The verdict in three sentences
In a company with 1,200 workstations, an in-house app with its own credentials is both a security risk and a ticket generator: about 15% of helpdesk requests concern passwords. Adding Microsoft Entra ID single sign-on and role management aligned with directory groups costs, as a 2026 order of magnitude, 4,000 to 12,000 EUR excl. VAT, with SCIM provisioning as an option. The work takes 2 to 5 weeks and lets the security lead cut off a departing employee's access in one click, across every application. Our benchmark case is a mid-sized firm in Strasbourg; the same scope and prices apply to a company in Dublin.
Why the in-house app blocks the security policy
A mid-sized industrial or services company often has one or more apps built internally or by a contractor: production tracking, expense management, sales portal. They manage accounts in their own database, with passwords users reuse elsewhere, no multi-factor authentication and no link to staff departures.
| Criterion | Local accounts in the app | Microsoft Entra ID SSO |
|---|---|---|
| Multi-factor authentication | To be built or missing | Conditional access policy already in place |
| Employee departure | Manual deactivation, often forgotten | Account disabled in the directory, access cut everywhere |
| Passwords to remember | One more per app | None added |
| Password helpdesk tickets | About 15% of volume | Sharp drop on the covered scope |
| Sign-in log | Specific to the app | Centralised in Entra ID |
| Compliance (ISO 27001 audit, cyber insurance) | Gap to justify | Requirement covered |
For 1,200 workstations generating about 6,000 tickets a year, 15% password tickets means 900 requests. At an estimated internal cost of 20 to 25 EUR per ticket, that is 18,000 to 22,500 EUR a year, part of which disappears with SSO.
Options and their cost
The technical basis is standard: OpenID Connect for a recent web app, SAML 2.0 for an older one. The real work lies in mapping directory groups to app roles, migrating existing accounts and testing with IT.
| Option | Content | 2026 budget excl. VAT | Timeline |
|---|---|---|---|
| Simple SSO | OpenID Connect or SAML sign-in, existing accounts matched by email | 4,000 to 6,000 EUR | 2 weeks |
| SSO + roles | Simple SSO + app roles driven by Entra ID groups | 6,000 to 8,500 EUR | 3 weeks |
| SSO + roles + SCIM | Automatic account creation, update and deactivation | 8,500 to 12,000 EUR | 4 to 5 weeks |
| Legacy app without a separate authentication layer | Sign-in module rework before integration | On quote, after audit | 1 to 2 extra weeks |
| Entra ID licences | Often already included in your Microsoft 365 subscription | Outside quote | Not applicable |
SCIM provisioning is the option that adds most to security: without it, the app account still exists after departure, it is only unreachable. With SCIM, it is deactivated automatically and the history stays clean for audit.
Typical 2 to 5 week plan
| Week | Task | Owner |
|---|---|---|
| 1 | Sign-in module audit, choice of OpenID Connect or SAML | Contractor |
| 1 | App registration in Entra ID | IT |
| 2 | SSO sign-in development and account matching | Contractor |
| 3 | Roles driven by directory groups | Contractor + IT |
| 4 | SCIM connector and user departure tests | Contractor |
| 4 to 5 | Acceptance, phased switchover, removal of local passwords | IT + business teams |
Switching over by a pilot group of 50 users, then department by department, prevents a role mapping issue from locking out the whole company on a Monday morning.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Julien, security lead of a 1,200-workstation company in Strasbourg, must bring 3 in-house apps into compliance before his cyber insurance renewal. He chooses SSO + roles + SCIM for the production management app at 11,000 EUR excl. VAT, and SSO + roles for the other two at 7,000 EUR each. Total: 25,000 EUR excl. VAT. Of the 900 annual password tickets, he estimates 40% concern these 3 apps, i.e. 360 tickets at 22 EUR, about 7,900 EUR a year avoided. The main gain remains closing a security gap flagged by the insurer, which conditioned the policy renewal.
FAQ
Does the app need to be rewritten to add SSO?
No, in most cases only the sign-in module changes. If the app mixes authentication and business logic, allow 1 to 2 extra weeks of rework, priced after audit.
OpenID Connect or SAML?
OpenID Connect for a recent web or mobile app, SAML 2.0 if the framework is old or requires it. Both are handled by Entra ID without a specific licence cost in most business Microsoft 365 subscriptions.
What happens to existing accounts?
They are matched to directory accounts by work email address. The few accounts with no match, often 2 to 5%, are handled manually during acceptance.
Is SCIM essential?
It is not mandatory, but it automates joiners and leavers. For 1,200 workstations with 10% turnover, that is about 120 departures a year no longer handled by hand.
Can external contractors sign in?
Yes, through Entra ID guest accounts, with the same multi-factor rules. Their access can be time-limited and reviewed automatically.
Let's scope your project. Send us the list of your in-house apps, their technology and your Microsoft 365 subscription: we will price SSO integration between 4,000 and 12,000 EUR excl. VAT per app, with a 2 to 5 week plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
