Single sign-on across six business apps: Keycloak vs Entra ID cost

The verdict in three sentences

A 900-employee company that makes staff juggle six different logins pays for it in helpdesk tickets, passwords on sticky notes and accounts never disabled after people leave. Entra ID P1, at roughly EUR 5.60 or GBP 4.90 per user per month, is the obvious choice if you already own Microsoft 365 licences that include it, while self-hosted Keycloak, with no licence fee but 2 to 4 days of managed support per quarter, costs four to seven times less over 3 years otherwise. Either way, a single sign-on project runs 6 to 10 weeks, with MFA mandatory for remote access from day one.

What six logins cost you today

The cost of an application estate without SSO is diffuse but measurable. In a mid-sized company in Amsterdam or London, the usual six are the ERP, HR and payroll, CRM, quality management, intranet and one custom business application.

In the Netherlands, the NIS2 transposition (the Cyberbeveiligingswet) puts identity and access management in scope for many mid-sized firms. In the UK, NCSC guidance and Cyber Essentials both push MFA on all cloud and remote access. SSO with MFA is the most visible proof that you have this under control.

Entra ID or Keycloak: the 3-year comparison

Both speak the same protocols, OpenID Connect and SAML, and both handle MFA. The difference lies in the cost model, hosting and dependence on the Microsoft ecosystem. Figures below are for Amsterdam, with EUR 750 day rates; London is similar in GBP at around GBP 650 a day.

Integration is the most variable line. A modern app that supports OIDC connects in one to two days. An older app with its own user store needs custom work or an authentication reverse proxy, 3 to 6 days. For your custom business application, adding OIDC is usually a small work package of a few days within ongoing maintenance.

The typical 6 to 10 week rollout

Step one, one to two weeks, inventories applications, source directories and roles. Step two installs the identity provider, connected to Active Directory or the HR system, with MFA by authenticator app or FIDO2 keys for administrators. Step three connects applications one by one, starting with the intranet and CRM, the lowest-risk ones. Step four migrates users in waves of 100 to 200, with extra helpdesk cover. The last step formalises leavers: disabling someone in the HR system cuts access to all six tools instantly.

On MFA, the rule is simple: mandatory for any access from outside the corporate network and for every privileged account, optional but encouraged on site. FIDO2 keys cost EUR 25 to 50 each, best reserved for the 20 to 40 administrator accounts.

Mini case study

Sanne, IT manager at a 900-employee logistics company in Amsterdam, only has Microsoft 365 Business Standard plus E3 for part of management. Her helpdesk handles 140 password tickets a month at 15 minutes each, at a loaded cost of EUR 50 an hour.

• Current password support cost: 140 × 0.25 h × EUR 50 = EUR 1,750 a month, or EUR 21,000 a year.
• With SSO and self-service reset, a 70% drop: EUR 14,700 saved a year.
• Keycloak over 3 years: EUR 34,000 of operations plus EUR 12,000 of integration, so EUR 46,000, against EUR 193,440 for standalone Entra ID P1.

Helpdesk savings alone cover most of Keycloak's annual running cost of about EUR 11,300. Login time saved, even counted at one minute per person per day, adds 3,150 hours a year on top.

FAQ

Do we have to choose between SAML and OpenID Connect?

No, Keycloak and Entra ID handle both. OIDC is simpler for modern web and mobile apps, SAML remains common on older packaged software.

Is Keycloak robust enough for 900 users?

Yes, it easily handles tens of thousands of users. You do need two nodes for high availability and an upgrade plan, with around 3 major releases a year.

What happens if the identity provider goes down?

Nobody can log in, hence the need for high availability and a local break-glass account per application. Aim for 99.9% availability, under 9 hours of downtime a year.

How long does user migration take?

Allow 2 to 3 weeks in waves of 100 to 200 people. Each wave brings a 2 to 3 day helpdesk peak, mostly for MFA enrolment.

Can identity data stay in the EU or UK?

With Keycloak, yes, on any hosting provider you choose. With Entra ID, data for European tenants is held within Microsoft's EU Data Boundary, under Microsoft's contract terms.

Let's scope your project. We inventory your applications, price the integration of each one and plan a wave-by-wave rollout over 6 to 10 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.