As a practitioner deeply invested in self-hosted identity and access management solutions, I find the current discourse around cloud-only IAM platforms to be lacking a critical perspective: that of data sovereignty and architectural autonomy. For a nascent startup with a compact, technically adept team of five engineers, the default trajectory often points directly to Microsoft Entra ID (formerly Azure AD), especially within a Microsoft 365 ecosystem. However, I would posit that this is precisely the moment to evaluate whether a self-hosted, open-source alternative like ForgeRock’s Open Identity Platform (or its commercial offerings) could provide greater long-term strategic value, despite its steeper initial operational overhead.
The core of my argument hinges on control and portability. Entra ID is a quintessential SaaS product—you are leasing an identity fabric that is deeply integrated with Azure and Microsoft services, but ultimately, your directory data, authentication flows, and policy enforcement are managed within a proprietary black box. For a startup, the immediate benefits are clear:
* **Rapid deployment and minimal maintenance:** Microsoft handles all infrastructure, scaling, security patches, and high availability.
* **Seamless integration:** If you are using Microsoft 365, the integration is essentially turnkey for user provisioning and Single Sign-On.
* **Predictable (initial) cost:** The per-user licensing within a Microsoft bundle can appear economical at this scale.
Conversely, a self-hosted ForgeRock (or even its open-source core components) stack introduces complexity but offers distinct advantages that align with a philosophy of decentralization:
* **Data Residency:** You dictate exactly where your identity data (user objects, sessions, tokens) is stored—be it on-premises or in a cloud VM you control. This is non-negotiable for certain regulatory postures.
* **Protocol Flexibility and Extensibility:** While Entra ID supports standard protocols (SAML, OIDC, OAuth 2.0), a self-hosted solution allows you to modify, extend, or audit the entire authentication and authorization workflow. Need a custom connector for a niche internal tool? You can build it.
* **Avoiding Vendor Lock-in:** Your IAM strategy becomes infrastructure-agnostic. Migrating cloud providers or adopting a hybrid model does not necessitate a complex identity migration project.
The technical burden for a 5-engineer team, however, is substantial. Deploying a production-grade ForgeRock instance requires expertise in:
* Container orchestration (e.g., Docker Compose or Kubernetes for the various components: AM, IDM, DS).
* Secrets management and TLS certificate lifecycle.
* Designing a resilient and backed-up data store (e.g., for the OpenDJ directory).
* Ongoing monitoring, logging, and security hardening.
A minimal, non-production `docker-compose.yml` to evaluate the stack might look like this, but it is merely the starting point of a significant journey:
```yaml
version: '3.8'
services:
openam:
image: forgerock/openam:latest
ports:
- "8080:8080"
- "8443:8443"
environment:
- SERVER_URL= http://openam:8080
- AM_CONFIG_DIR=/home/forgerock/openam
volumes:
- am-data:/home/forgerock/openam
opendj:
image: forgerock/opendj:latest
ports:
- "1389:1389"
- "1636:1636"
environment:
- ROOT_PASSWORD_FILE=/var/run/secrets/opendj.pw
volumes:
- dj-data:/opt/opendj/data
volumes:
am-data:
dj-data:
```
My question to the community, particularly those who have navigated this crossroads, is multifaceted: For a small, engineering-heavy startup where the team *could* theoretically manage the infrastructure, does the long-term strategic benefit of owning your identity layer outweigh the undeniable operational convenience of Entra ID? Are there hybrid approaches—perhaps using Entra ID for workforce access but a self-hosted solution for customer identity (CIAM) scenarios—that have proven effective? I am particularly interested in concrete experiences regarding the total cost of ownership over a 3-year horizon, factoring in not just licensing but engineering hours for setup, maintenance, and troubleshooting.
Take back control
I'm the lead backend engineer at a 25-person SaaS startup, and we've been running Entra ID in production for two years after migrating from Auth0. I haven't run ForgeRock myself, but I did a deep evaluation for a previous consultancy, and the operational overhead was the deciding factor.
**Deployment and upkeep time:** Entra ID was functional for our basic auth needs in an afternoon. ForgeRock, even using their containers, required 2-3 days to get a pilot node tuned and linked to our apps. You're looking at ongoing tuning and monitoring, which for a 5-engineer team is a real tax on bandwidth.
**Real-world costs:** Entra ID for us is bundled in our Microsoft 365 Business Premium licenses at about $22/user/month. ForgeRock's commercial support for a team that small would likely start in the $15k-$20k/year range minimum, plus the AWS/Azure compute costs for your VMs or containers, which can add another $500-$1000/month. The open-source version is "free" but your team's time is not.
**Where ForgeRock breaks:** It's powerful, but complexity is its weakness. Schema changes, certificate rotations, and policy updates all require manual, careful configuration. We saw latency spikes under load if the cache wasn't sized right, and debugging flows meant combing through server logs. Entra just works, but you can't see the gears turning.
**Where ForgeRock clearly wins:** If you have regulatory requirements forcing data to stay in your own VPC, or if you need to deeply customize authentication journeys in ways a SaaS provider would never allow, ForgeRock is your only real option. It's a heavyweight, but it bends to your will.
I'd recommend Entra ID for your team, hands down, unless you have a hard requirement for on-premise data residency or need an auth flow so custom it can't be built with Entra's external ID. If those are your constraints, tell us, because that's the only way ForgeRock's operational burden makes sense for a team your size.
You're framing this as if "time to functional" is the only metric. Sure, Entra got you auth in an afternoon. That's a vendor lock-in free trial.
The deeper cost you're missing is the exit fee later. When your pricing is tied to Microsoft 365 per-user bundles, scaling your workforce becomes an IAM cost negotiation. ForgeRock's complexity means you own the learning curve upfront, not when you try to decouple from a platform later.
Your cost comparison is also incomplete. You're bundling Entra's price, but what's the cost when your 5-engineer startup needs a feature outside Entra's roadmap? With a self-hosted platform, you can build or fork it. With Entra, you submit a ticket and wait. For a team of engineers, that's a bigger tax on bandwidth than server monitoring.
Trust but verify.
Control and portability sound great in a slide deck. You're leasing your identity fabric either way. With Entra, you're leasing infrastructure and uptime. With ForgeRock, you're leasing your own engineering time to keep the lights on.
That "architectural autonomy" means you now own the blame when the auth server hiccups during a demo. Your five engineers get to be on-call for IAM patching instead of building your product. Strategic value tends to evaporate when you're debugging LDAP sync at 2am.
The proprietary black box argument is a red herring. Your directory data in Entra is still your data. You can get it out. The real lock-in isn't the data, it's the convenience. Good luck convincing your team to give that up.
CRM is a necessary evil
Your point about ongoing tuning and monitoring is well taken, but I think the comparison of the $22/user/month bundled cost to ForgeRock's cost is misleading. That $22 isn't just for Entra ID, it's for an entire Microsoft 365 suite. If you don't need Word, Exchange, and Teams, you're paying for them anyway, which inflates the perceived IAM cost.
A fairer comparison would be the standalone Entra ID P1 license, which is around $6/user/month. For a 5-engineer team, that's only about $360/year. Even adding the compute costs you mentioned, ForgeRock's commercial support starting at $15k makes the cost differential stark from year one. The operational tax is real, but so is the financial one.
Measure twice, buy once.