Cirrus Bridge / Pricing
How Cirrus Bridge pricing works
Every Cirrus Bridge plan includes the full managed service. Plans differ by your authentication volume, the protocols your applications need, and how many applications sit outside InCommon and eduGAIN. Tell us about your environment and we'll send a quote sized to it.
Every plan
Included in every Bridge plan
Every plan is hosted and operated by Cirrus, so your team has no servers to run.
Every InCommon and eduGAIN application
Access to every federated service, with no cap on how many your users reach.
DNS cutover
Move off Shibboleth or CAS with one DNS change and no application reconfiguration.
LogAPI event streaming
Authentication events streamed out of Bridge for your own logging and monitoring.
Guided implementation
Setup, testing, and cutover with a team that came from higher ed identity management.
24x365 production support
Support around the clock, every day of the year.
Operations handled
Hosting, certificate rotation, metadata refresh, and upgrades run by Cirrus.
Plans
Bridge plans
Six plans, from teams getting started to the largest research universities. Every plan includes everything above; they differ only in capacity.
| Plan | Federation StandardFor IAM teams getting started | Federation Standard PlusFor IAM teams with volume | Federation ExpansionFor expanding IAM teams | Federation AdvancedMulti-protocol and advanced integrations | Federation EvolveExpand access for a growing user base | Federation UltraMaximum throughput and enterprise integrations |
|---|---|---|---|---|---|---|
| Annual successful authentications | 2M | 4.5M | 4.5M | 6M | 15M | 25M |
| Application protocols | SAML | SAML | SAML and CAS | SAML and CAS | SAML and CAS | SAML and CAS |
| Applications outside InCommon and eduGAIN | 50 | 75 | 100 | 500 | 750 | 1,000 |
| InCommon and eduGAIN applications, DNS cutover, LogAPI | Included | Included | Included | Included | Included | Included |
Every plan is an annual subscription plus a one-time implementation fee.
Sizing
How to find your plan
Three numbers place you in a plan, and most teams can find them in systems they already run.
| Factor | Range across plans | Where to find your number |
|---|---|---|
| Annual successful authentications | 2 million to 25 million | Sign-in logs from your current IdP for the past 12 months |
| Application protocols | SAML, or SAML and CAS | Whether any application, such as Banner, still requires CAS |
| Applications outside InCommon and eduGAIN | 50 to 1,000 | Applications configured directly on your Shibboleth or CAS server today |
Unsure where you land? Send what you know and we'll size it with you.
Billing
How billing works
Bridge is an annual subscription, plus a one-time implementation fee in the first year. The implementation fee covers guided setup, testing, and cutover with the Cirrus team. Renewal years are subscription only.
Year one
Subscription + implementation
Renewal years
Subscription only
Procurement
Procurement readiness
Cirrus provides what campus security and procurement reviews ask for.
Frequently asked questions
Can we start small and grow?
Yes. Start on the plan that fits today's volume and move to a larger one mid-term as more applications come over.
What counts as an authentication?
A successful sign-in through Bridge. Failed attempts are excluded from the count.
Do our applications need to change?
No. With DNS cutover, your existing Shibboleth or CAS endpoint points to Bridge, and applications keep their current configuration. Users keep signing in with Entra ID, Okta, or Duo SSO as they do today.
How long does implementation take?
A few weeks to a few months, depending on how many applications you have and how prepared your team is.
Where is Cirrus Proxy pricing?
Proxy is priced by use case. Select Proxy in the quote form and we'll follow up.