The verdict in three sentences
Adding SSO (SAML 2.0 and OIDC) and SCIM provisioning to a B2B SaaS costs EUR 8,000 to 25,000 excl. VAT in-house or outsourced, delivered in 4 to 8 weeks. A third-party service (WorkOS, Auth0, Okta Customer Identity) avoids the build but charges EUR 125 to 250 per enterprise connection per month. Beyond 6 to 10 enterprise customers, building it yourself becomes cheaper, provided you add the audit log, MFA and security documentation that procurement questionnaires check.
Why enterprise accounts stall without SSO
The IT department of a CAC 40 group no longer accepts manually managed accounts. It requires its 3,000 employees to sign in with their Microsoft Entra ID or Okta identity, leavers to be deactivated automatically the same day, and every sensitive action to be logged. Procurement's security questionnaire, often 150 to 250 questions based on ISO 27001 and SIG Lite, rules out vendors who answer "no" on these points.
| Typical enterprise requirement | What you must deliver | Build cost (EUR excl. VAT) | Duration |
|---|---|---|---|
| SAML 2.0 SSO | Per-customer configuration, metadata, certificates | 3,000 to 7,000 | 1 to 2 weeks |
| OIDC SSO | Authorization Code + PKCE flow | 1,500 to 4,000 | 1 week |
| SCIM 2.0 provisioning | Create, update, deactivate accounts and groups | 3,000 to 8,000 | 2 to 3 weeks |
| MFA for non-SSO accounts | TOTP or FIDO2 keys | 1,000 to 3,000 | 1 week |
| Exportable audit log | Who did what, when, from which IP, SIEM export | 2,000 to 5,000 | 1 to 2 weeks |
| Customer admin console | Verified domains, roles, sessions | 1,500 to 4,000 | 1 week |
| Total | 8,000 to 25,000 (excluding overlaps) | 4 to 8 weeks |
The low end fits a SaaS whose authentication is already clean (well-known library, clear multi-tenant model). The high end covers a rework of the user model, common when the product was built for SMEs with one account per email.
Build or buy: the numbers
| 2026 criterion | In-house build | Third-party identity service |
|---|---|---|
| Upfront cost | EUR 8,000 to 25,000 excl. VAT | EUR 1,000 to 3,000 integration |
| Recurring cost | EUR 1,500 to 4,000 per year maintenance | EUR 125 to 250 per connection per month |
| Annual cost for 5 enterprise customers | EUR 1,500 to 4,000 | EUR 7,500 to 15,000 |
| Annual cost for 20 enterprise customers | EUR 2,000 to 5,000 | EUR 30,000 to 60,000 |
| Time to go live | 4 to 8 weeks | 1 to 2 weeks |
| Vendor lock-in | None | High, costly migration |
| Identity data location | Your hosting, EU possible | Often US, check it |
A third-party service is the rational choice to sign the first enterprise account within 2 weeks. Building in-house makes sense once the roadmap targets 10 enterprise customers, or when buyers require EU hosting of identity data, increasingly common since the NIS 2 directive.
What the security questionnaire will check
SSO rarely unlocks the deal on its own. Prepare in parallel a written security policy, a business continuity plan, a penetration test less than 12 months old (EUR 5,000 to 15,000 excl. VAT), the list of GDPR sub-processors and a role matrix. With that file ready, answering a 200-question questionnaire takes 3 to 5 days instead of 3 to 4 weeks.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Julien, CEO of a Lyon-based HR SaaS with EUR 2 million in annual recurring revenue, is stuck at procurement with a CAC 40 group for a EUR 180,000 per year contract. Three other enterprise prospects set the same condition.
Third-party option: 4 connections x EUR 190 x 12 = EUR 9,120 per year, then EUR 22,800 per year at 10 customers. In-house option: EUR 18,000 excl. VAT of development, 6 weeks, plus EUR 3,000 per year maintenance. Over 3 years, ramping up to 10 customers, the third-party service costs about EUR 48,000 and the in-house option EUR 27,000. Julien plugs in a third-party service to sign the CAC 40 deal within 2 weeks and starts the in-house build in parallel, delivered before the fifth customer. The EUR 180,000 contract alone covers the investment 10 times over.
FAQ
SAML or OIDC, do we need both? Yes, if you target enterprises: about 60% of large French groups still use SAML with Entra ID or ADFS, the rest prefer OIDC. The second protocol adds EUR 1,500 to 4,000.
Is SCIM essential? For contracts above 500 users, almost always. It guarantees automatic deactivation of leavers, required by 8 security questionnaires out of 10.
Can we charge extra for SSO? Many vendors reserve it for the Enterprise plan, with a 20 to 40% higher price per seat. That usually pays back the build with the first contract.
How long to onboard the first customer connection? Once the module ships, configuring a new customer takes 1 to 3 hours with their IT team.
Do we need ISO 27001 certification? Not always for the first contract, but 40 to 60% of enterprise tenders ask for it. Allow EUR 25,000 to 60,000 and 9 to 12 months.
Let's scope your project. Describe your current authentication stack and your prospects' requirements: we will price SSO, SCIM and audit logging between EUR 8,000 and 25,000 excl. VAT for delivery in 4 to 8 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
