SCIM user provisioning and offboarding for business apps: cost (2026)

The verdict in three sentences

Orphaned accounts of former employees are one of the most common security gaps and one of the cheapest to fix: SSO plus SCIM provisioning costs €3,000 to €10,000 excl. VAT per business application. Once connected to Entra ID or Okta, an employee's departure disables all of their access in under an hour, with no ticket and nothing forgotten. For a mid-sized company in scope of NIS2, it is also the simplest proof of controlled access management.

The hidden cost of orphaned accounts

The CISO of a 600-employee company runs an access review and finds 140 active accounts belonging to people who left months ago. They are spread across the in-house ERP, the HR intranet, the quoting app and two custom business tools, none of which is connected to the directory.

Beyond the leak risk, these accounts carry direct costs: per-user licences on some third-party tools, IT time (25 to 40 minutes per departure across 5 applications on average) and non-compliance during customer or cyber insurance audits.

SSO, SCIM and group-based roles: what needs to be built

SSO (OpenID Connect or SAML) handles authentication: users sign in with their company account. SCIM 2.0 handles the lifecycle: the directory automatically creates, updates and deactivates accounts in the application. Both are needed, because SSO alone leaves local accounts and API tokens active.

The low end applies to a recent application (Node.js, Laravel, Django) with clean user management. The high end applies to older applications where roles are hard-coded and must be redesigned.

On the licensing side, SCIM provisioning to custom applications generally requires Entra ID P1 (about €6 per user per month) or an Okta Lifecycle Management plan (€4 to €8 per user per month depending on volume).

NIS2 and cyber insurance: what access management must prove

The NIS2 directive, now transposed across the EU, requires essential and important entities to implement access control and identity management measures. Cyber insurers ask the same questions in their underwriting questionnaires.

For a mid-sized company, NIS2 fines can reach €7 million or 1.4% of global turnover for an important entity. The SCIM budget is negligible compared with that exposure.

Mini case study

Sophie, CISO of a 600-employee industrial company near Lyon, must connect 5 internal applications to Entra ID. Three are recent (€4,000 excl. VAT each), two are legacy (€9,000 excl. VAT each): a total of €30,000 excl. VAT over 10 weeks. The company handles 90 departures and 110 arrivals a year; IT time drops from 35 to 4 minutes per movement, about 100 hours saved a year, close to €5,500 at a €55 loaded hourly cost. More importantly, the cyber insurer agrees to remove an €8,000 annual surcharge tied to the lack of automated revocation. Payback lands around 2 years and 3 months, with documented NIS2 compliance from the first quarter.

FAQ

Isn't SSO alone enough?

No. SSO blocks sign-in through the directory, but local accounts, API tokens and open sessions stay active. SCIM disables the account itself within minutes, for an extra €1,500 to €4,000 excl. VAT.

Entra ID or Okta: which one?

If the company already uses Microsoft 365, Entra ID P1 at about €6 per user per month is the natural choice. Okta makes sense in multi-cloud or highly heterogeneous environments.

How long does it take to connect one application?

Allow 3 to 6 weeks per application, including one week of testing on a pilot group of 10 to 20 users before the general switch-over.

What about the 140 existing orphaned accounts?

An initial clean-up is required before SCIM goes live: reconciliation with the HR export, deactivation, then data archiving according to the retention policy. Allow 2 to 4 days of work for 5 applications.

Does SCIM work for external contractors?

Yes, provided they are created in the directory as guests or external accounts with an expiry date. Their access is then cut automatically when the assignment ends.

Let's scope your project. Send us the list of your internal applications and your directory (Entra ID, Okta, Google): we will price SSO and SCIM provisioning at €3,000 to €10,000 excl. VAT per application, with a 3 to 6 week plan for each. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.