The HRIS SSO upgrade tax
Which vendors gate SSO
| Vendor | SSO gate | Typical upcharge |
|---|---|---|
| BambooHR | Pro tier only | ~$4 PEPM (~67% of Core) |
| Gusto | Plus tier and above | ~$6 PEPM (~100% of Simple) |
| Justworks | Bundled at both tiers | None |
| Paychex Flex | Select tier and above | Tier-based, no separate SSO line |
| Rippling | Bundled (free SAML); SCIM in IT module | None for SAML; $6 PEPM for IT/SCIM |
| Paylocity | Bundled | None |
| Paycom | Bundled | None |
| ADP Workforce Now | Separately quoted | $2-$4 PEPM |
| Workday HCM | Bundled at Core | None |
| UKG Pro | Bundled at Core | None |
| HiBob | Bundled at Core | None |
SCIM bundling
SCIM (automated provisioning and de-provisioning) is usually bundled with SSO when SSO is itself bundled. When SSO is sold as an upgrade tier, SCIM rides with it at no separate charge. The exception is Rippling, where SSO is free across all tiers but SCIM lives inside the paid IT module.
Is the upcharge negotiable on multi-year?
Yes, with caveats. Vendors that gate SSO behind a tier (BambooHR Pro, Gusto Plus) rarely break the tier gate but will discount the Pro tier itself by 10-20% on a 3-year MSA. Vendors that separately quote SSO (ADP) typically waive the SSO line entirely for a 3-year commit.
Why the tax exists
SSO and SCIM are correlated with enterprise procurement maturity. Vendors use the gate as a pricing signal: any prospect who asks for SSO is, on average, willing to pay more. The sso.tax campaign argues this practice is anti-security; it persists because enterprise buyers do, in fact, pay.