The verdict in three sentences
When an enterprise IT team blocks a deal, it is very often because the product lacks SAML or OIDC single sign-on and SCIM provisioning, two baseline requirements above 500 employees. A B2B software company can build them in-house for roughly $9,000 to $28,000, or use a service such as Auth0 or WorkOS at around $125 per enterprise connection per month in 2026. The choice depends mostly on how many enterprise accounts you expect over 3 years and on the deadline in the deal at hand, usually 4 to 8 weeks.
What enterprise IT actually asks for
SSO is one line of the security questionnaire. Enterprise questionnaires (banks, manufacturers, public bodies) often hold 80 to 200 questions, about ten of which are knockout criteria.
| Security questionnaire item | What to ship | In-house effort |
|---|---|---|
| SAML 2.0 SSO | Sign-in via Entra ID, Okta, Google Workspace, ADFS | 6 to 12 days |
| OIDC SSO | Modern alternative, often requested alongside | 3 to 5 days |
| SCIM 2.0 provisioning | Automatic account creation and deactivation | 6 to 10 days |
| Role mapping | Directory groups mapped to app roles | 3 to 5 days |
| Audit log | Sign-ins, permission changes, exports, kept 12 months | 4 to 6 days |
| SSO admin screen | Client configures its own identity provider | 4 to 8 days |
| Disable local passwords | Enforce SSO for a given domain | 1 to 2 days |
That is 27 to 48 days, or $9,000 to $28,000 depending on day rate ($330 to $580 loaded in-house or freelance) and legacy code. Without SCIM many IT teams accept a first signature but require provisioning within 6 months.
Build or use a service
| Criterion (2026 estimates) | In-house build | Auth0 or WorkOS |
|---|---|---|
| Upfront cost | $9,000 to $28,000 | $2,200 to $5,500 integration |
| Recurring cost | Maintenance 10 to 15% a year | About $125 per enterprise connection per month |
| Lead time | 6 to 10 weeks | 2 to 4 weeks |
| Identity provider coverage | The ones you test | Broad, tested by the vendor |
| Lock-in | None | High, costly to migrate |
| Data residency | Your hosting | Depends on region offered, check the contract |
The service wins when the deal demands an answer within a month or when you expect fewer than 10 enterprise connections. Beyond 15 to 20 enterprise accounts, cumulative subscription costs quickly exceed a well-maintained in-house build. For data hosted outside the client's region, also check how transfers are covered in the contract, since enterprise IT and procurement teams look closely at it.
A hybrid path is common too: start with a service to unblock the current deal within weeks, but design your user and role model so that the identity layer can be swapped later. Keeping your own internal user IDs, storing the identity provider mapping in your database and wrapping the vendor SDK behind a thin internal interface typically adds 2 to 4 days of work. It turns a future migration from a multi-month project into a few weeks, once enterprise connections reach the point where subscription fees hurt margins.
The checklist to bring to the security review
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Beyond SSO, prepare written answers on: TLS 1.2 and encryption at rest, hosting region, tested backups, a pentest report under 12 months old, password policy, incident response with notification within 72 hours, business continuity, sub-processor list, and ideally a SOC 2 Type II or ISO 27001 roadmap. If clients also want to connect their own tools, the next step is usually a documented API, as covered in our article on a public API for an HR tech SaaS vendor.
Mini case study
Emily, CEO of a construction project management SaaS ($2.3M ARR), has 3 enterprise deals stalled, averaging $40,000 a year each. She expects 12 enterprise connections within 3 years.
Service option: $4,400 integration, then an average of 7 active connections over the period at $125 a month, so 7 x 125 x 36 = $31,500. Three-year cost: $35,900. In-house option: $21,000 build and $2,800 a year maintenance, $29,400 over 3 years, but 8 weeks of lead time. Emily went in-house after negotiating a start 6 weeks after signature with the first prospect. Winning 2 of the 3 deals brings $80,000 a year, a payback in under 4 months.
FAQ
SAML or OIDC first? SAML remains the most requested by large enterprises, especially with Entra ID and ADFS. OIDC adds 3 to 5 days once the foundation is right.
Is SCIM really mandatory? Not always at signature, but most IT teams require it within 6 to 12 months. Without it, departed employees keep active accounts, which is an audit finding.
Can we charge for SSO? Yes, many vendors keep it for an enterprise plan priced 20 to 40% higher. In public tenders, avoid presenting it as a paid security add-on.
How long to onboard a new client once SSO exists? With a self-serve admin screen, 1 to 2 hours on the client side and minutes of support. Without one, expect half a day of technical back and forth per client.
Should the pentest cover SSO? Yes, SAML signature validation flaws are a classic vulnerability. A targeted authentication pentest costs $4,500 to $10,000.
Let's scope your project. Send us the security questionnaire from your next deal and your current architecture, and we will price SSO, SCIM and audit logging on a timeline that fits your deadline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
