The verdict in three sentences
Adding SSO authentication (SAML 2.0 or OpenID Connect) to a business web app costs between 5,000 and 15,000 CAD in Toronto in 2026, depending on the number of roles and the state of the existing login code. Adding SCIM provisioning, which creates and disables accounts automatically from the directory, costs about 6,000 CAD more and is often what truly satisfies IT. The project ships in 3 to 6 weeks and cuts password-related tickets by roughly 70%.
What integration costs by identity provider
Most Canadian IT departments mandate Microsoft Entra ID (formerly Azure AD), sometimes Google Workspace or Okta. App-side work is similar, but configuration, testing and group handling vary.
| Identity provider | Protocol | Integration cost (CAD) | Timeline | Specifics |
|---|---|---|---|---|
| Microsoft Entra ID | OIDC or SAML | 5,000 - 10,000 | 3 - 4 weeks | App roles and groups, conditional access |
| Google Workspace | SAML or OIDC | 5,000 - 9,000 | 3 weeks | Less granular groups |
| Okta | OIDC or SAML | 5,500 - 11,000 | 3 - 4 weeks | Excellent SCIM support |
| On-premise ADFS | SAML / WS-Fed | 8,000 - 15,000 | 4 - 6 weeks | Network access and certificates |
| Several IdPs (multi-client SaaS) | OIDC + SAML | 10,000 - 15,000 | 5 - 6 weeks | One directory per client, email domain discovery |
| SCIM 2.0 provisioning (option) | SCIM | + 5,000 - 7,500 | + 1 - 2 weeks | Automatic deactivation when an employee leaves |
MFA is usually delegated to the identity provider, so no extra cost on the app side. If the app must also serve external users without a directory, budget 2,000 to 4,500 CAD for local MFA (TOTP or passkeys).
Build direct, Auth0 or Keycloak: three-year cost
Three architectures dominate. A direct integration with a proven OIDC library is enough for an internal app connected to one directory. An identity broker pays off as soon as several directories or apps are involved.
| Option | Upfront cost (CAD) | Monthly cost | 3-year cost (ballpark) | Best for |
|---|---|---|---|---|
| Direct integration (OIDC library) | 5,000 - 9,000 | 0 CAD | 5,000 - 12,000 | One app, one directory |
| Self-hosted Keycloak | 7,500 - 13,000 | 120 - 450 CAD (server + monitoring) | 12,000 - 29,000 | Several apps, data kept in Canada |
| Auth0 (Okta) | 6,000 - 12,000 | 0 - 2,200 CAD depending on users and enterprise SSO | 6,000 - 91,000 | B2B SaaS selling to enterprises |
| Microsoft Entra External ID | 6,000 - 12,000 | Free up to 50,000 monthly active users, then usage-based | 6,000 - 22,000 | Microsoft ecosystem |
| Zitadel or Authentik cloud | 6,000 - 10,500 | 150 - 1,200 CAD | 12,000 - 54,000 | Open-source alternative |
Data residency matters more and more: many public sector and regulated organisations in Ontario prefer Keycloak hosted in a Canadian region, in line with PIPEDA and provincial requirements.
What makes an SSO project fail
Three mistakes recur: keeping the old password login running in parallel with no shutdown plan, mapping app roles by hand instead of using directory groups, and forgetting logout (single logout) and session duration. Require acceptance testing with one test account per role and an employee departure scenario: the account must be blocked in the app within 15 minutes of being disabled in the directory.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
David, IT director of a 450-employee retail group in Toronto, mandates Entra ID for its 6 internal apps. The help desk handles 180 password tickets a month at 18 minutes each, 54 hours monthly at 58 CAD fully loaded: 37,600 CAD a year. SSO for the scheduling app, the most used, costs 9,500 CAD plus 6,000 CAD of SCIM. With 70% fewer tickets, savings reach about 26,300 CAD a year: payback in 7 months, not counting the removal of orphaned accounts of former staff.
FAQ
SAML or OIDC, which to choose?
OIDC is easier to integrate into modern and mobile apps, while SAML is still required by some IT departments and legacy directories. Supporting both adds 1,500 to 3,000 CAD.
Is SSO enough for security?
It centralises access but must be paired with MFA and short sessions. According to Microsoft, MFA blocks more than 99% of account attacks.
Do I need Entra ID P1 for SSO?
Basic SSO works with standard Microsoft 365 licences. Conditional access requires Entra ID P1, about 8.20 CAD per user per month.
How long does migrating existing users take?
Linking accounts by email address happens automatically in minutes. Plan one week of coexistence before turning off password login.
Is SCIM essential?
Not for 20 users, but beyond 100 it prevents accounts staying active after departures, a point flagged in most security audits.
Let's scope your project. List your apps, directory and MFA requirements: we will price the SSO integration, with or without SCIM, in the 5,000 to 21,000 CAD range with a 3 to 6 week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
