Self-Hosted Keycloak SSO for Custom Business Apps in Berlin 2026: Cost and Trade-offs

The verdict in three sentences

For a 900-employee mid-sized company juggling 7 internal applications, SSO (single sign-on) removes multiple passwords and above all the accounts of departed staff that were never disabled, the top intrusion vector found in NIS2 audits. Microsoft Entra ID P1 costs about EUR 6 per user per month and is the default if you already run Microsoft 365, while self-hosted Keycloak is free to license but needs EUR 3,000 to 8,000 of setup and serious operations. Either way, budget EUR 1,500 to 4,000 per business application connected over OIDC, and expect roughly 70% fewer password reset tickets.

Entra ID or Keycloak: the real 2026 comparison

The choice depends less on technology than on your existing ecosystem and your sensitivity to data sovereignty, a frequent concern for German companies under strict works council and data protection scrutiny. Entra ID is a managed service, integrated with Microsoft 365, with native conditional access and MFA. Keycloak is open source software (a CNCF project) that you host wherever you want, including in a German or EU sovereign cloud, and administer yourself.

The real 3-year cost for 900 users

The licence is rarely the main item. What weighs is integrating each business application: an off-the-shelf ERP often supports SAML or OIDC out of the box, while a custom app built 8 years ago needs its authentication layer rewritten.

The reading is simple: if your staff already hold a Microsoft 365 licence that includes Entra ID P1, Entra ID is almost always cheaper. If your users do not have M365 (shop floor, warehouses, subcontractors) or your applications must stay outside extraterritorial law, Keycloak becomes clearly more cost-effective. A hybrid model is common: Entra ID for office staff, federated Keycloak for sensitive applications and external accounts.

Steps for an SSO project without breakage

A typical project runs in four stages. First the inventory: list of applications, supported protocol (OIDC, SAML or none), user count, business owner. Then the foundation: identity provider, MFA, account creation and deletion rules tied to the HR system. Then integration, starting with the most-used application for a visible win. Finally the cutover: local passwords disabled and a tested leaver process that must cut all access within one hour.

Mini case study

Thomas, IT director of a 900-employee industrial company headquartered in Strasbourg with a subsidiary in Berlin, handles about 260 password reset tickets per month at 15 minutes each, i.e. 65 hours per month. Only 400 office employees hold an M365 E3 licence. He chooses a hybrid model: Entra ID for those 400 (already included), Keycloak hosted in the EU for the 500 operators and the sensitive quality application. Budget: EUR 6,000 setup, EUR 17,500 integration, EUR 600 per month operations. Tickets drop by 70%, freeing 45 hours a month (about EUR 2,000 of support time at EUR 45 an hour). Over 3 years, time savings alone cover more than 80% of the project, before counting the avoided risk of orphaned accounts.

FAQ

Is Keycloak reliable enough for a mid-sized company?

Yes, it is used by banks and public administrations, provided it is deployed in high availability (at least 2 nodes) and updated every 2 to 3 months. Budget EUR 300 to 900 per month for managed operations.

How much does integrating a custom application cost?

From EUR 1,500 if the framework supports OIDC natively to EUR 4,000 if the authentication layer must be rewritten. A very old application may need an authentication proxy, around EUR 2,000.

Is MFA mandatory?

The law does not impose it in every case, but NIS2 and cyber insurers increasingly require it. With SSO, you enable it once for all applications, avoiding 7 separate configurations.

How long does a full project take?

Budget 2 to 4 weeks for the Entra ID foundation, 4 to 8 weeks for Keycloak, then 1 to 2 weeks per application. A portfolio of 7 apps is usually migrated in 3 to 4 months.

Can we switch identity provider later?

Yes, if the applications speak standard OIDC: switching means reconfiguring each client, about 1 day per application. That is a reason to demand OIDC rather than a proprietary integration.

Let's scope your project. We inventory your applications, cost the Entra ID, Keycloak or hybrid scenario and integrate SSO over OIDC app by app, EUR 1,500 to 4,000 each, within 3 to 4 months for a portfolio of 7 tools. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.