Shrink your identity attack surface. Start free.
Two ways to buy: start a self-serve 30-day trial and continue on metered Professional Edition, or take Enterprise volume terms with procurement and security review. Pricing is per identity you actually run: $3.50 per human and $0.50 per non-human identity, per month. No card to start.
Professional Edition
Full coverageFull coverage for serious least-privilege.
Billed monthly in arrears, exclusive of tax. The 10-Day Rule and group exclusion apply.
- All surfaces, all data
- Hourly sync
- API access
- Custom role export (ARM / Bicep / Terraform)
- Full reports (PDF, CSV)
- Priority email support
- 30-day free trial included
No card required. After 30 days, subscribe to keep full coverage.
Enterprise
VolumeVolume coverage with procurement and security review on your terms.
Annual commitment, volume terms, and a single invoice across all of your connected tenants.
Built on the same metered model: $3.50 per human and $0.50 per non-human identity, with volume terms applied to your committed scope. Annual prepay takes 20% off the per-identity rate.
- Everything in Professional Edition
- Volume pricing on metered identities
- Annual commitment and consolidated invoicing
- Security review, DPA, and procurement support
- Dedicated onboarding and priority support
- Single sign-on for operator access
Volume terms, annual invoicing, and a security review. We'll scope it with you.
How the trial works
The self-serve path to full CIEM coverage for your Microsoft Cloud identities.
Start a 30-day free trial
Connect a tenant with read-only consent. Full coverage of every human and non-human identity, no card.
Subscribe to keep coverage
After 30 days, subscribe to keep full coverage. Metered monthly in arrears at the rates above, so you only pay for identities you actually run. Don't subscribe and the account locks; data stays recoverable for 30 days, then is purged.
Or get it comped
Need it without billing? An admin can grant your account comped access with no subscription required.
What happens after the trial
No card to start, and no surprise at the end. Here is the full lifecycle, start to finish.
- Day 1
Start free
Connect a tenant with read-only consent. Full coverage of every human and non-human identity, no card.
- Day 30
Subscribe to keep coverage
The trial ends. Subscribe to continue on metered Professional Edition, or have an admin comp the account. Either keeps coverage live.
- Day 30+
Or the account locks
If you don't subscribe, the account locks at the trial end and enters a 30-day window. We send a warning 7 days before data is purged. Subscribe any time in the window to unlock instantly.
After the 30-day trial: an unconverted account locks, then its data is purged 30 days later (warning on day 23). Subscribing at any point before purge restores full access.
How are identities counted?
Billing counts human identities (members, guests, named admins) at $3.50 per month and non-human identities (service principals, managed identities, app registrations, agents) at $0.50 per month. Groups are never counted. Microsoft first-party service principals are excluded.
What is the 10-Day Rule?
An identity is billed for a month only if it was enabled on at least 10 calendar days that month — so short-lived or decommissioned identities, enabled fewer than 10 days, are not counted and do not inflate the bill.
What does the trial include?
The 30-day trial unlocks full Professional coverage with no card, up to 500 human and 2,500 non-human identities. After 30 days, subscribe to keep full coverage.
What happens after my trial?
There is no free-forever path. When the 30-day trial ends, the account locks unless you subscribe or an admin comps it. Your data stays recoverable for 30 days, and we send a warning 7 days before it is purged. Subscribe at any point in that window to unlock instantly.
Can I forecast or cap my monthly spend?
Yes. The estimator above projects your monthly cost from your human and non-human identity counts, including a seasonal-swing range. Once you are subscribed, the billing page shows live accrued spend and an end-of-month forecast from your run rate, so there are no surprises before the invoice.
Is there an annual discount?
Yes. An annual prepay commitment takes 20% off the per-identity rate, applied to your committed scope and to annual overage. It is a commitment path, distinct from the default monthly arrears, and is set up through the Enterprise contact flow.
Do you offer enterprise or volume pricing?
Yes. Enterprise covers volume terms on a committed scope, annual commitment with a single consolidated invoice, procurement and PO support, and a security review. Choose Talk to sales on the Enterprise card to scope it. There is no self-serve Enterprise checkout.
Estimate your monthly cost
$3.50 per human identity, $0.50 per non-human identity, per month. Drag or type to model your tenant.
Members, guests, named admins
Service principals, managed identities, app registrations, agents
Estimated monthly cost
$600.00
per month, exclusive of tax
- 100 human × $3.50
- $350.00
- 500 non-human × $0.50
- $250.00
- 10-Day Rule. An identity is billed for a month only if it was enabled on at least 10 calendar days that month, so identities enabled fewer than 10 days are not counted.
- Groups are never counted. Microsoft first-party service principals are excluded.
- Billed monthly in arrears. Stripe Tax adds local VAT or GST at checkout.
What you get, and where Enterprise adds
Coverage scope, retention window, and API access are what determine whether Permafrost fits your programme, not just the price. Every Professional capability is live from day one of the trial. Enterprise layers volume terms, procurement, and security review on the same coverage.
| Capability | ProfessionalSelf-serve | EnterpriseVolume |
|---|---|---|
| Identity coverage | All identities | All identities across your connected tenants |
| Principal cap | All principals | All principals |
| Sync cadence | Hourly | Hourly |
| Privileged sign-in ingest | Full | Full |
| Non-privileged sign-in ingest | Available | Available |
| Directory audit ingest | Curated + privileged-target | Curated + privileged-target |
| Aggregate dashboard tiles | Full | Full |
| Retention window | 30 days+ | 30 days+ |
| IR backfill (operator-mediated) | 30-day window | 30-day window |
| Raw-event export | CSV | CSV |
| Right-sized role export | Included | Included |
| API accessFindings, identities, per-principal UPR, recommended roles, and connected tenants. Scoped, bearer-auth, read-only. | Included | Included |
| Pricing model | Metered list rate | Volume terms on committed scope |
| Billing | Monthly, in arrears | Annual commitment, single invoice |
| Procurement and PO support | Not included | Included |
| Security review and DPA | Not included | Included |
| SSO / SAML for operator access | Not included | Included |
| Onboarding | Self-serve | Dedicated |
| Support | Priority email | Dedicated + priority |
| Card required | Not during trial | Invoiced, no card |
Reviewing posture before you connect a tenant? Read the Trust Center and the security posture summary, including live certification status.
Read-only · synthetic data · no sign-in