Salesforce External Identity—the license type that gives external users (customers, partners, citizens, members) authenticated access to Salesforce-hosted experiences without requiring a Customer Community, Partner Community, or full Experience Cloud license—has become one of the most commercially material license decisions in the broader Salesforce footprint. The capability is foundational to any digital experience that authenticates end users against the Salesforce identity layer: a customer portal, a partner self-service site, a citizen-facing public-sector experience, a membership-based community surface. The License has a distinct commercial structure, a distinct scaling profile, and a distinct set of negotiation levers that the disciplined buyer captures meaningful commercial outcomes against.
This article unpacks the External Identity license, the related Experience Cloud licensing surface, the commercial structure that connects the two, and the negotiation discipline that produces the meaningful commercial outcomes across the external-user identity footprint. The framing is buyer-side and vendor-neutral. The external-user identity surface is one of the dimensions of the Salesforce commercial commitment that the undisciplined buyer most consistently overpays for, because the commercial structure is not particularly transparent and the operational scope is frequently overstated relative to the actual deployment requirement.
What the External Identity license actually does
The External Identity license provides authenticated identity for external users, with the Salesforce identity layer serving as the authoritative identity store. The license supports the standard authentication flows—password-based, social, SAML/OIDC SSO, MFA—and provides the identity foundation for any Salesforce-hosted experience that requires authenticated external access. The license does not include the Experience Cloud capability surface; the External Identity user can authenticate against the Salesforce identity layer but cannot access the broader Experience Cloud capability without additional licensing.
The External Identity license is priced per monthly active user (MAU), with the MAU definition being one of the most commercially consequential dimensions of the commitment. The MAU definition determines which authenticated users count against the commercial commitment, and the definition has material implications for the commitment size. The disciplined buyer scopes the MAU definition against the realistic monthly active user count, not against the maximum addressable user base.
| License Type | Capability | Pricing model |
|---|---|---|
| External Identity | Authentication only | Per MAU, $1.00-$2.50 |
| External Identity + Plus | Auth + limited data access | Per MAU, $2-$4 |
| Customer Community Login | Read + limited write | Per login, $4-$10 |
| Customer Community Member | Full community surface | Per member, $5-$12 |
| Partner Community | Partner-grade access | Per partner, $25-$50 |
The MAU definition is the most consequential commercial dimension
The monthly active user definition is the single most consequential commercial dimension of the External Identity commitment. The MAU definition determines which authenticated users count against the commercial commitment, and the definition has material implications for the commitment size. The default MAU definition typically counts every user who authenticates in a given month, which produces a commitment size that scales with the broader user authentication pattern.
The disciplined approach is to scope the MAU definition against the realistic monthly active user count, not against the maximum addressable authenticated user base. The scoping discipline includes the documentation of the realistic authentication pattern—the user populations that actually authenticate monthly, the user populations that authenticate sporadically, the user populations that authenticate rarely. The MAU commitment should be scoped against the realistic monthly active user count, with explicit volume tier scaling that aligns the commitment with the realistic authentication pattern.
The Experience Cloud licensing surface
The External Identity license is frequently coupled with the broader Experience Cloud licensing surface—Customer Community Login, Customer Community Member, Partner Community, and the related Experience Cloud capability tiers. The Experience Cloud licensing surface has its own commercial structure, its own scaling profile, and its own negotiation levers. The disciplined buyer scopes the Experience Cloud licensing surface against the operational requirement of the deployment, not against the maximum addressable Experience Cloud capability.
The Experience Cloud licensing decision is structured around the operational requirement of each user population. The user population that requires only authenticated identity is licensed at External Identity. The user population that requires limited read access plus authentication is licensed at Customer Community Login. The user population that requires the full community surface is licensed at Customer Community Member. The user population that requires partner-grade access is licensed at Partner Community. The disciplined licensing structure matches each user population to the minimum-viable Experience Cloud tier for the operational requirement.
The four levers that move the External Identity commitment
1. Scope the MAU definition against realistic monthly active user count
The MAU definition should be scoped against the realistic monthly active user count, with explicit documentation of the authentication pattern across the user populations. The disciplined scoping captures 30-50% reductions in the MAU commitment without operational impact, because the realistic MAU count is typically 30-50% of the maximum addressable authenticated user base.
2. Tier the Experience Cloud licensing against operational requirement
The Experience Cloud licensing should be tiered against the operational requirement of each user population, with the minimum-viable tier for each population. The tiered licensing captures 25-45% reductions in the Experience Cloud commitment without operational impact, because the maximum addressable Experience Cloud capability is frequently overstated relative to the realistic operational requirement.
3. Negotiate the volume commitment structure with tier thresholds
The volume commitment structure should include tier thresholds at which the per-MAU pricing steps down, with explicit protections against the volume-commitment exposure when the deployed MAU falls short of the original assumptions. The disciplined volume commitment structure captures 15-25% reductions in the volume-commitment exposure across the commitment term.
4. Coordinate the External Identity commitment with the broader Salesforce commercial discussion
The External Identity commitment should be coordinated with the broader Salesforce commercial commitment. The bundled negotiation captures the volume leverage that aligns the External Identity commitment with the broader footprint, and prevents the negotiation-leverage dilution that occurs when the External Identity commitment is negotiated as a discrete commercial discussion.
The pitfalls that show up in External Identity commitments
Six patterns appear repeatedly in External Identity commitments. First, the MAU definition is scoped against the maximum addressable authenticated user base rather than against the realistic monthly active user count. Second, the Experience Cloud licensing is scoped at the maximum capability tier rather than against the operational requirement of each user population. Third, the volume commitment structure is static rather than tiered, exposing the customer to volume-commitment exposure when deployed MAU falls short. Fourth, the External Identity commitment is negotiated as a discrete commercial discussion, dropping the volume leverage that would have applied in a coordinated negotiation. Fifth, the renewal mechanics are silent on the MAU definition and the Experience Cloud licensing, exposing the customer to discretionary repricing at the renewal moment. Sixth, the customer does not establish the operational MAU baseline, leaving the External Identity commitment without an operational benchmark for the next renewal.
What a well-negotiated External Identity commitment looks like
A well-negotiated External Identity commitment has seven features. The MAU definition is scoped against the realistic monthly active user count, with explicit documentation of the authentication pattern. The Experience Cloud licensing is tiered against the operational requirement of each user population, with the minimum-viable tier for each population. The volume commitment structure includes tier thresholds and scope-down protections. The External Identity commitment is coordinated with the broader Salesforce commercial discussion for volume leverage. The renewal mechanics specify the MAU definition, the Experience Cloud licensing, and the protections against discretionary repricing. The operational MAU baseline is documented and shared as the foundation for the commercial scoping. And the commitment includes the customer's right to scope down the MAU commitment and the Experience Cloud licensing if operational reality falls short.
Benchmark outcomes by deployment scale
For a mid-market customer with a 100,000-500,000 addressable authenticated user base and active External Identity deployment, the disciplined External Identity commitment typically lands at $140K-$680K annually, against the standard default of $260K-$1.4M for equivalent addressable user bases.
For a large-enterprise customer with a 1M-10M addressable authenticated user base, the disciplined External Identity commitment typically lands at $1.2M-$8.4M annually, against the standard default of $2.4M-$18M for equivalent addressable user bases. The proportional commercial outcomes scale with the broader external-user identity footprint.
The renewal data that wins
The single most valuable artifact for an External Identity renewal is the user-population-by-user-population operational consumption report. The report should capture the realistic monthly active user count across each user population, the Experience Cloud tier consumption across each population, and the broader operational outcomes the External Identity deployment has produced. The report establishes the operational baseline for the next renewal conversation and supports the right-sizing of the MAU commitment and the Experience Cloud licensing at the renewal moment.
Where to begin
If your External Identity commitment is in scoping, the most useful first step is a user-population-by-user-population operational specification. Document the realistic monthly active user count across each user population, the Experience Cloud tier requirement for each population, and the broader operational specification of the deployment. The specification establishes the foundation for the disciplined commercial commitment. If your External Identity commitment is already in production, the most useful first step is a user-population-by-user-population consumption analysis that establishes the right-sizing opportunities for the next renewal conversation.
The strategic frame
The Salesforce External Identity license—and the broader Experience Cloud licensing surface—is a strategic commercial decision that has material implications for the customer's external-user identity footprint and the broader Salesforce commitment. The commitment deserves the same scope discipline that applies to every other Salesforce commercial discussion, with the multi-dimensional structure—MAU definition, Experience Cloud tiering, volume commitment, coordination with the broader Salesforce commitment—warranting careful negotiation across each dimension. Customers who treat the External Identity commitment as a strategic commercial decision—with disciplined scoping and measured operational outcomes—consistently capture meaningful commercial outcomes across the external-user identity footprint.