Adding Entra ID SSO to a custom app: cost in New York

The verdict in three sentences

Adding Microsoft Entra ID SSO (formerly Azure AD) to an existing custom app costs 1,800 to 4,500 USD in 2026 for the OIDC or SAML integration, plus 1,200 to 2,800 USD to map app roles to Entra ID groups. On licences, most Microsoft 365 customers already have Entra ID; budget about 6 USD per user per month for Entra ID P1 if you want conditional access. A realistic timeline is 2 to 4 weeks including testing, and the project removes orphaned accounts and shared passwords in one go.

Why New York IT leaders are doing it in 2026

In New York, outpatient clinics in Manhattan, mid-size firms in Brooklyn and Long Island City and financial services back offices share the same finding: business apps built 5 to 10 years ago have their own user database. The result: accounts still active after an employee leaves, passwords written on sticky notes at nursing stations, and no MFA. Cyber insurers, HIPAA security reviews and, for financial firms, the NYDFS cybersecurity regulation (23 NYCRR 500, with MFA requirements tightened in 2025) now expect centralised, strong authentication.

2026 market order of magnitude for a service provider. The most useful piece after SSO itself is SCIM provisioning: an employee disabled in Entra ID loses app access within a minute.

Licences and risks: what to know before signing

The classic risks are well known and handled during scoping: a break-glass local admin account kept outside SSO, service accounts that cannot use MFA, sessions that run too long on shared clinic workstations, and dependence on Microsoft availability. A documented fallback sign-in and session lengths tuned per profile cover these cases.

If the app is too old to accept clean SSO, the question becomes a rebuild. The Kolonell 2026 grid for custom applications then applies: 2.5 to 4 M FCFA (about 3,810 to 6,100 EUR) for a simple app, 4 to 7 M FCFA (about 6,100 to 10,670 EUR) for a medium app, 7 to 15 M FCFA and up (about 10,670 to 22,870 EUR and up) for a complex app, with SSO designed in from day one. Maintenance: 35,000, 75,000 or 120,000 FCFA per month (about 50, 110 or 180 EUR).

Mini case study

David, IT director of a 250-employee clinic in New York, runs an operating room scheduling app with 180 local accounts. His help desk handles about 40 password resets a month at 15 minutes each, or 120 hours a year. With an OIDC integration at 2,500 USD, group-based roles at 1,700 USD and SCIM provisioning at 2,300 USD, the project costs 6,500 USD. At 60 USD per loaded help desk hour, he saves 7,200 USD a year, before counting the removal of orphaned accounts flagged in the last HIPAA risk assessment: the project pays back in about 11 months.

FAQ

How much does it cost to add Entra ID SSO to a custom app?

Budget 1,800 to 4,500 USD for the OIDC or SAML integration, and 1,200 to 2,800 USD for group-based role management. With provisioning and logging, the total usually lands between 6,300 and 13,600 USD.

Do we need to buy Entra ID P1 licences?

Not necessarily, SSO works with Entra ID Free included in Microsoft 365. P1, at about 6 USD per user per month, becomes useful for conditional access and is often included if you have Business Premium or E3.

OIDC or SAML: which one?

OIDC for a modern web or mobile app, simpler and 30 to 40 % cheaper to integrate. SAML for an older app or a packaged product that only supports that protocol.

What timeline should we plan?

Plan 2 to 4 weeks, including one week of testing with a pilot group of 10 to 20 users before the full switch.

What happens if Microsoft is down?

A break-glass admin account outside SSO, protected and logged, keeps you in control. Major Entra ID incidents are rare, in the order of a few hours a year.

Let's scope your project. Send us your app's technology, user count and Microsoft 365 plan: we will price the SSO integration, roles and provisioning with a 2 to 4 week plan. Detailed quote within 48 h via our quote form. WhatsApp +221 77 596 93 33.