The verdict in three sentences
When 80 franchisees juggle 6 tools and 6 passwords, an account compromise is not an accident but a probability. A single sign-on (SSO) integration in OIDC or SAML, with multi-factor authentication, costs 5,000 to 14,000 EUR excl. tax (about 5,400 to 15,000 USD), plus 3,000 to 8,000 EUR for per-store role management. The identity provider adds 3 to 6 EUR per user per month, and the project ships in 4 to 8 weeks.
The hidden cost of 6 passwords
In a franchise network, every location uses the franchisor's extranet, the POS, the supplier ordering tool, the training platform, reporting and email. Teams rotate, seasonal staff come and go, and credentials travel on sticky notes or in WhatsApp groups. The day an account is compromised, nobody knows who had access to what.
| Symptom | Frequency observed in an 80-store network | Consequence |
|---|---|---|
| Password reset requests | 60 to 120 a month | 10 to 20 hours of support a month |
| Former employees' accounts still active | 15 to 30% of accounts | Uncontrolled access to prices and margins |
| Passwords shared between colleagues | The majority in stores | No traceability of actions |
| Successful phishing | 1 to 3 incidents a year | Fraudulent orders, customer data leak |
| Opening a new store | 6 accounts created by hand | 1 to 2 days before access |
| A franchisee leaves | Tool-by-tool revocation | Risk of oversight, privacy exposure |
The building blocks of SSO for a franchise network
SSO relies on a central identity provider that authenticates the user once, then opens connected apps through the OIDC (OpenID Connect) or SAML protocols. Multi-factor authentication through a mobile app or a security key blocks most phishing attacks. The real difficulty in a franchise is the role model: a store manager sees their location's figures, a field manager sees their region, headquarters sees everything.
| Work package | Scope | Budget EUR excl. tax (order of magnitude 2026) | Duration |
|---|---|---|---|
| Scoping and app inventory | List of the 6 tools, supported protocols, profile mapping | 1,000 to 2,500 | 1 week |
| Identity provider setup | Directory, password policy, multi-factor authentication | 1,500 to 3,500 | 1 to 2 weeks |
| Connecting OIDC or SAML compatible apps | 4 to 5 standard tools | 2,000 to 5,000 | 1 to 2 weeks |
| Adapting the in-house extranet | Replacing local login, tokens, global logout | 1,500 to 3,000 | 1 to 2 weeks |
| Per-store and per-region roles | Groups, rights per location, delegation to the store manager | 3,000 to 8,000 | 2 to 3 weeks |
| Automated provisioning | Account creation and removal from HR system or a master file | 1,500 to 4,000 | 1 week |
The pure SSO integration sits between 5,000 and 14,000 EUR excl. tax. With roles and provisioning, a complete project reaches 10,000 to 26,000 EUR excl. tax.
Choosing the identity provider
| Option | Cost per user per month | Strengths | Limits |
|---|---|---|---|
| Microsoft Entra ID | 5 to 6 EUR depending on plan | Ideal if the network already runs Microsoft 365 | Per-user license, seasonal staff included |
| Okta Workforce Identity | 3 to 6 EUR depending on modules | Very broad integration catalog | Cost climbs with add-ons |
| Google Workspace (built-in SSO) | Included in Workspace licenses | Simple for networks already on Google | Fine-grained roles more limited |
| Self-hosted Keycloak | 0 EUR license, 150 to 400 EUR a month for hosting and operations | Data sovereignty, local hosting | Needs in-house skills or a vendor |
| Auth0 and similar | Varies with volume | Suited to extranets open to partners | Watch per-active-user pricing |
Mini case study
Megan, IT manager of an 80-location franchisor in Toronto, has 480 users, or 6 per store. She picks a 9,000 EUR SSO integration, 5,500 EUR for per-store roles and 2,500 EUR for provisioning, 17,000 EUR excl. tax in total. The identity provider costs 4 EUR per user per month, or 23,040 EUR a year. On the other side, support spent 15 hours a month on passwords, 180 hours a year at 45 EUR, or 8,100 EUR. And the last account compromise had cost 22,000 EUR in fraudulent orders and investigation time. Avoiding a single incident a year covers most of the recurring cost.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
OIDC or SAML, which one?
OIDC is simpler for modern and mobile apps, SAML remains the norm for many older business tools. In a franchise network the two are often combined, which adds only 1 to 2 days of work.
Will multi-factor authentication slow store teams down?
With an 8 to 12 hour session and push approval on mobile, users authenticate once a day. For shared terminals, a security key at 25 to 50 EUR per store avoids using personal phones.
What happens when a franchisee leaves the network?
With provisioning, deactivating the store cuts all its access in one action, within minutes. Without SSO, tool-by-tool revocation often takes 1 to 3 days and leaves forgotten accounts.
Is SSO compatible with privacy regulations?
Yes, and it improves compliance: login traceability, fast account removal, least-privilege access. Choose a provider that hosts data in your jurisdiction and sign a data processing agreement.
How long to roll out across 80 stores?
Plan 4 to 8 weeks of project work, then a phased rollout in waves of 10 to 20 stores, with a short 3-minute video for the teams.
Let's scope your project. List your tools, user count and store profiles: we price the SSO integration, roles and provisioning, with an indicative budget and rollout timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
