The verdict in three sentences
For a mid-sized company in Berlin, integrating Microsoft Entra ID SSO into a business application costs EUR 3,000 to 9,000 excl. VAT depending on the protocol and the quality of the existing code. Syncing roles from the directory adds EUR 2,000 to 5,000 and is what actually removes orphan accounts. The project takes 2 to 5 weeks and gives the CISO access logs that can be used directly for NIS2 compliance.
What you are actually buying: the building blocks of an Entra ID integration
A serious integration is more than a "Sign in with Microsoft" button. It covers registering the application in the tenant, choosing the protocol, retrieving groups, enforcing conditional access (MFA, compliant devices, geolocation) and logging. On a business application built five years ago with local authentication, most of the work is often replacing the user table with a federated identity without breaking data history.
| Component | 2026 range (EUR excl. VAT) | Indicative timeline | Comment |
|---|---|---|---|
| OIDC SSO on a modern app (Node, .NET, Python) | 3,000 - 5,000 | 1 to 2 weeks | Mature MSAL libraries, simplest case |
| SAML 2.0 SSO on a legacy app | 5,000 - 9,000 | 2 to 3 weeks | Metadata, certificates, longer testing |
| Mapping Entra groups to application roles | 2,000 - 5,000 | 1 to 2 weeks | Ends manual rights management |
| SCIM provisioning (auto create and disable) | 3,000 - 6,000 | 1 to 2 weeks | Employee leaves = access cut in under 40 min |
| Access logging and SIEM export | 1,500 - 4,000 | 1 week | Audit evidence, 12-month retention advised |
| Migration of existing local accounts | 1,000 - 3,500 | 3 to 5 days | Matching by email, duplicate cleanup |
| Targeted security testing (tokens, redirects) | 1,500 - 3,000 | 3 to 5 days | Recommended before go-live |
A typical scope for a mid-sized company (OIDC, roles, logging) therefore lands around EUR 7,000 to 14,000 excl. VAT. SCIM is optional but pays off once the application has more than 150 users with regular turnover.
OIDC or SAML, MFA and NIS2: how to decide
The protocol choice depends first on the tech stack. OIDC is the current standard, lighter and better tooled. SAML remains relevant for older Java or PHP applications, or if your security policy requires it. In both cases, multi-factor authentication is not coded into the application: it is enforced by Entra ID conditional access policies, which avoids maintaining a second MFA system.
| Criterion | OIDC | SAML 2.0 | Current local authentication |
|---|---|---|---|
| 2026 integration cost | EUR 3,000 - 5,000 | EUR 5,000 - 9,000 | EUR 0 (but security debt) |
| MFA and conditional access support | Native via Entra | Native via Entra | To be built, EUR 4,000 and up |
| Access revocation when an employee leaves | Immediate with SCIM | Immediate with SCIM | Manual, often forgotten |
| Suited to APIs and mobile apps | Yes | Poorly suited | Varies |
| Annual maintenance load | EUR 500 - 1,200 | EUR 800 - 1,800 | Password resets to handle |
| Contribution to NIS2 evidence | Strong | Strong | Weak |
Under NIS2, as transposed in Germany and across the EU, essential and important entities must implement access management and strong authentication. An Entra ID-backed SSO with centralized logs covers a significant share of the expected access control measures. It does not replace risk analysis or a continuity plan, but it greatly simplifies the demonstration during an inspection.
The mistakes that blow the budget
Three mistakes keep appearing in our audits. First: forgetting service accounts and technical access, which bypass SSO and remain backdoors. Second: pushing every Entra group into the token, which exceeds the 200-group limit and triggers hard-to-diagnose login errors. Third: not planning a break-glass account in case the tenant becomes unavailable. Each of these mistakes costs on average 1 to 3 days to fix, or EUR 700 to 2,100 excl. VAT.
Mini case study
Nathalie, CISO of a 420-employee industrial company in Berlin, manages a production tracking application with 260 local accounts. An internal audit reveals 38 accounts of former employees still active. The chosen project: OIDC SSO (EUR 4,200), role mapping (EUR 3,100), SCIM (EUR 3,800) and logging (EUR 2,200), i.e. EUR 13,300 excl. VAT over 4 weeks.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
On the benefit side, IT support handled about 45 password resets per month at 15 minutes each, or 11 hours monthly. At EUR 55 per loaded hour, that is EUR 7,260 per year saved, not counting the removal of the risk tied to the 38 orphan accounts. Direct payback comes in under two years, and the NIS2 argument was enough to get the budget approved by management.
FAQ
Do I need an Entra ID P1 or P2 license for SSO?
Basic SSO works with the version included in Microsoft 365. Conditional access requires Entra ID P1, about EUR 5.60 per user per month in 2026, often already included in Microsoft 365 Business Premium or E3.
How long is the application unavailable during the switchover?
With a prepared migration, downtime is limited to a 30-minute to 2-hour window scheduled outside production. Both login modes can coexist for 1 to 2 weeks to secure the transition.
Can external users (subcontractors, customers) be included?
Yes, via Entra External ID or B2B guests. Budget an extra EUR 1,500 to 3,000 to handle separate journeys and roles for these groups.
Is SSO enough to be NIS2 compliant?
No, it mainly covers access control and authentication. It must be complemented by vulnerability management, a backup policy and an incident notification procedure within 24 hours.
What happens if Microsoft changes its APIs?
MSAL libraries are maintained and changes are announced 12 to 24 months ahead. A maintenance contract of EUR 500 to 1,200 per year absorbs these updates.
Let's scope your project. Send us your application's tech stack and user count: we will price SSO, roles and logging, with an indicative budget of EUR 7,000 to 14,000 excl. VAT and a 2 to 5 week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
