The verdict in three sentences
Integrating Microsoft 365 single sign-on (Entra ID) into a business application costs 6,000 to 20,000 GBP in London and 4,000 to 15,000 EUR excl. VAT in Grenoble, and takes 2 to 5 weeks, depending on whether you stop at OIDC login or add SCIM provisioning and conditional MFA. For a company where every employee manages 9 passwords, the measured gain is -70% password tickets and accounts disabled the moment someone leaves. Licensing is the deciding question: basic SSO is included in Microsoft 365, but conditional access requires Entra ID P1, about 6 EUR (around 5 GBP) per user per month, already bundled in Microsoft 365 Business Premium.
Three integration levels, three budgets
| Level | Scope | 2026 cost (EUR excl. VAT) | Timeline |
|---|---|---|---|
| 1. Basic SSO | OIDC or SAML login via Entra ID, role mapping by group | 4,000 to 6,500 | 2 weeks |
| 2. SSO + provisioning | level 1 + SCIM (automatic create, update, disable) | 7,000 to 11,000 | 3 to 4 weeks |
| 3. SSO + SCIM + advanced security | level 2 + conditional MFA, logging, B2B guest accounts, targeted pen tests | 11,000 to 15,000 | 4 to 5 weeks |
| Option: several applications | each extra app reuses the foundation | 2,000 to 4,000 per app | 1 week |
| Option: legacy app without OIDC | authentication proxy or Entra Application Proxy | 3,000 to 7,000 | 2 weeks |
Level 2 is what we recommend to most SMEs: SCIM removes the most expensive risk, a former employee keeping access to the business app for weeks after leaving.
Entra ID licences: what do you really need?
| Feature | Entra ID Free (included in M365) | Entra ID P1 (about 6 EUR/user/month) | Entra ID P2 (about 9 EUR/user/month) |
|---|---|---|---|
| OIDC or SAML SSO to a business app | yes | yes | yes |
| MFA through security defaults | yes | yes | yes |
| Conditional access (country, compliant device, risk) | no | yes | yes |
| SCIM provisioning to the app | partial, case by case | yes | yes |
| Group-based access assignment | limited | yes | yes |
| Risky sign-in detection | no | no | yes |
If you already run Microsoft 365 Business Premium (about 20.60 EUR or 18 GBP per user per month), P1 is included: no extra licence. On Business Standard, moving 80 users to P1 costs about 5,760 EUR (around 4,800 GBP) per year, to weigh against the cost of a security incident or a failed client audit.
Measured gains
| Indicator | Before SSO | After SSO + SCIM |
|---|---|---|
| Passwords per employee | 9 | 2 to 3 |
| "Forgot password" tickets per month (80 staff) | 45 | 13 (-70%) |
| Average time per ticket | 15 minutes | 15 minutes |
| Time to disable an account after departure | 3 to 20 days | immediate |
| Account setup for a new starter | 30 to 45 minutes across 5 tools | automatic |
| Client security questionnaires (ISO 27001, NIS 2, Cyber Essentials) | partial answers | provable MFA and audit trail |
Grenoble and London compared
| Criterion | SME in Grenoble | Company in London |
|---|---|---|
| SSO + SCIM integration | 4,000 to 15,000 EUR excl. VAT | 6,000 to 20,000 GBP |
| Senior developer day rate | 550 to 750 EUR | 650 to 950 GBP |
| Entra ID P1 licence | about 6 EUR per user per month | about 5 GBP per user per month |
| Compliance framework | GDPR, NIS 2 | UK GDPR, Cyber Essentials |
| Timeline | 2 to 5 weeks | 2 to 6 weeks |
Mini case study
Julien, IT director of an 80-person manufacturing SME in Grenoble, runs a production tracking app, a client extranet and a quality tool, each with its own accounts. He picks level 2 at 9,500 EUR excl. VAT, plus 2 extra apps at 3,000 EUR each, i.e. 15,500 EUR. The company is already on Business Premium.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Password tickets: 32 tickets avoided per month x 15 minutes x 12 months = 96 h, i.e. 5,760 EUR per year at 60 EUR/h.
- Joiners and leavers: 20 moves per year x 3 h saved = 60 h, i.e. 3,600 EUR per year.
- User productivity: 5 minutes per day per employee no longer lost on logins, i.e. 1,500 h per year. Under a cautious 20 EUR/h valuation, 30,000 EUR.
With over 39,000 EUR of annual gains, the project pays back in under 5 months. A London firm of the same size at 13,000 GBP sees a comparable curve, and finally answers its clients' security questionnaires with confidence.
FAQ
OIDC or SAML: which one?
OIDC for a modern web or mobile app, as it is simpler and better tooled. SAML remains useful for older apps or vendors that only support it. The cost gap is small, 500 to 1,500 EUR.
What if Microsoft 365 goes down?
Keep one or two break-glass admin accounts with strong local authentication. Global Entra ID outages are rare, a few hours per year at most.
Do we need to change our business app's code?
Yes if it manages its own accounts, typically 3 to 8 days of development. If a vendor hosts the app, check that it supports OIDC or SAML, sometimes only in its premium tier.
Does SSO really improve security?
Yes, it centralises MFA and access revocation. Over 80% of security breaches involve compromised credentials, and SSO shrinks the attack surface to a single, strongly protected point.
Can external partners get access?
Yes, through Entra B2B guest accounts, without a full Microsoft 365 licence for them. The first 50,000 monthly active external users are free.
Let's scope your project. Tell us your applications, Microsoft 365 licence and headcount: we will scope an SSO integration between 4,000 and 15,000 EUR (6,000 to 20,000 GBP in London), delivered in 2 to 5 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
