The verdict in three sentences
For a mid-size company that enforces Microsoft Entra ID on every internal tool, adding SSO to an existing business app costs between EUR 4,000 and 12,000 (about USD 4,400 to 13,000) in 2026, depending on the state of the code and the number of roles. Multi-factor authentication (MFA) is often handled by the identity provider, but a proper in-app MFA adds EUR 2,000 to 5,000. The real issue is not the login itself: it is mapping groups to roles and access logging, which decide whether the CISO signs off.
Authentication options and their cost
A CISO centralizing identities has three goals: one offboarding point (disable the account in Entra ID and access is gone everywhere), a consistent MFA policy, and usable logs when an incident happens. Each option covers these goals to a different degree.
| Option | 2026 integration cost (excl. tax) | Timeline | CISO coverage |
|---|---|---|---|
| Local login/password + in-app TOTP | EUR 2,000 to 5,000 | 1 to 2 weeks | Weak: accounts outside the directory |
| SSO OpenID Connect (Entra ID, Okta, Google) | EUR 4,000 to 8,000 | 2 to 4 weeks | Good: central deactivation |
| SSO SAML 2.0 (legacy apps) | EUR 5,000 to 10,000 | 3 to 5 weeks | Good, heavier setup |
| SSO + SCIM account provisioning | EUR 8,000 to 12,000 | 4 to 6 weeks | Very good: automatic create and delete |
| MFA delegated to Entra ID (conditional access) | EUR 0 to 1,500 on the app side | A few days | Very good with P1/P2 licenses |
| Hardened in-app MFA (WebAuthn, FIDO2 keys) | EUR 3,000 to 5,000 | 2 to 3 weeks | Excellent for privileged accounts |
In practice, the most common setup in a mid-size company is OpenID Connect + MFA delegated to Entra ID through conditional access, with in-app MFA only for administrator accounts. Entra ID P1 licenses run around USD 6 per user per month in 2026 (order of magnitude), a cost often already covered through Microsoft 365 E3 or E5.
What drives the quote
The range goes from one to three times because the target app is never a blank slate. Here are the items we price separately.
| Item | 2026 range (excl. tax) | Variation factor |
|---|---|---|
| Audit of the existing authentication module | EUR 800 to 2,000 | Framework, technical debt, home-made sessions |
| OIDC or SAML integration | EUR 2,500 to 6,000 | Number of environments (test, staging, production) |
| Entra ID group to app role mapping | EUR 1,000 to 3,000 | 3 roles or 25 roles, per-entity rights |
| Access logging (login, failure, privilege change) | EUR 1,000 to 2,500 | Export to a SIEM (Sentinel, Splunk) or a simple table |
| Migration of existing accounts | EUR 500 to 2,000 | Email matching, duplicates, external accounts |
| Targeted penetration test on authentication | EUR 1,500 to 4,000 | External firm or in-house |
Role mapping is the most underestimated item. An app with 3 roles (reader, contributor, administrator) plugs in within a day. An app with rights per subsidiary, per site and per document type needs a real matrix, validated with business teams, or the CISO will block the go-live.
The logging a CISO expects
A usable log contains at least: Entra ID identifier (oid), UTC timestamp, IP address, result (success or failure), MFA method used and role changes. Recommended retention: 12 months online. Sending logs to Microsoft Sentinel through a connector adds about EUR 1,000 to the project.
Mini case study
Claire, CISO of a 1,200-employee manufacturing company in Toronto, enforces Entra ID on 14 internal tools. The non-conformity management tool, custom-built in 2021, still uses local accounts: 340 users, 6 roles, and 3 accounts of former employees still active, found during the last audit.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Agreed budget: audit EUR 1,200, OIDC integration EUR 4,500, mapping of 6 roles EUR 1,800, logging to Sentinel EUR 1,500, FIDO2 MFA for 8 administrators EUR 3,000. Total: EUR 12,000 (about USD 13,000), delivered in 5 weeks.
On the gains side, IT support handled about 25 password resets per month at 15 minutes each, or 75 hours a year. At EUR 45 per loaded hour, that is EUR 3,375 a year, plus the removal of orphan-account risk, which the company's cyber insurer factored into its pricing. Estimated payback: under 3 years on support alone, immediate on compliance.
FAQ
Is SSO enough without MFA?
No, SSO centralizes access but does not strengthen it. If Entra ID already applies conditional access with MFA, the app benefits at no extra cost; otherwise, budget EUR 2,000 to 5,000 for in-app MFA.
OpenID Connect or SAML: which one?
For a modern web app, OpenID Connect is simpler and 20 to 30% cheaper to integrate. SAML remains relevant for legacy apps or enterprise customers who require it by contract.
How long is the app unavailable during the switch?
With a prepared cutover, downtime is under one hour. We often keep a local fallback login for 2 administrator accounts for 30 days.
Do we also need to handle external users (suppliers, customers)?
Yes if the app is open to them: Entra ID B2B or External ID handles them, with an extra integration cost of EUR 1,500 to 3,000 depending on the invitation flow.
What happens if Entra ID goes down?
Microsoft states 99.99% availability for Entra ID. A local break-glass account, protected by a FIDO2 key and monitored in the logs, covers extreme cases.
Let's scope your project. Send us the app, your identity provider and the number of roles: we price SSO, MFA and logging within a EUR 4,000 to 17,000 range, delivered in 3 to 6 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
