The verdict in three sentences
For a B2B software vendor in Dubai, missing SAML SSO and fine-grained roles costs deals: the requirement appears in roughly 80% of enterprise security questionnaires. SAML and OIDC integration costs AED 25,000 to 60,000 and takes 4 to 8 weeks, plus an identity provider at USD 2 to 6 per user per month if you do not build it yourself. A single enterprise contract usually pays back the investment, provided you also ship a usable audit log.
What enterprise buyers actually require
IT departments at banks, government-related entities and large groups in the UAE send questionnaires of 80 to 300 questions. The same blocks come up every time.
| Requirement | Estimated frequency in questionnaires | What it implies | Blocking if missing |
|---|---|---|---|
| SAML 2.0 SSO (Entra ID, Okta, Google) | 80% | Login through the client's directory | Yes, most often |
| OIDC for modern applications | 50% | OAuth 2.0 standard, JWT tokens | Sometimes |
| SCIM provisioning | 40% | Automatic account creation and removal | For 500+ users |
| Configurable roles and permissions | 75% | Read, edit, admin per module | Yes |
| Exportable audit log | 65% | Who did what, when, from which IP | Often |
| MFA enforced in the app | 60% | If the client does not use SSO | Sometimes |
| UAE data residency and PDPL | 70% | Hosting location, subprocessors, DPA | For banks and government |
These frequencies are estimates from 2025 and 2026 questionnaires; they vary by sector and run higher in banking and healthcare.
The cost of integration
| Work package | Content | Duration | Indicative budget (AED) |
|---|---|---|---|
| SAML 2.0 | Multi-tenant login, per-client metadata, tests with 2 directories | 1 to 2 weeks | 8,000 to 18,000 |
| OIDC | Authorization flow, token refresh | 1 week | 4,000 to 10,000 |
| Role model (RBAC) | Default roles, custom roles, per-module permissions | 1 to 3 weeks | 6,000 to 16,000 |
| Audit log | Events, 12-month retention, CSV export | 1 week | 4,000 to 10,000 |
| SCIM provisioning (option) | Sync with client directory | 1 to 2 weeks | 6,000 to 14,000 |
| Documentation and admin console | Setup guide for the client's IT team | 0.5 to 1 week | 3,000 to 6,000 |
| Total excluding SCIM | 4 to 8 weeks | 25,000 to 60,000 |
These are 2026 market estimates for Dubai, for an application already in production with a sound architecture. If authentication is hardcoded into every screen, add 20 to 40% to refactor it.
Build or buy the identity provider
| Option | Upfront cost | Recurring cost | Best for |
|---|---|---|---|
| Full in-house build | AED 25,000 to 60,000 | Maintenance only | Under 10 SSO clients, experienced team |
| Market identity provider (Auth0, WorkOS, Okta CIC) | AED 8,000 to 20,000 integration | USD 2 to 6 per user per month, or a fee per SSO connection | Fast growth, little time |
| Self-hosted open source (Keycloak) | AED 16,000 to 40,000 | Hosting AED 200 to 800 per month + maintenance | Data residency constraints |
For 3,000 users, a provider at USD 3 per user per month costs USD 108,000 a year: beyond a few thousand users, self-hosting or an in-house build becomes competitive again.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Omar, CTO of a 25-person maintenance management software vendor in Dubai (illustrative persona), loses 3 tenders in a year for lack of SSO, at an average deal size of AED 180,000 per client per year. He invests AED 44,000 in SAML, OIDC, roles and audit log, then AED 24,000 for self-hosted Keycloak in a UAE data centre, with AED 600 per month of hosting. First-year cost: AED 75,200. If he wins just one of 3 similar contracts the following year, AED 180,000 of revenue covers the investment more than twice.
FAQ
SAML or OIDC: which first?
SAML, because most enterprise buyers in the UAE require it through Microsoft Entra ID or Okta. OIDC follows in about 1 week if the authentication layer is well isolated.
Should we charge clients for SSO?
Many vendors reserve it for their enterprise plan, with a 15 to 30% uplift on the subscription. That covers the identity provider and reflects the real cost of SSO support, about 2 to 4 hours per new client.
How long does it take to connect a new SSO client?
With a clear admin console and documentation, 1 to 3 hours on the vendor side. Without them, the metadata exchange with the client's IT team can drag on for 2 to 3 weeks.
How long must the audit log be kept?
Enterprise buyers usually ask for 12 months of retention, sometimes 3 years in banking or healthcare. Storage stays cheap, roughly AED 40 to 200 per month for a small vendor.
Is SSO enough to pass a security questionnaire?
No, it covers about 15 to 20% of the questions. Plan for a backup policy, an incident response plan and, for the largest contracts, a penetration test at AED 20,000 to 50,000.
Let's scope your project. Send us your tech stack and the security questionnaire that is blocking you: we will price the SSO, roles and audit log integration with a 4 to 8-week schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
