Enterprise features
authentik Enterprise adds features for identity provisioning, security, compliance, and device access. These features are included with both Enterprise plans.
Enterprise and Enterprise Plus
Enterprise includes all the product features on this page and ticket-based support for qualifying subscriptions.
Enterprise Plus includes everything in Enterprise, with additional options for organizations that need a customized agreement:
- Dedicated support channels (Slack and/or scheduled calls)
- Assistance with onboarding best practices
- SLA-backed response times
- Volume discounts for large teams
- Auditable FIPS-compliant deployments to meet FedRAMP requirements
- Billing and purchase via invoice
See the pricing page for current plan details.
Product features
Identity and provisioning
- Google Workspace integration synchronizes users and groups from authentik to Google Workspace.
- Microsoft Entra ID integration synchronizes users and groups from authentik to Microsoft Entra ID.
- External OAuth and SAML sources embed an external identity provider in a flow for migration or additional verification. For example, dynamically redirect users to authenticate against Entra ID or GWS before continuing with a flow.
- The Shared Signals Framework provider sends security events to subscribed applications, including Apple Business Manager.
- OAuth authentication for SCIM uses short-lived OAuth tokens instead of a static token for SCIM provisioning.
Authentication and network access
- Password history compliance prevents users from reusing previous passwords.
- Client certificate authentication authenticates or enrolls users with client certificates from devices, smart cards, PIV cards, or hardware tokens.
- RADIUS EAP-TLS authenticates network clients with EAP-TLS and client certificates.
Audit and reporting
- Enhanced audit logging records detailed object changes and shows before-and-after values for compliance review.
- CSV data exports export user and event data for analysis, reporting, or backup.
Device security
- The Fleet connector uses device information from Fleet in device-aware access decisions.
- The Google Chrome connector uses Chrome Enterprise Device Trust signals in device-aware access decisions.
- Local device login enables users to sign in to Windows and Linux devices with authentik credentials. This feature is in preview.
- Advanced device compliance adds device facts and integrations to device-aware access decisions. This feature is in development; see the Endpoint Devices feature overview.
Feature availability can change as preview features mature. Refer to the linked technical documentation for current platform support and configuration requirements.