The verdict in three sentences
For a mid-sized Irish company whose CISO requires Entra ID with MFA on every internal application, adding SSO to an existing business app costs EUR 3,000 to 12,000 and takes 2 to 4 weeks. The decisive choice is not OIDC versus SAML but the level of automation: roles driven by Entra groups and SCIM provisioning eliminate orphaned accounts at the source. The gain shows in security (no app passwords, leavers revoked immediately) and in time: about 15 minutes per joiner and as much per leaver.
The four integration levels and their cost
2026 order of magnitude for a custom business web app (Node.js, .NET, PHP or Python), excluding Microsoft licences.
| Level | Scope | Timeline | Budget (ex. VAT) |
|---|---|---|---|
| 1. Simple OIDC SSO | Sign-in via Entra ID, inherited MFA, sign-out | 1 to 2 weeks | EUR 3,000 to 5,000 |
| 2. SAML 2.0 SSO | Same in SAML, for apps or frameworks that require it | 2 weeks | EUR 4,000 to 6,500 |
| 3. Group-based roles | Mapping Entra groups to app roles, fine-grained rights | 2 to 3 weeks | EUR 6,000 to 9,000 |
| 4. SCIM 2.0 provisioning | Automatic account creation, update and deactivation | 3 to 4 weeks | EUR 9,000 to 12,000 |
| Conditional access option | Restriction by compliant device, country, network | +2 to 4 days | EUR 1,500 to 3,000 |
| External accounts (B2B) option | Partner and contractor guests | +3 to 5 days | EUR 2,000 to 4,000 |
Licences remain your cost: MFA and SSO are included from Entra ID Free, but conditional access requires Entra ID P1 (about EUR 6 per user per month, often already part of Microsoft 365 E3 or Business Premium).
OIDC or SAML: technical comparison
| Criterion | OpenID Connect (OIDC) | SAML 2.0 |
|---|---|---|
| Format | JSON, JWT tokens | Signed XML |
| Suited to | Modern web apps, APIs, mobile | Legacy apps, packaged software |
| Integration complexity | Low, MSAL libraries | Medium, certificate handling |
| Certificate renewal | Automatic via metadata | Manual every 1 to 3 years depending on setup |
| API protection | Native (access tokens) | Not built in, must be added |
| 2026 recommendation | Default for custom builds | If an existing constraint applies |
For an app built in-house or by a vendor, OIDC with the MSAL library is almost always the right choice. SAML remains useful for packaged software that only supports that protocol.
Security: what SSO fixes and what it does not
SSO centralises authentication, but authorisation stays inside the app. A security review should check token validation (signature, audience, issuer, expiry), app session length (8 hours maximum recommended) and sign-in logging. SCIM provisioning closes the most common gap: the app account that stays active months after an employee leaves. In mid-market audits, 5 to 15% of accounts in an app without SSO belong to people who have left.
Mini case study
Aoife, CISO of a 650-employee food manufacturer near Dublin, must connect the quality management app (220 users) to Entra ID. She picks level 4 with SCIM for EUR 10,500. The company has about 90 joiners and 85 leavers a year, seasonal staff included. At 15 minutes saved per movement for IT support, that is 44 hours a year, about EUR 2,200 at EUR 50 per loaded hour. The main gain lies elsewhere: the initial audit found 31 active accounts belonging to former staff, and the company's cyber insurer required MFA on every exposed app to keep a EUR 25,000 deductible. The project ships in 3 weeks, and app passwords disappear.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Do we need an Entra ID P1 licence for SSO?
No, SSO and basic MFA work with Entra ID Free included in Microsoft 365. P1, around EUR 6 per user per month, becomes necessary for conditional access and some advanced provisioning features.
How long does simple OIDC SSO take?
One to two weeks including testing, if the app already has a clean authentication layer. Add a week if session handling must be rebuilt.
Is SCIM essential?
It is once the app exceeds 100 users or staff turnover is frequent. Below that, documented manual deactivation may suffice, at the cost of orphaned-account risk.
Can we keep a local fallback sign-in?
Yes, keeping 1 or 2 emergency accounts protected by a FIDO2 key is recommended, to access the app if Entra ID is down. These accounts must be logged and tested every quarter.
Does SSO help with NIS2?
Yes, the NIS2 directive, transposed in Ireland, requires access control and multi-factor authentication measures from in-scope entities. Centralising authentication on Entra ID with MFA provides direct audit evidence.
Let's scope your project. Describe your app, user count and CISO requirements: we price the Entra ID integration between EUR 3,000 and 12,000 with a 2 to 4 week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
