Okta vs Microsoft Entra India: what a 600-seat Mumbai NBFC actually shortlisted

The CISO framed it as Okta vs Microsoft Entra India, best identity platform wins. That is not actually the question. The question is what this NBFC already pays Microsoft every year, what their app estate actually looks like, and where a second identity vendor earns a premium instead of duplicating a capability they have already bought.

This was a shortlist meeting I sat in on last month. A 600-seat Mumbai NBFC, mid-size, regulated, growing. The CISO, Farah, had Okta at the top of her list because that is the reflex in identity circles. The IT head, Raghav, kept tapping the renewal line on their Microsoft 365 bill. The CFO wanted one number she could take to the risk committee. They asked me to referee the math.

The shortlist on the whiteboard

Farah’s case for Okta was clean. Best-of-breed identity, a directory that does not assume everything lives in Microsoft, an integration catalogue with thousands of pre-built app connectors, and a lifecycle automation engine that joiners-movers-leavers teams genuinely like. For a security lead who has watched a Microsoft-first identity setup creak under a non-Microsoft app, the appeal is real.

Raghav’s case for Entra was quieter and harder to argue with. The NBFC ran Microsoft 365 E3 across all 600 seats. E3 includes Entra ID P1 already. They were paying for a working identity platform and barely using it past basic single sign-on. Achha, said the CFO, so one of you wants me to buy something I might already own.

That is the whole tension in one sentence. Okta is excellent and it is also net-new money. Entra is already on the invoice. The shortlist is not which platform is better in a vacuum. It is whether the better platform is better enough to pay twice for identity.

What you already pay Microsoft

Start with the sunk cost, because most shortlists skip it. Entra ID P1 ships inside Microsoft 365 E3. Entra ID P2 ships inside E5. The standalone list prices run roughly six US dollars a user a month for P1 and nine for P2, and Microsoft documents what each tier covers in its Entra ID licensing fundamentals, but if you already hold E3 or E5 the P1 floor is bought and paid for. The only open question is whether you upgrade the core to P2 for the features that matter to a regulated NBFC.

P2 is where Entra gets interesting for compliance. It adds risk-based conditional access, identity protection signals, privileged identity management with just-in-time admin elevation, and access reviews. For a finance company that has to show an auditor who can touch what and when, those are not nice-to-haves. P1 to P2 is a per-seat step-up, not a platform switch, and the team keeps one console.

Raghav’s question to Farah was the fair one. “If Entra P2 covers conditional access, PIM, and access reviews, what is Okta giving us that we are not already an upgrade away from?” Farah’s answer was the honest start of the real decision. “Our app estate.”

Where Okta earns its premium

Here is where I changed my mind. I came into the room half-assuming the NBFC should just turn on what they own and skip Okta. Then we listed the apps.

The estate was not Microsoft-shaped. Salesforce for the relationship managers. A loan origination system from a domestic fintech vendor. Workday for HR. Two custom underwriting tools. A document-signing platform, a video-KYC vendor, a collections dialer, and a long tail of smaller SaaS that the business had bought without IT in the loop. Forty-plus apps, and maybe a third of them sat awkwardly with a Microsoft-first identity layer.

This is the exact shape where Okta stops being a luxury. Its integration network and lifecycle automation are built for a sprawling, multi-vendor app estate. When a relationship manager resigns, one Okta workflow can deprovision Salesforce, the LOS, the dialer, and email in a single sweep. Entra can do a lot of this, more every quarter, but for a heavily non-Microsoft estate Okta still does it with less plumbing. Matlab, the premium buys breadth, and this NBFC had the breadth.

Where Okta vs Microsoft Entra India actually gets decided

The decision is not a feature grid. It is two questions, in order.

First, how Microsoft-shaped is your estate? If your apps are mostly Microsoft and a short list of common SaaS that Entra integrates natively, the answer leans Entra. You already own the floor, the upgrade to P2 is cheap relative to a second vendor, and your admins live in one console. If your estate is broad and non-Microsoft, the answer leans Okta for the apps that need it, because the integration and deprovisioning work is where breaches and audit gaps actually happen.

Second, what does a second identity vendor cost you beyond the licence? Okta is billed annually, carries a contract minimum, and the per-user number climbs fast once you move past the starter tier into adaptive MFA, privileged access, and full lifecycle automation. A mid-tier Okta seat with the governance features a finance firm wants lands far above the Entra P2 step-up. So the real test is not “is Okta worth it” but “for which users is Okta worth it.” Bas, that reframing is the whole exercise.

For most regulated Indian mid-market firms already standardised on Microsoft 365, the centre of gravity is Entra, with Okta scoped to the part of the estate that genuinely needs it. That is not a knock on Okta. It is just where the money is honest.

What we landed on, in one table

We did not pick a winner. We scoped each layer to the users who needed it, the same way you would size any other licence.

The all-Okta plan and the split plan both clear the same security bar. The split came in over a crore cheaper across three years, because we stopped paying a best-of-breed premium on 480 seats whose entire working day sits inside Microsoft 365 anyway.

One thing to watch before you sign

Two warnings for the back pocket. First, Microsoft moves the Entra add-on lines around. Entra ID Governance is a separate per-user add-on on top of P1 or P2, and the Entra Suite bundles internet and private access on top again. Microsoft’s own Entra ID Governance documentation spells out the P1-or-P2 prerequisite, so if a partner quotes you “Entra covers governance,” ask whether that is P2 or the extra Governance SKU, because the bill is different. Second, Okta’s number on the page is the starter number. The features a finance firm actually wants, adaptive MFA, privileged access, lifecycle automation, sit in the higher tier of Okta’s published workforce pricing, and it is billed annually with a contract minimum. Price the tier you will use, not the one on the homepage.

We walk clients through this exact split when we run an Okta and IAM review for India, and the answer is almost never “all of one vendor.” If you want the Microsoft-side detail, our Okta SSO rollout story from a Pune NBFC audit week covers what the deployment actually feels like. The licensing logic here is a cousin of the Intune licensing by role exercise, and if device management is on the same table, the Hexnode vs Intune bake-off is the question that comes up right after this one.

The full Microsoft cloud and identity hub covers the wider Sirius Star approach to identity, conditional access, and the partner discount you should be asking for either way. We resell both Microsoft and Okta and support the deployment; we are not on a quota that rewards us for selling you a second identity platform you do not need.

P.S. Karthik here. We ran this same shortlist for a Hyderabad lender last quarter and the split was even more lopsided, because they were already on E5, so Entra P2 was sitting unused inside a licence they had paid for two years running. The shortlist took one afternoon with their app inventory open on the screen. The saving paid for the migration twice over. Reply on WhatsApp and we will block thirty minutes on Thursday to look at your two quotes side by side.