The verdict in three sentences
For a business application rolled out to 1,200 employees, SSO integration with Microsoft Entra ID costs EUR 4,000 to 9,000 excl. VAT with OIDC or SAML, and SCIM provisioning adds EUR 3,000 to 6,000. The real gain is security (conditional MFA, leavers revoked in minutes) and support, with about 20% fewer tickets. If the company does not have Entra ID P1 yet, budget EUR 6 per user per month, often already included in Microsoft 365 E3 or Business Premium.
Why IT directors require SSO before any rollout
In a mid-sized London company, an internal application without SSO creates three immediate problems: one more password per employee, accounts that stay active after someone leaves, and no way to enforce group security policy (MFA, managed devices only, blocking sign-ins from outside approved countries). ISO 27001 auditors, Cyber Essentials Plus assessors and client security questionnaires now expect centralised identity management.
SSO via Entra ID solves this: users sign in with their usual Microsoft account, IT manages access from a single console, and the application automatically inherits conditional access rules.
| Component | What it brings | Indicative 2026 cost (excl. VAT) |
|---|---|---|
| OIDC SSO (OpenID Connect) | Modern sign-in, suited to web and mobile apps | EUR 4,000 to 7,000 |
| SAML 2.0 SSO | Compatibility with legacy policies and some third-party IdPs | EUR 5,000 to 9,000 |
| Group-to-role mapping | App permissions driven from Entra ID | EUR 1,500 to 3,000 |
| SCIM 2.0 provisioning | Automatic account creation, update and deactivation | EUR 3,000 to 6,000 |
| Logging and audit | Sign-in traceability, export to SIEM | EUR 1,500 to 3,500 |
| Security testing | OWASP review, token flow testing | EUR 2,000 to 4,000 |
A typical project (OIDC + roles + SCIM + logging) falls between EUR 10,000 and 19,500 excl. VAT, delivered in 3 to 6 weeks.
OIDC, SAML, SCIM: what to choose
OIDC is the default for a modern application: simpler to implement, it handles access tokens for APIs and mobile apps well. SAML remains useful if the group mandates it or if the app must also accept another identity provider, for example at a client or subsidiary. SCIM becomes essential beyond a few hundred users: without it, an employee who leaves keeps an account in the app until someone remembers to delete it.
| Criterion | No SSO | SSO only | SSO + SCIM |
|---|---|---|---|
| Revocation delay after leaving | Days to weeks | Immediate at sign-in, local account kept | Under 40 minutes, account disabled |
| Password tickets (1,200 users) | About 90 per month | About 70 per month | About 70 per month |
| Conditional MFA | Must be built | Inherited from Entra ID | Inherited from Entra ID |
| Account creation | Manual | Just-in-time at first sign-in | Automatic from HR |
| ISO 27001 compliance | Frequent gaps | Partial | Good |
| Integration cost | EUR 0 | EUR 4,000 to 9,000 | EUR 7,000 to 15,000 |
Licence costs and security settings
Conditional access requires Entra ID P1, priced at EUR 6 per user per month in 2026, i.e. EUR 86,400 a year for 1,200 employees if nothing is already covered. In practice, most mid-sized companies already have P1 through Microsoft 365 E3, E5 or Business Premium, so the extra cost is zero. On configuration, plan an MFA rule for everyone, blocking sign-ins from unapproved countries, a compliant-device requirement for admin roles, and an 8 to 12-hour session lifetime. These settings take IT one to two days.
Mini case study
Emma, IT director of a 1,200-employee services company in London, rolls out a field intervention management app. She chooses OIDC + SCIM + logging for EUR 14,000 excl. VAT. P1 licences are already included in Microsoft 365 E3.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Calculation: the service desk handled about 90 password tickets a month on internal apps. A 20% drop removes 18 tickets a month, 216 a year, at EUR 25 per ticket: EUR 5,400 saved. Add 2 days a month of manual account management removed by SCIM, 24 days a year at EUR 450: EUR 10,800. Annual gain: EUR 16,200. The integration pays back in just over 10 months, not counting the avoided risk of an orphan account being exploited after a departure.
FAQ
How much does Entra ID SSO integration for a business app cost?
Expect EUR 4,000 to 9,000 excl. VAT for SSO alone with OIDC or SAML. With SCIM, roles and logging, the budget ranges from EUR 10,000 to 19,500.
Is an Entra ID P1 licence mandatory?
Basic SSO works with the free tier of Entra ID. Conditional access and conditional MFA require P1, at EUR 6 per user per month, often already included in Microsoft 365 E3.
How long does the project take?
OIDC SSO is live within 1 to 2 weeks. With SCIM and security testing, plan 3 to 6 weeks in total.
Does SSO replace permission management in the app?
No, it handles authentication. Fine-grained permissions are mapped from Entra ID groups, which costs an extra EUR 1,500 to 3,000.
Can we also accept a client's Google Workspace accounts?
Yes, a multi-provider OIDC architecture allows it. Add about EUR 2,000 to 4,000 per additional identity provider.
Let's scope your project. Tell us your user count, the protocol your group mandates and whether you need SCIM: we will price the integration between EUR 4,000 and 19,500 excl. VAT, delivered in 3 to 6 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
