Citadel Identity360 Pricing: What Shapes Your IGA Quote

Citadel Identity360 pricing starts from your estate rather than a rate card. Before any figure appears, the scope a quote covers comes down to six inputs: the identities you govern by type, the applications and connectors you need, where the platform will run, how much tailoring your processes require, who carries implementation and administration, and who owns upgrades across the contract term. This guide walks CIOs and Heads of IT through each input, shows how the Citadel plan treats it, and lists the material to gather so a first pricing conversation starts from an accurate picture of the estate.

For market-wide context, our explainer on IGA pricing for human, contractor and machine identities compares billing meters, and IGA pricing models and budgeting shows where programme costs expand. This page covers one thing: how a Citadel Identity360 quote is built and what you bring to it.

Terms a Citadel Quote Uses

• Billing scope: the agreed set of identities, applications and capabilities the plan covers.
• Identity population: every governed principal, counted by type. That means employees, contractors, partners, service accounts, API keys, machine identities and AI agents.
• Connector mix: the integration methods your applications need, from SCIM and REST to files, batch jobs, mainframes and RPA.
• Included customization: the 400 hours of tailoring Citadel Identity360 includes, usable on approval chains, report layouts, policy rules and integration adjustments.
• Hypercare: post-launch stabilisation support, part of the Citadel plan.
• Upgrade ownership: whoever plans, regression-tests and rolls out each new platform version.
• IGA total cost: subscription plus every internal and external effort needed to run governance over the contract, from setup through daily operation to eventual retirement.

Criteria This Pricing Guide Covers and Excludes

In scope: identity population by type, contractor lifecycle, non-human identity and AI agent governance, connector reach, SoD and risk scoring, deployment model, included customization, implementation and hypercare, administration skills, upgrade ownership and audit evidence.

Out of scope: list prices, discount structures, regional tax treatment, payment terms, hardware procurement for self-hosted builds and the commercial terms of other vendors.

How Citadel Identity360 Pricing Is Structured

Citadel Identity360 uses one plan and one price for human, non-human and agent identities within the agreed scope. An employee, a fixed-term contractor, a service account behind a batch job and an AI agent registered against an MCP server are governed in one product under one commercial agreement.

Three elements travel with that plan by default:

• Setup, rollout and hypercare, so Astranova stays accountable from first configuration until production settles.
• 400 hours of customization, which you can direct at approval chains, reports, policy logic or adapting an integration to an unusual target.
• Built-in AI agent governance, machine identity lifecycle control and discovery of AI agents from the central registries of Microsoft Entra, AWS and Google Cloud.

With those capabilities built in, the quote conversation is about your scope, not a module list. Ask our team how each scope input is reflected in your figure. The Citadel Identity360 platform page covers the capability set.

Six Inputs That Set a Citadel Identity360 Quote

Who and what you govern

Start with a population count split by type, because contractors, partners, service accounts, API keys and agents sit beside employees. Contractors get the same lifecycle engine as staff in Citadel, with a named sponsor, start and end dates, extension approvals, periodic validation and offboarding. Service accounts and keys receive an accountable owner at creation and stay tracked until decommissioning. Agents are registered with owners, connected to registered MCP servers and authorised tool by tool.

Bring defensible counts and expected growth. NIST SP 800-53 control AC-2 asks organisations to define and manage account types, which makes a typed inventory a governance asset as well as a pricing input. The NIST SP 800-53 catalogue is the reference most auditors will recognise.

Which applications must be connected, and how

Integration scope is the input that needs the most detail. Citadel Identity360 reaches targets over SCIM and REST or SOAP APIs, LDAP directories, JDBC databases, SFTP drops, flat files, batch feeds, mainframes and custom adapters. Where an application can only be administered through its screens, robotic process automation becomes the fulfilment path. A legacy finance console can therefore be read through a JDBC query or CSV export, checked against policy in Citadel, updated by an approved robotic workflow and then confirmed with a fresh read.

For the quote, list each application with its integration method, whether you need read-only visibility or full fulfilment, and who owns it. The Citadel guide to integrations across cloud, SaaS and legacy systems helps classify each one.

Where the platform will run

Three hosting options are available for Citadel Identity360: SaaS, a dedicated private cloud tenancy, or your own data centre on-prem. The same product runs in each, and the clearest difference is how much infrastructure work lands with your team. Ask our team how your chosen model is reflected in the quote. With SaaS, Astranova operates the platform. A private cloud tenancy or an on-prem build hands you residency and change-window control, along with the servers, databases, backups and monitoring that control requires. Our hosting decision framework for IGA works through those constraints one by one.

How much tailoring your processes need

Approval chains, report formats and policy rules rarely match a standard configuration, and Citadel includes 400 hours of customization for that work. List known bespoke requirements, such as a two-stage approval for finance roles, an auditor-specific certification report or a custom attribute rule for contractor sponsors. Then rank them so the included hours go first to the items that matter most.

Who carries implementation and daily administration

Services dependence is a cost line worth isolating early. Citadel keeps it contained in two ways. Setup, rollout and hypercare come with the plan. Routine configuration is no-code-first, so your IT and IAM staff can run workflows, policies and campaigns, while specialised integration work is scoped up front. To size the internal team, use our breakdown of how many IGA FTEs a CIO should budget.

Who owns upgrades over the contract term

New versions consume effort even when no licence fee changes. On Citadel SaaS, Astranova handles each version rollout. In a private cloud tenancy or on-prem build, your team keeps the release calendar, staging environment and fallback plan. Settle this before the quote, because it fixes how much operational effort sits with you each contract year.

Cost Driver Table: Citadel Answer and a Question for Every Vendor

Cost driver	Citadel Identity360	Question to put to every shortlisted vendor
Identity population	One plan and one price across human, non-human and agent identities within agreed scope	Which identity types are counted separately, and at what point does each one become billable?
Contractor lifecycle	Sponsor, engagement window, extension approval, validation and offboarding in the same platform and plan	Is contractor governance inside the plan being quoted?
NHI and AI agents	Owner-led lifecycle for service accounts and keys; agent discovery from the central registries of Entra, AWS and Google Cloud; tool-level MCP authorization; a kill switch for intervention and containment	Which machine and agent capabilities are in the base subscription?
Connector reach	SCIM, REST and SOAP APIs, LDAP, JDBC, SFTP, flat files, batch, mainframe, custom adapters and robotic process automation	Which of my applications need custom integration work, and how is it scoped?
SoD and risk scoring	Real-time SoD conflict detection, an identity risk score and AI-assisted certification recommendations in the platform	Are SoD rules and risk analytics part of the quoted plan?
Deployment model	SaaS, dedicated private cloud tenancy or on-prem in your data centre	Which hosting models are offered, and does the governance feature set change between them?
Customization	400 hours included	How is tailoring of workflows, reports and policies charged?
Implementation and hypercare	Setup, rollout and hypercare part of the plan	Which implementation phases are quoted separately, and by whom?
Upgrade ownership	Astranova-run on SaaS; under your control in a private cloud tenancy or on-prem build	Who retests customised workflows at each release?
Audit evidence	Audit evidence collected automatically for every review, certification and policy action, with one-click auditor exports	What does producing an auditor-ready evidence pack cost each cycle?

Illustrative Quote Dossier: A Mixed Estate Manufacturer

The following scenario is illustrative and describes no real customer.

A manufacturing group runs an HR system, a cloud directory, several SaaS suites, an ERP platform, a mainframe payroll application and a plant maintenance tool that has no API. A large contractor workforce rotates through engineering projects. Automation teams have built service accounts for nightly integrations and are piloting support agents on an MCP server.

Its dossier for the Citadel pricing call has five parts:

• A typed identity inventory covering employees, contractors, partners, service accounts, API keys and registered agents, with expected growth noted for each.
• An application register marking each target as SCIM, API, JDBC, file, mainframe or RPA, and as read-only or full fulfilment.
• A hosting decision, in this case private cloud because group policy names a jurisdiction for identity records.
• A ranked list of bespoke requirements for the 400 included hours, led by a contractor extension approval and an auditor report format.
• A statement of who administers the platform after hypercare, and who approves releases.

With that dossier, the first quote reflects the real estate: the maintenance tool becomes a robotic fulfilment path, contractors and agents sit inside one plan, and hosting effort is visible from day one.

From Quote to IGA Total Cost Over the Contract Term

A quote is one line in a life-cycle estimate, which the US GAO Cost Estimating and Assessment Guide frames as an account of every effort needed to develop, operate and maintain a programme. Add these to the Citadel figure:

• Internal administrator and application-owner time, with routine Citadel configuration handled no-code-first.
• Hosting and operations effort for a private cloud or on-prem build, which sits with Astranova under SaaS.
• Reviewer time for certification campaigns, where Citadel shows risk context and an AI-assisted recommendation for each access item.
• Audit preparation time, with Citadel gathering evidence automatically for every review, certification and policy action.
• Tailoring beyond the 400 included hours, if your ranked list runs longer.

The CISA Cross-Sector Cybersecurity Performance Goals 2.0, realigned to the functions of NIST CSF 2.0 including GOVERN, now rate each goal for cost, impact and ease of implementation, and include least-privilege practices among the new goals. For a multi-year model that spans hosting estates, see our multi-year IGA TCO guide across SaaS, cloud and legacy systems.

Preparing Your Inputs Before the First Pricing Call

1. Export identity counts by type from HR, directories, cloud consoles and agent registries.
2. Build the application register with integration method, fulfilment need and owner for each target.
3. Choose the hosting model, or shortlist two, and record the residency or change-control rule behind the choice.
4. Write and rank your bespoke requirements against the 400 included customization hours.
5. Name the internal team that will administer Citadel after hypercare.
6. Agree who signs off releases and how customised workflows are retested.

Citadel Identity360 Pricing Questions Buyers Ask

How is Citadel Identity360 priced?

A single Citadel Identity360 plan, at a single price, covers people, machine identities and AI agents within an agreed scope. Setup, rollout, hypercare and 400 hours of customization come with it. Bring your identity population, connector mix and hosting choice, and our team will scope the plan from them.

Does the Citadel plan include service accounts and agents?

Yes, within the agreed scope, and no separate machine or agent product is needed. People, service accounts, API keys, machine identities and AI agents share one plan and one governance model, and agents in the central registries of Microsoft Entra, AWS or Google Cloud can be discovered into the inventory.

What can the 400 included customization hours be spent on?

Approval chains, report layouts, policy rules, workflow changes and adjustments to individual integrations. Ranking requirements before the quote puts the hours on the changes with the most governance value.

Does choosing on-prem or private cloud change what Citadel costs?

Ask our team how your hosting model is reflected in the quote. The same Citadel Identity360 product runs in every model; a self-hosted build adds infrastructure and version-rollout work for your team, whereas SaaS leaves platform operations with Astranova.

How do MCP clients on agent platforms fit into a Citadel quote?

Citadel’s AI governance produces a configuration file that MCP clients on Claude, OpenAI and Cursor can use to reach governed MCP services. Agent governance sits inside the same plan, and the Citadel agent governance overview shows the registration and tool authorization flow.

Which documents speed up a Citadel quote?

A typed identity inventory, an application register with integration methods, a hosting decision, a ranked list of tailoring needs and the name of whoever administers Citadel after hypercare.

Bring Your Identity Inventory to a Citadel Demo

The most direct route to an accurate Citadel Identity360 quote is a working session built around your own estate. Bring the typed inventory and the application register, including the one system with no API, and we will show how Citadel governs it inside one plan. Request Demo to book that session, or preview the platform first in our Citadel Identity360 videos.