The verdict in three sentences
Four internal applications with four different passwords generate endless resets, orphaned accounts after people leave and a real phishing risk. An Entra ID SSO integration (formerly Azure AD) costs EUR 4,000 to 12,000 per application depending on its technology, plus the Entra ID P1 licence at roughly EUR 6 per user per month if it is not already bundled in Microsoft 365. For a 1,500-employee company, the full project lands between EUR 30,000 and 60,000 and cuts support tickets by about 30%.
Map the four applications before pricing
Cost depends less on user count than on the nature of each application. A typical mid-sized company in London runs:
- an in-house HR portal (leave, expenses), often in PHP or .NET;
- a line-of-business tool built 8 years ago, with its own user table;
- a partner extranet open to external accounts;
- a reporting application already compatible with SAML or OpenID Connect.
Each one is handled differently: simple configuration for the compatible app, a rewrite of the authentication layer for the legacy tool, Entra B2B guests for the extranet.
Integration cost per application in 2026
| Application | Starting point | Work | 2026 budget (excl. VAT) |
|---|---|---|---|
| Reporting | SAML / OIDC compatible | Configuration, group mapping, tests | EUR 4,000 to 5,500 |
| HR portal | Maintained code, recent framework | Add OIDC, roles by Entra group | EUR 6,000 to 8,500 |
| Legacy business tool | Own user table, poorly documented code | Authentication rebuild, account migration | EUR 9,000 to 12,000 |
| Partner extranet | External accounts | B2B guests, conditional access, access reviews | EUR 7,000 to 10,000 |
| Shared foundation | Directory, groups, MFA, conditional access | Design, pilot, documentation | EUR 5,000 to 9,000 |
| Change management | 1,500 users | Communication, 2 weeks of extra support | EUR 2,000 to 4,000 |
Indicative total: EUR 33,000 to 49,000, with a 10 to 20% buffer for surprises in the legacy tool. Timeline: 8 to 14 weeks with a phased rollout.
Licences and recurring costs
| Item | Assumption | Estimated annual cost |
|---|---|---|
| Entra ID P1 standalone | EUR 6 x 1,500 users x 12 months | EUR 108,000 |
| Entra ID P1 included in Microsoft 365 E3 / Business Premium | Already paid | EUR 0 extra |
| Entra ID P2 (advanced identity protection) | About EUR 9 per user, 100 admins | EUR 10,800 |
| External B2B guests | First 50,000 monthly active users free | EUR 0 in most cases |
| Integration maintenance | 5 to 8 days a year | EUR 3,500 to 6,000 |
| Annual access review | Rights audit | EUR 2,000 to 3,500 |
The first question for your reseller or managed service provider: do your Microsoft 365 licences already include P1? For most mid-sized companies on E3 or E5 the answer is yes, which reduces the recurring cost to maintenance only.
Mini case study
James, CIO of a 1,500-employee electrical equipment distributor in London, handles 1,100 tickets a month, 32% of them related to passwords and access. Each ticket costs about EUR 18 in internal support time.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
After SSO, he targets 30% fewer tickets: 330 per month, or EUR 5,940 a month and EUR 71,280 a year. His staff are already on Microsoft 365 E3, so P1 is included. With a EUR 42,000 project and EUR 5,000 of annual maintenance, payback comes in about 8 months, before counting the instant access removal for the 150 annual leavers.
FAQ
Is Entra ID P1 mandatory?
Basic SSO works with the free tier, but conditional access and group-based assignment require P1. P1 costs about EUR 6 per user per month and is included in Microsoft 365 E3, E5 and Business Premium.
Can we keep passwords as a fallback?
Yes, for a 2 to 4-week transition. They must then be disabled, otherwise the application keeps an entry point not protected by MFA.
How long does the rollout take?
Allow 8 to 14 weeks for four applications, with a pilot of 50 to 100 users. The SAML-compatible app can go live as early as week three.
What about external contractors?
They become B2B guests in Entra ID. The first 50,000 external monthly active users are free, and access is revoked in one click when the engagement ends.
Does SSO help with NIS2 and Cyber Essentials?
Yes. Mandatory MFA, sign-in logging and access reviews are among the controls expected by NIS2 in the EU and by Cyber Essentials Plus in the UK.
Let's scope your project. We map your internal applications, price the Entra ID SSO integration app by app (EUR 4,000 to 12,000) and plan an 8 to 14-week rollout. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
