$14 Core (AccessOwl); BambooHR Core $10 / Pro $17 / Elite $25 + implementation 5–15% of annual (PeopleManagingPeople). Vendor pricing and capabilities change — verify current terms directly.
No. No platform fee, no SSO tax, no paid implementation. Okta gates its $4 Lifecycle add-on behind a ~$14/user Core base; Rippling and BambooHR charge $2k–$20k or 5–15% of annual to onboard. Passage is self-serve from a free tier that actually disables accounts.
You pay per active employee whose lifecycle you manage in the billing period — the joiner-mover-leaver subject pool — not per IT seat. This matches the Okta / AccessOwl / Console convention and aligns price with value.
The free tier caps at 5 automated runs/month and can't push evidence to Sightline/Bastion. Teams upgrade to Pro for unlimited runs, all four identity connectors, the residual-token closure gate, the license-reclamation savings rollup, device lifecycle, and signed evidence push — the compliance buyer's must-have. Team adds the non-federated SaaS connectors that run two-step deprovisioning and OAuth-grant discovery.
Yes — that's the point. Disabling Okta/Entra/Google only stops single sign-on; non-federated SaaS like GitHub, Salesforce, Atlassian, Zoom and Slack keep their own tokens. On Team, Passage runs two steps per app — remove the seat and revoke the OAuth grant/token — discovers shadow apps no template anticipated, and the closure gate hard-blocks if a seat was removed while its token is still live. (Live connector calls are simulated behind a boundary in this build; the orchestration, the gate, and the hashed proof are real.)
We compare on the IT joiner-mover-leaver job. Rippling and BambooHR also do full HR/payroll/benefits, which Passage deliberately does not — that's noted in the table. The numbers cite public 2026 list pricing; we link the sources and recommend verifying current terms directly.
No card, no implementation call. Local-first — the free tier disables accounts for real.
Start free