Teleport Enterprise Edition Pricing Guide
The Teleport Infrastructure Identity Platform modernizes identity, access, and policy for infrastructure, for both human and non-human identities, improving engineering velocity and resiliency of critical infrastructure against human factors and/or compromise.
Revision: JUNE 16, 2026
Overview
The Teleport Infrastructure Identity Platform consists of four products:
Teleport Zero Trust Access
Provides engineers with just-in-time, least-privilege access to applications, servers, databases, Kubernetes clusters, MCP servers, Git repositories, and other resources across distributed infrastructures, improving engineering time to market and infrastructure resiliency.
Teleport Machine & Workload Identity
Provides non-human identity management and access control, improving infrastructure resiliency by securing system and data access between machines and workloads.
Teleport Identity Governance
Hardens and monitors identities for both human and non-human identities, improving resiliency of infrastructure against compromise due to human-factor or identity attacks.
Teleport Identity Security
Exposes and eliminates hidden risk across all of your infrastructure.
Teleport Infrastructure Identity Platform
Standard
Teleport Zero Trust Access, Teleport Machine & Workload Identity, and Teleport Identity Governance are bundled together as our Standard offering for companies deploying access & governance use cases.
Premium
Our Premium offering adds Teleport Identity Security for companies that also want to deploy identity security use cases.
Billable Metrics
Teleport Infrastructure Identity Platform pricing is usage-based, calculated from two billable metrics:
Usage-Based Pricing
Billable Metric | Description |
|---|---|
Monthly Active User (MAU) | Any unique interactive local or SSO user, utilizing any protocol or interface, who shows activity at least once within a monthly period, starting on the subscription start date and ending on each monthly anniversary thereafter. “Active” means a user having performed any activity that would appear in an audit log; for example, connecting to a resource via the Web UI or via |
Teleport Protected Resource (TPR) | Any unique resource such as a Kubernetes cluster, SSH server, database instance, Windows and Linux desktops, serverless endpoint, MCP server, Git repository, or a machine or workload identity (any distinct CI/CD pipeline, machine host, microservice, or similar non-human identity) that has registered itself with the Teleport cluster at least once within a monthly period. We aggregate TPRs during each day on an hourly basis, and take an hourly average to compute a daily TPR. Then we average the daily TPR over a monthly period, which starts on the subscription start date and ends on each monthly anniversary thereafter. |
Teleport Enterprise Edition
Teleport Enterprise Edition is Teleport’s commercial edition of its Infrastructure Identity Platform. Teleport products are available as follows:
Products
Enterprise Edition | Standard | Premium | Billable Metrics |
|---|---|---|---|
Teleport Zero Trust Access |
| ||
Teleport Machine & Workload Identity | |||
Teleport Identity Governance | |||
Teleport Identity Security | N/A |
Support
Support Packages | Products | Notes |
|---|---|---|
Priority Support | All products | Always included for self-hosted, hybrid, and cloud deployments of the Teleport Platform. |
Multi-Region High Availability Support | Enterprise Edition – Standard | Modifies Priority Support by elevating Severity Level 1 SLA from 1 hour to 30 minutes. |
Deployment & Cloud Support Packages
Teleport can be deployed on-premises or in the cloud. For customers choosing Teleport-managed cloud deployment, Teleport offers two service packages:
- Standard High Availability is offered with Teleport-managed cloud deployments, featuring a 99.9% SLA with single-region failover and up to 50K connected resources per tenant.
- Multi-Region High Availability is offered with Teleport-managed cloud deployments, offering 99.99% SLA, up to 130K connected resources, and a 30-minute Severity Level 1 response time.
Support Service | Failover | Availability Zones | SLA | Connected Resources per Tenant | Fee | Tenants Included | Additional Tenant Cost | Max Tenants Allowed | Paired Support |
|---|---|---|---|---|---|---|---|---|---|
Standard High Availability | Single Region | 3 | 99.9% | Up to 50k | Included | 2 | Yes | 10 | Priority Support |
Multi-Region High Availability (MRHA) | Multi-Region | 9 | 99.99% | Up to 130k | Yes | 2 | Yes | 5 | MRHA Support |
Appendix
Teleport Enterprise Edition Key Features
| Teleport Zero Trust Access |
| On-demand, least privileged access, on a foundation of cryptographic identity and zero trust. |
|
| Teleport Machine & Workload Identity |
| A product for non-human identity management and access control, improving infrastructure resiliency by securing system and data access between machines and workloads. |
|
| Teleport Identity Governance |
| Hardens and monitors identities for both human and non-human identities, improving resiliency of infrastructure against compromise due to human-factor or identity attacks. |
|
| Teleport Identity Security |
| Expose and eliminate hidden risk in your infrastructure, including suspicious identity behavior, shadow access, and blind spots. |
|
Machine & Workload Identity TPR examples
The Machine & Workload Identity agent, tbot, runs on your machines and issues short-lived credentials to your workloads providing them with an identity and allowing them to access other resources protected by Teleport. We count each unique instance of tbot as a TPR as determined by hourly average. The following examples illustrate this:
Virtual Machine (1 TPR per VM): Each virtual machine that will run tbot as a long-lived background service to issue identities to services running upon that machine will count as 1 TPR.
Kubernetes Cluster (1 TPR per node): When using Kubernetes integration and SPIFFE workload attestation, the tbot agent runs as a DaemonSet, and each node in K8s counts as 1 TPR.
CI/CD Pipeline (1/730th TPR per run): Each time the CI/CD pipeline runs, a unique ephemeral instance of tbot will spawn to issue an identity for that pipeline run. Assuming the pipeline run takes less than 1 hour, due to the hourly averaging mechanism used by Teleport, this counts as 1/730th of a TPR. If you had 730 CI/CD runs in a month, this would be 1 TPR.
Things that are not counted as TPRs:
- SPIFFE IDs
- X.509 certificates
Identity Security TPR examples
Every Teleport Protected Resource discovered for the purposes of Zero Trust Access is available and counted for Identity Security (when Identity Security is enabled) and vice-versa.
As a rule of thumb, everything that is a computing resource or a bot with a virtual or real CPU and memory is a TPR; otherwise it’s not.
Examples of resources visible in Identity Security that are not TPRs:
IAM roles, Okta groups, Entra ID groups:
These AWS and other SaaS resources are highly ephemeral. Identity Security may discover and reveal them in the access graph, but those are not counted as TPRs.
SSH Keys, end-user computers, Teleport Roles, RDS tables:
These are examples of other fine-grained resources that may be discovered by Identity Security, but those are not counted as TPRs either.
Machine and Workload Identity Jenkins jobs, GitHub actions, and microservices:
Identity Security may discover and reveal them in the access graph, but those are not counted as a TPR for the purposes of Identity Security.