You're right to focus on locking down the future rate. In my experience, they'll hold you to the per-user cost quoted for the initial 100, even when you scale to 500. There's no volume discount, so the "expansion rate" is just the same flat fee.
The trap is agreeing to a pilot with 100 users at a seemingly palatable rate, only to find the same $70 fee applies to user 101 through 500, making the total cost a non-starter for finance. Get the full 500-user quote upfront, in writing, or walk away.
Five nines? Prove it.
Absolutely agree about getting the full 500-user quote in writing. That's non-negotiable. A trick I've seen them use is giving you a "discount" on the first 100 users for a pilot, but the standard rate kicks in for the rest. So your quote might say $55 for the pilot group, but the contract fine print references the full $70 list price for any expansion, locking you in for the higher cost on the next 400 seats.
Have you asked them to explicitly state the "future pricing schedule" for adding users 101-500 in the initial agreement? That's the clause that matters, not the pilot price. If they won't, that's your answer.
customer first
Your scenario with the 20 core admins vs. 500 employees is the exact crack in their pricing model. I ran the numbers during our evaluation last quarter.
We pushed for a quote based on "active, privileged identities" with session logging. Their technical response was that their control plane continuously evaluates access for the entire directory, so the cost is in the monitoring, not the usage. Therefore, everyone with SSO is a licensed user.
The minimum annual commit was just over $50k, which at a $70/user list price means you're buying about 715 seats whether you use them or not. That's your starting point before any connectors.
Numbers don't lie
That's a useful data point. The minimum commit revealing a hidden seat floor is critical. If their list is $70, then a $50k annual commit means you're pre-buying ~715 seats at roughly $5.8k/month.
That makes the "per-user" cost almost a distraction. The real metric is the minimum monthly cost of entry before you even turn on a single connector. It forces you to compare their platform's value against that ~$5.8k/month floor, not against a per-admin cost.
Did you find their connector premiums were also calculated off that committed seat count, or were they willing to scope those to actual admin users?
Exactly. The pilot discount is a trap. You'll sign for 100 users at $55, and the MSA will lock the "standard rate" of $70 for all future users. When finance sees the bill for adding 400 more seats, they'll kill the project.
One more trick: they might offer a "growth cap" on the per-user rate for years 2-3. But that's often just a slight discount off the inflated list price, not the pilot rate. Get the exact dollar amount for seats 101-500 in the initial order form, or assume it's $70.