What happens to SSO in Directus v12?

Directus v12 did not change how single sign-on works. The openid, oauth2, ldap and saml drivers are the same, the environment variables are the same, and a provider configured for v11 carries into v12 untouched. What changed is the question that comes before configuration: whether your licence entitles you to SSO at all.

This is the licensing half of our SSO coverage. If you came here to wire up a provider, the setup guides — Google, Microsoft Entra ID, GitHub and LDAP / Active Directory — are unaffected by v12 and stay accurate. This post is about who runs them for free, who pays, and the seat definition that decides how much.

What v12 actually changed

Two things arrived together in 2026. Directus replaced the Business Source License with its own Modified Source Commercial License (MSCL), and v12 shipped registration keys — instances validate against a licensing service and report usage telemetry. The software stayed source-available; the enforcement became real rather than honour-based.

With enforcement came tiers, and with tiers came the first genuine feature gates Directus has had. SSO is the most prominent thing behind one.

Where SSO sits in each tier

The Core tier is free for everyone, forever, with no registration — and it is deliberately small: three seats, fifty collections, no SSO, no advanced RBAC filters. Directus staff describe it as the tier other vendors would charge $20 a month for. At three seats, the absence of SSO is an irritation rather than a governance problem, which is presumably the point.

The Open Innovation Grant is where most self-hosters actually live. If your organisation makes under $5M a year and is under 50 people, the grant gives you the full platform — SSO, custom RBAC filters, everything, with no feature gates — for free. The two things it costs are registration and keeping basic telemetry on. And note how Directus counts those 50 people: it is the people who log into the Studio, not everyone on your payroll.

Teams — the middle tier introduced after community pushback on pricing, at “hundreds of dollars a month” rather than the four figures originally floated — includes SSO and support. Enterprise includes everything, uncapped, and is the only tier that can turn the telemetry off.

Do SSO logins consume seats?

This is the question that decides whether the licence change costs you anything, and Directus has now answered it formally: a seat is consumed by each user who has at least one policy with App Access or Admin Access enabled. Nothing else counts.

That cuts both ways. The 40 employees who sign into the Data Studio through Entra ID each consume a seat — SSO does not change that arithmetic. But if you use Directus as the identity layer for your own application, the end users who authenticate through it and only ever touch the REST or GraphQL APIs consume no seats, no matter how many thousands of them exist — provided their policies grant no app access. Directus’s own example: two content editors plus 50,000 registered application users is two seats.

The practical rule: audit the policies attached to your SSO-provisioned users. Directus creates users on first SSO login with the role you configured in AUTH_<PROVIDER>_DEFAULT_ROLE_ID — if that role’s policy grants app access, every person who ever clicks the button becomes a seat, whether or not they return. A user whose policy grants app access counts even if they never log in.

Your existing configuration carries over

To be concrete about what does not change: redirect URLs, driver choice, scopes, identifier keys, PUBLIC_URL behaviour, the cookie flags — all of it works in v12 exactly as the guides describe. There is nothing to reconfigure, re-register with your identity provider, or migrate. If sign-in worked the day before the upgrade and your tier includes SSO, it works the day after.

What is new is what happens when your tier does not include it. On Core, SSO is not available — the licence, not the software, is what says no.

If you are on Core and need SSO

You have three honest options, in ascending order of cost. Check the grant thresholds first — under $5M a year and under 50 people covers a great many businesses that assume they must pay, and the grant’s only ongoing price is registration and telemetry. If you are over the thresholds, the Teams tier was created precisely for the “we need SSO but we are not an enterprise” case. And if neither fits, that is the Enterprise conversation.

What we would not recommend is the fourth option people reach for: staying on an old v11 while the world moves on. It works until the first security release you cannot take, and authentication is the wrong place to fall behind on patches.

The parts still open

Licensing enforcement in v12 raises questions Directus has not fully answered — what exactly happens to sign-ins when a paid licence lapses, how registration keys behave across development, staging and production, and what a long network outage does to validation. We track every one of those, with sources, in our Directus licence reference — 56 questions the community asked, including the 15 Directus has not answered yet. If SSO is load-bearing for your organisation, the enforcement questions deserve a read before you commit an architecture to them.