Adding Microsoft Entra ID single sign-on to a custom business app in London (2026)

The verdict in three sentences

Connecting Microsoft Entra ID over OIDC to your business apps removes local passwords, enforces MFA and applies your Conditional Access rules everywhere, for £8,000 to £20,000 per app as a 2026 order of magnitude in London. The real payoff is SCIM provisioning: a leaver disabled in Entra ID loses access to all 4 apps within minutes, which closes the most common audit finding. Plan 4 to 6 weeks for a batch of 4 apps, provided your roles are already modelled as groups.

Why the audit flags your local accounts

In a 1,100-person firm, apps built in-house or by an agency (procurement, field scheduling, quality tracking, HR portal) often manage their own credentials. Typical audit result: reused passwords, leavers' accounts still active months after they left, no MFA, and logs scattered across 4 databases. Cyber insurers, Cyber Essentials Plus assessors and large clients in financial services now expect centralised strong authentication, in line with NCSC guidance.

SSO through Entra ID fixes this with one pattern: the app delegates sign-in to Microsoft (OpenID Connect, or SAML for older tools), receives a signed token with the user's identity and groups, then applies its own permissions. MFA, risky sign-in detection and country blocking become Entra ID policies instead of application code.

What the integration costs in 2026

Cost depends mostly on each app's condition: a modern framework with a ready OIDC library, or legacy code where authentication is tangled with business logic. SCIM provisioning requires the app to expose a compliant API, which most in-house tools lack. London day rates for senior developers run around £600 to £900, which explains the higher range.

Check licences before budgeting. If staff already hold Microsoft 365 E3, Conditional Access is included and the licence line drops to zero. Otherwise standalone Entra ID P1 comes to roughly £66,000 a year for 1,100 users, worth comparing with bundled plans.

Cutting over without stopping operations

A clean cutover follows four steps. First the inventory: each app's real roles, service accounts, contractor access. Then create Entra ID groups and register each app with its redirect URLs. Next, run 1 to 2 weeks of dual sign-in, where SSO is offered and local accounts stay active for a pilot group. Finally close local accounts, keeping one break-glass account stored offline and protected by a hardware key.

Shared floor or warehouse terminals used by several operators need a specific answer: badge, Windows Hello PIN or short sessions. That case often represents 20% of the effort in an operational business, so scope it early. To validate the result, a focused penetration test on authentication flows is worthwhile, as covered in our article on pentesting before launch.

Mini case study

Priya, CIO of a 1,100-staff engineering consultancy in London, must fix 4 internal apps before the next client security review.

• Integration: 2 modern apps at £9,500 and 2 legacy apps at £16,000, total £51,000.
• SCIM: £3,500 on the HR app, which feeds the others through groups.
• Licences: already covered by Microsoft 365 E3, £0 extra.
• Total project: £54,500, delivered in 5 weeks.

Measured gains: the helpdesk handled 320 password resets a month at 15 minutes each, 80 hours at a £45 loaded rate, £3,600 a month or £43,200 a year. Those tickets fall by 75% after cutover, saving about £32,400 a year. Payback lands in roughly 20 months on that line alone, before counting the closed audit finding on orphan accounts that a key client contract depended on.

FAQ

Do we need Entra ID P1 licences?

Basic SSO works with the free tier included in Microsoft 365. Conditional Access and some provisioning features require P1, about £5 per user per month, often already in E3 or Business Premium.

OIDC or SAML for an in-house app?

OIDC is the right choice for a modern web or mobile app: simpler, JSON tokens, mature libraries. SAML still makes sense for 1 or 2 older tools that already support it, with no rework.

What about contractor access?

Contractors are invited as B2B guest accounts with MFA and an expiry date. A firm this size typically has 50 to 150 external accounts, to be reviewed every 90 days.

How disruptive is the cutover for users?

With a 1 to 2 week pilot, perceived downtime is zero. On the day local accounts close, plan half a day of extra helpdesk cover for 1,100 staff.

Is SSO enough to pass a security audit?

It fixes authentication and leaver handling, often 30 to 40% of findings. Internal permissions, encryption and application logs still need attention in each app.

Let's scope your project. We inventory your apps, roles and licences, then plan the SSO and SCIM cutover over 4 to 6 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.