Skip to content
Edition matrix

Feature Comparison

Explore differences across editions. Filter by group, search by feature, and toggle edition columns.

The table shows available capabilities. FAPI 2.0 is opt-in; DPoP and mTLS require compatible client and API integration. Rolling updates depend on suitable topology and release compatibility.

Back to FeaturesSee Pricing

Basic Support is included for supported versions during an active subscription or perpetual upgrade coverage, with an initial substantive response within one business day. Support alone does not extend upgrade coverage. Support plans and escalation packs →

Each separate production installation needs a licence, even within one company or cluster. Multiple tenants within one installation do not add deployments. Dev/test uses the purchased features; application, user-store and federated identity-provider configuration limits apply independently per environment without consuming production allowances. Passive disaster recovery and up to 30 days of overlap per failover, failback or migration event are included. Independent ongoing production installations require separate licences.

43 of 43 features

Scroll sideways to compare all editions

Feature: Starter, Business, Enterprise
FeatureStarterBusinessEnterprise
Licensing
Available licence types
  • Annual subscription: use and edition updates while active
  • Annual subscription: use and edition updates while active
  • Annual subscription: use and edition updates while active
  • Perpetual: indefinite use of covered versions; 12 months of upgrades unless the order provides longer, optional coverage thereafter
  • Redistribution / OEM requires a separate agreement
Licensed environments
  • 1 installed production system, normally in one Kubernetes cluster
  • Unlimited associated dev/test environments, including QA, staging and CI/CD
  • Unlimited runtime instances and replicas within the installation
  • 1 installed production system, normally in one Kubernetes cluster
  • Unlimited associated dev/test environments, including QA, staging and CI/CD
  • Unlimited runtime instances and replicas within the installation
  • 1 installed production system, normally in one Kubernetes cluster
  • Unlimited associated dev/test environments, including QA, staging and CI/CD
  • Unlimited runtime instances and replicas within the installation
Licensed counts
Client Applications
5 - 15 client applications
15 - 30 client applications
client applications (no licence count cap)
User Stores
1 user store
2 user stores
user stores (no licence count cap)
Federated identity-provider configurations
1 - 2 federated identity-provider configurations
2 - 5 federated identity-provider configurations
federated identity-provider configurations (no licence count cap)
Available Authentication Modules
IdP Types
  • User Store
  • OpenID Connect
  • Microsoft
  • Google
  • Twitter
  • Facebook
  • User Store
  • OpenID Connect
  • Microsoft
  • Google
  • Twitter
  • Facebook
  • User Store
  • OpenID Connect
  • Microsoft
  • Google
  • Twitter
  • Facebook
Passwordless User Store login with passkeysYesYesYes
Second Factor Types
  • TOTP (Microsoft Authenticator, Google Authenticator, ..)
  • Passkeys / FIDO2
  • TOTP (Microsoft Authenticator, Google Authenticator, ..)
  • E-Mail
  • Passkeys / FIDO2
  • TOTP (Microsoft Authenticator, Google Authenticator, ..)
  • E-Mail
  • SMS with Swisscom
  • SMS with eCall
  • SMS with iWay
  • SMS with Twilio
  • Passkeys / FIDO2
OpenID Connect
OpenID Connect CompliantYesYesYes
Authorization Code Flow with PKCEYesYesYes
Issuer validation supportYesYesYes
Refresh-token replay protectionYesYesYes
Implicit Flow
Legacy compatibility only. Not recommended for new applications.
Legacy compatibility only. Not recommended for new applications.
Legacy compatibility only. Not recommended for new applications.
Hybrid Flow
Compatibility support
Compatibility support
Compatibility support
Client Credentials FlowYesYesYes
Device Authorization GrantYesYesYes
Claims request parameterYesYesYes
Pairwise subject identifiersYesYesYes
Advanced OIDC & OAuth Security
FAPI 2.0 Security Profile (opt-in)YesYesYes
Pushed Authorization Requests (PAR)YesYesYes
JWT-Secured Authorization Requests (JAR)YesYesYes
DPoP sender-constrained access tokensYesYesYes
mTLS client authentication and certificate-bound access tokensYesYesYes
JWT introspection responsesYesYesYes
Reference tokens and token encryptionYesYesYes
OAuth 2.0 Token ExchangeYesYesYes
Deployment and Operations
Automated Helm SetupYesYesYes
Rolling updates (validate topology and release compatibility)YesYesYes
Admin ApplicationYesYesYes
Prometheus MetricsYesYesYes
dapr IntegrationYesYesYes
Management and Configuration Features
Certificate ManagementYesYesYes
Multi-TenancyYesYesYes
User QuestionnaireNoYesYes
Tenant specific label values / translationsNoNoYes
Tenant specific login viewsNoNoYes
Claim Rule EngineNoNoYes
Auditing
Audit Trail on configuration valuesNoNoYes
Audit Trail on user store configuration valuesNoNoYes
Audit Trail on user store login requestsNoNoYes
Provisioning
SCIM Provisioning from AADNoNoYes
SCIM Provisioning from Active Directory with ProAuth Directory SyncNoNoYes
Generic SCIM ProvisioningNoNoYes

Image detail