Cloud RADIUS pricing: how to model cost per site and per user

{{asset:header_image.png}}

Use this to compare per-user and per-site cloud RADIUS pricing for IEEE 802.1X staff WiFi. At 40 sites, 25 identities per site, £2 per user and £40 per site per month, it returns £24,000 a year per-user against £19,200 per-site. Break-even sits at 20 identities per site, so above that headcount per-site pricing costs less.

What does this cloud RADIUS pricing model output?

The model takes five inputs about your estate and your quotes. It returns six figures you can paste into a business case:

• Identities covered: sites multiplied by staff identities per site.
• Annual cost, per-user pricing: what a per-user quote costs over 12 months.
• Annual cost, per-site pricing: what a per-site quote costs over 12 months.
• The gap: per-user cost minus per-site cost. A positive figure means per-site pricing is cheaper.
• Break-even identities per site: the headcount at which both metrics cost the same.
• Year-two per-user cost: the per-user bill after a year of headcount growth.

Run it before you shortlist vendors, so you know which pricing metric suits your estate. Run it again when the quotes arrive, so you compare like with like.

Which network this prices

The model prices the secure network. On this network, staff and managed devices authenticate with IEEE 802.1X. That standard holds a device off the network until a RADIUS server approves it.

RADIUS (Remote Authentication Dial-In User Service, defined in RFC 2865) is the protocol between your access points and that server. Most estates pair it with EAP-TLS (RFC 5216), which authenticates each device with a certificate instead of a password. The certificate is issued against your identity provider: Microsoft Entra ID, Okta or Google Workspace.

When authentication succeeds, the RADIUS reply tells the access point which VLAN (virtual LAN, a separate network segment) to place the device on. Identity sets the VLAN.

Guests on the open network sign in through a captive portal, the web page shown before access is granted. Residents and headless devices on xPSK networks each get their own pre-shared key. Both use different billing units, and the adapt section shows how to fold them in. For the wider design, start with the secure network guide.

{"tone":"tip","title":"Count named people, not peak connections","text":"Enter the number of staff who hold a secure network identity at each site, taken from HR. Directory exports often include leavers and service accounts, which inflate a per-user model."}

The cloud RADIUS pricing calculator

Overwrite the defaults with your own figures. The defaults describe the worked example in the next section.

{"title":"Cloud RADIUS cost model: per user against per site","intro":"Enter your estate and the two prices on your quotes. The model returns the annual cost under each metric, the gap between them and the break-even headcount per site.","inputs":[{"id":"sites","label":"Sites on the estate","unit":"sites","default":40,"min":1,"max":5000,"step":1},{"id":"perSite","label":"Staff identities per site","unit":"identities","default":25,"min":1,"max":2000,"step":1},{"id":"userRate","label":"Quoted price per user per month","unit":"£","default":2,"min":0.05,"max":20,"step":0.05},{"id":"siteRate","label":"Quoted price per site per month","unit":"£","default":40,"min":0,"max":1000,"step":1}],"outputs":[{"id":"annualUser","label":"Annual cost, per-user pricing","expr":"sites*perSite*userRate*12","format":"currency","unit":"£"},{"id":"annualSite","label":"Annual cost, per-site pricing","expr":"sites*siteRate*12","format":"currency","unit":"£"},{"id":"gap","label":"Per-user cost minus per-site cost, per year","expr":"sites*perSite*userRate*12-sites*siteRate*12","format":"currency","unit":"£"},{"id":"breakeven","label":"Break-even identities per site","expr":"ceil(siteRate/userRate)","format":"int"}],"example":"At 40 sites, 25 identities per site, £2 per user and £40 per site per month, per-user pricing costs £24,000 a year and per-site pricing £19,200, a gap of £4,800. Break-even is 20 identities per site.","assumptions":["Default prices are illustrative inputs, not Purple's price list or a market benchmark.","Prices are flat: no volume tiers, discounts or minimum terms.","The per-site price carries no cap on identities per site.","Excludes one-off onboarding, VAT, PKI charges and internal admin hours.","Every site has the same headcount."]}

{"tone":"note","title":"Illustrative prices","text":"The £2 and £40 defaults exist to make the worked example concrete. Replace them with the figures on your own quotes before you draw any conclusion."}

Worked example: a 40-site hotel group on Cisco Meraki

Take a hotel group with 40 properties on Cisco Meraki, managed in the Meraki Dashboard. Each hotel has 25 staff who need the secure network: front desk, housekeeping supervisors, managers and maintenance. They authenticate with EAP-TLS certificates issued against Microsoft Entra ID. Guests stay on the open network and sit outside this model.

The group has two quotes. Vendor A charges £2 per user per month. Vendor B charges £40 per site per month, with no cap on identities per site. HR expects headcount to grow 10% next year, with no new hotels.

{"caption":"Worked example: inputs and outputs for a 40-site hotel group","asOf":"2026-06-10","columns":[{"key":"item","label":"Item"},{"key":"value","label":"Value","highlight":true},{"key":"basis","label":"Basis"}],"rows":[["Sites","40","Asset register"],["Staff identities per site","25","HR headcount, named accounts"],["Per-user price","£2 per user per month","Vendor A quote"],["Per-site price","£40 per site per month","Vendor B quote"],["Headcount growth","10%","HR plan for next year"],["Identities covered","1,000","40 × 25"],["Annual cost, per-user","£24,000","1,000 × £2 × 12"],["Annual cost, per-site","£19,200","40 × £40 × 12"],["Gap in year one","£4,800","£24,000 - £19,200"],["Break-even per site","20 identities","£40 ÷ £2"],["Year-two per-user cost","£26,400","1,100 × £2 × 12"]],"footnote":"Illustrative inputs. Replace the two prices with your own quotes.","download":{"filename":"cloud-radius-worked-example.csv"}}

What the example tells the hotel group

Per-site pricing saves £4,800 in year one. The gap widens to £7,200 in year two. Growth lifts the per-user bill to £26,400, while the per-site bill stays at £19,200.

Break-even sits at 20 identities, below the group's average of 25. Per-site pricing therefore wins at every hotel of average size or larger.

Make two checks before you sign. First, confirm in writing that the per-site price has no identity cap. Second, look at your smallest sites.

A 10-room property with eight staff costs £16 a month on per-user pricing, against £40 on per-site pricing. If a third of the estate looked like that, a blended contract could beat either metric alone. The adapt section shows how to model it.

{"tone":"warning","title":"Leavers stay on a per-user bill","text":"If a vendor bills on accounts that exist at month end, leavers who are never removed keep costing you. Automate joiners, movers and leavers from your identity provider so the billed count matches your real headcount."}

How are the cloud RADIUS cost figures built?

Every output comes from the inputs with one line of arithmetic. Nothing is weighted, smoothed or hidden.

• Identities covered = sites × identities per site.
• Annual per-user cost = identities covered × price per user per month × 12.
• Annual per-site cost = sites × price per site per month × 12.
• Gap = annual per-user cost - annual per-site cost.
• Break-even = price per site ÷ price per user, rounded up to a whole identity.
• Year-two per-user cost = identities covered × (1 + growth), rounded to a whole identity, × price per user × 12.

{"kind":"flow","direction":"lr","caption":"How the model turns estate counts and two quotes into a pricing decision","alt":"A flow from site count and headcount through two annual cost calculations to a break-even comparison and a pricing decision.","nodes":[{"id":"s","label":"Sites","sub":"40 in the example","tone":"neutral"},{"id":"h","label":"Identities per site","sub":"25 named staff","tone":"neutral"},{"id":"u","label":"Per-user annual cost","sub":"1,000 × £2 × 12 = £24,000","tone":"brand"},{"id":"p","label":"Per-site annual cost","sub":"40 × £40 × 12 = £19,200","tone":"brand"},{"id":"b","label":"Break-even per site","sub":"£40 ÷ £2 = 20 identities","tone":"neutral"},{"id":"d","label":"Choose the metric","sub":"25 is above 20, so per-site costs less","tone":"success"}],"edges":[{"from":"s","to":"u"},{"from":"h","to":"u"},{"from":"s","to":"p"},{"from":"u","to":"b"},{"from":"p","to":"b"},{"from":"b","to":"d"}]}

Assumptions you should know about

• Prices are flat. Volume tiers, discounts and minimum terms are not modelled.
• The per-site price has no identity cap.
• Site count stays the same in year two; only headcount grows.
• One-off onboarding, VAT, certificate authority (PKI) charges and internal admin hours sit outside the model.
• The model counts named staff identities, not devices or guest sessions.
• Every site has the same headcount. Real estates rarely do, so the next section shows the fix.

Why site count drives cost at all

Each site's access points or controller act as a RADIUS client, the device that sends authentication requests to the server. With cloud-managed platforms such as Cisco Meraki and Juniper Mist, requests often leave each site from its own public IP address. Each site then becomes a separate client entry with its own shared secret. Per-site pricing reflects that configuration work.

The access point settings are standard. You set the SSID to WPA2-Enterprise or WPA3-Enterprise and point it at the RADIUS server on UDP 1812 for authentication and 1813 for accounting. Pointing access points at cloud RADIUS covers the settings by vendor. If requests cross the internet, ask whether the service supports RadSec, which carries RADIUS inside TLS (RFC 6614).

How do you adapt the model to your estate?

Split uneven estates into size bands

Most estates mix small branches with large flagships. Run the calculator once per band, then add the results.

Take 30 branches with eight staff each and 10 flagships with 70 staff each, at the same £2 and £40 prices.

• Branches: per-user costs £5,760 a year; per-site costs £14,400.
• Flagships: per-user costs £16,800 a year; per-site costs £4,800.

Per-user across the whole estate costs £22,560. Per-site across the whole estate costs £19,200. Per-user for branches plus per-site for flagships costs £10,560.

Ask vendors whether they will quote a blended contract. The band split is the evidence for that request.

Switch the unit for per-device quotes

Some quotes bill per device, not per person. Multiply identities per site by devices per person, then enter the result as identities per site. Staff with a laptop and a phone double a per-device bill, so check the ratio against your device management records.

Add xPSK keys and guest access as separate lines

xPSK networks give each device or resident its own pre-shared key. They suit build-to-rent blocks, student halls and headless devices such as printers. Run the calculator a second time with keys per site as the identity count. Guest access on the open network usually carries its own pricing, so keep it on a separate line.

Model growth in sites as well as people

The year-two output grows headcount only. If you are opening sites, run the calculator again with next year's site count. Per-site pricing rises with every opening, while per-user pricing rises with every hire.

Add the costs the subscription leaves out

Put one-off costs next to the calculator output: onboarding fees, internal hours for migration and certificate authority charges. Add VAT if your quotes exclude it. A three-year view usually shows the one-off lines are small against the subscription, but put them on the page.

Billing metric	What you count	Where it bites	Best fit
Per user	Named staff identities	Seasonal hiring, slow deprovisioning	Small branches, low headcount per site
Per device	Devices that authenticate	Staff carrying two or three devices	Single-device fleets, kiosks
Per site	Locations or RADIUS clients	Estates with many tiny sites	Large hotels, hospitals, campuses
Per key (xPSK)	Keys issued to devices or residents	Unit turnover in residential estates	BTR, student housing, IoT
Platform fee	One flat figure	Paying for headroom you never use	Fixed, predictable estates

What should you do with the result?

Use the result to set your pricing metric before you talk to vendors. Then ask every vendor to quote in that metric, so the calculator compares them on equal terms.

Price is one line of the decision. Check three more before you shortlist.

Uptime in writing. Ask for a RADIUS uptime SLA, separate from overall platform availability. Purple gives a 99.9% RADIUS uptime SLA on a platform that runs at 99.999% uptime. Plan for failure anyway: RADIUS server down explains what your access points do when authentication stops.

Migration effort. RADIUS migration is usually a weekend exercise. You add the cloud servers to each SSID, prove one pilot site, then repoint the rest. Budget the internal hours as a one-off line.

Hardware fit. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. No new hardware enters the cost model.

{"title":"Cloud RADIUS quote checklist","groups":[{"heading":"Scope","items":[{"text":"List every site with its access point vendor and console","why":"Per-site quotes need an exact site count"},{"text":"Count named staff identities per site from HR, not from the directory alone","why":"Stale accounts inflate per-user bills"},{"text":"Count devices per person if any quote bills per device"},{"text":"Separate secure, open and xPSK networks into their own lines"}]},{"heading":"Pricing terms","items":[{"text":"Confirm the billing metric and whether it counts active or provisioned accounts"},{"text":"Ask for any identity cap on a per-site price"},{"text":"Get volume tiers, minimum term and overage rates in writing"},{"text":"Ask which PKI, certificate and identity provider connector charges apply"}]},{"heading":"Service","items":[{"text":"Get the RADIUS uptime SLA in writing, separate from platform uptime"},{"text":"Ask where authentication servers run and how failover works"},{"text":"Ask how long RADIUS accounting logs are kept and how you export them","why":"These logs are your evidence for access-control audits"}]},{"heading":"Migration","items":[{"text":"Pick a pilot site on each access point vendor you run"},{"text":"Schedule the cutover window and the rollback plan"},{"text":"Budget internal hours as a one-off cost next to the subscription"}]}],"download":{"filename":"cloud-radius-quote-checklist.csv"}}

{"tone":"proof","title":"Proven at estate scale","text":"JPMorgan runs staff WiFi on Purple across 5,000 branches. Purple runs the largest cloud RADIUS in the world, across 80,000+ venues in 90 countries."}

See how Purple prices and runs it on the cloud RADIUS product page. For the security case behind the budget, read the enterprise WiFi security guide. Next, read cloud RADIUS for multi-site estates to set one policy across every location you have just priced.

Frequently asked questions

How is cloud RADIUS usually priced?

Most cloud RADIUS quotes bill per user, per device or per site, monthly or annually. Some add a platform fee or a one-off onboarding charge. The metric matters more than the headline rate, because it decides which part of your estate drives the bill. Run every quote through the calculator above on the same inputs before you compare them.

Is per-user or per-site pricing cheaper for a multi-site estate?

Per-site pricing is cheaper once your average headcount per site passes break-even: the per-site price divided by the per-user price. At the default inputs that is 20 identities. Small branches with five or six staff favour per-user pricing. Large hotels, hospitals and campuses favour per-site pricing. Model mixed estates in size bands and ask for a blended contract.

Will cloud RADIUS work with the access points we already own?

Yes. Purple is hardware-agnostic and runs on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You point your WPA2-Enterprise or WPA3-Enterprise SSID at the cloud RADIUS servers in the console you already use. No new hardware enters the cost model, so the calculator output is the whole subscription line.

How long does migration from on-premises RADIUS take?

RADIUS migration is usually a weekend exercise. You add the cloud RADIUS servers to each SSID, prove one pilot site, then repoint the rest of the estate. Keep the old server available as a rollback path until the pilot has run through a normal working week. Budget the internal hours as a one-off line next to the calculator output.

What uptime should a cloud RADIUS contract include?

Ask for a written RADIUS uptime SLA, not only a platform availability figure. Purple gives a 99.9% RADIUS uptime SLA on a platform that runs at 99.999% uptime. Check how the SLA is measured, what it pays back and whether it covers accounting as well as authentication. Then plan how your access points behave if authentication stops.

Does cloud RADIUS help with PCI DSS or ISO 27001 audits?

It gives you evidence for access-control audits; it does not make you compliant on its own. Every 802.1X session ties to a named identity, and RADIUS accounting records when each session started and ended. That answers the auditor's question of who was on the network and when. Purple holds ISO 27001 and Cyber Essentials certification for the platform itself.

Should we count people or devices in the model?

Count whichever unit the vendor bills on, and model the other as a cross-check. For a per-device quote, multiply identities per site by devices per person before you enter it. Staff with a laptop and a phone double a per-device bill. For xPSK networks that issue a key per device or resident, model keys as the identity count.

What hidden costs should a cloud RADIUS quote show?

Ask for every cost line in writing: onboarding fees, certificate authority charges, identity provider connectors, support tiers, overage rates and minimum terms. Ask whether billing counts active or provisioned accounts, and whether any per-site price caps identities. Add the internal hours for migration as a one-off line. With those in place, the calculator output becomes a defensible annual budget figure.