Adding SSO and MFA to an In-House Business App: London 2026

The verdict in three sentences

Connecting an existing business application to Microsoft Entra ID for SSO with multi-factor authentication usually takes 8 to 20 development days, depending on the state of the code and the number of roles to map. Licences are often already paid for: Entra ID P1 (around 4.90 GBP per user a month) is included in Microsoft 365 E3, E5 and Business Premium, which most mid-size companies already hold. The real stakes are access logging and instant account removal when staff leave, the two points Cyber Essentials Plus assessors and insurers check first.

Why audits almost always flag authentication

An internal application built five or ten years ago often manages its own accounts: username, password stored in the database, no MFA. Three risks follow. Passwords are reused across services, leavers' accounts stay active because nothing links them to the directory, and no usable trail exists to reconstruct a suspicious login. Since the 2025 Cyber Essentials requirements, MFA must be enabled wherever a cloud service or web application supports it, and the UK Cyber Security and Resilience Bill is extending obligations for managed service providers and critical suppliers.

Steps and effort

The move to SSO relies on a standard protocol, OpenID Connect ideally, or SAML 2.0 for older applications. Effort depends on code quality.

In London, at 550 to 800 GBP a day for a contractor or consultancy, integration costs 4,400 to 16,000 GBP. MFA itself is configured in Entra ID through Conditional Access policies, with no extra application code.

Comparing identity providers

If the company does not run Microsoft 365, several options exist. The table compares recurring costs for 400 application users.

What Cyber Essentials Plus and the NCSC expect

Assessors care less about the protocol than the evidence. They ask for the list of active accounts, last sign-in dates, permissions per role, leaver deactivation time and log retention. NCSC logging guidance suggests keeping authentication logs for at least 6 months, and many cyber insurers now ask for 12, stored separately from the application. SSO fixes deactivation in one step: an account disabled in Entra ID loses application access as soon as its token expires, usually within an hour.

The Kolonell benchmark

Kolonell builds SSO into the business applications it develops or takes over. Securing an existing application is quoted after a code audit; a new application falls within the custom grid: simple 2,500,000 to 4,000,000 FCFA (3,810 to 6,100 EUR), medium 4,000,000 to 7,000,000 FCFA (6,100 to 10,670 EUR), complex 7,000,000 to 15,000,000+ FCFA (10,670 to 22,870+ EUR). Maintenance comes in three plans: 35,000, 75,000 or 120,000 FCFA a month (53, 114 or 183 EUR).

Mini case study

James, CISO of a 1,300-employee logistics company in London, must fix the finding raised on the warehouse management app used by 400 staff. The company already holds Microsoft 365 E3, and therefore Entra ID P1.

• Integration: 14 days x 650 GBP = 9,100 GBP.
• Additional licences: 0 GBP.
• Log forwarding to the existing SIEM: 2 days included.

On the benefit side, the service desk handles 480 password resets a year for this app at 20 GBP per ticket: 9,600 GBP a year disappear with SSO and self-service reset. Payback comes in about 11 months, before counting the reduced risk of a breach through an orphaned account or a lower insurance premium.

FAQ

OpenID Connect or SAML: which should we use?

OpenID Connect for any recent web or mobile application, as it is simpler to build and test. SAML still makes sense for older apps that already support it, saving 2 to 4 days of integration.

Will MFA slow down warehouse operators?

Conditional Access can exempt fixed terminals on the site network and require MFA only off-site. FIDO2 keys cost 20 to 45 GBP per operator for shared terminals.

How long should we keep access logs?

At least 6 months under NCSC guidance, and 12 months for most insurers and auditors. For 400 users, storage amounts to a few gigabytes a year.

Can contractors keep local accounts?

Better to invite them as guest users in Entra ID, free up to 50,000 monthly active users. Local accounts escape access reviews and central deactivation.

Do we need to rewrite the application to add SSO?

Rarely: in about 80% of cases only the authentication module changes. If permissions are tangled with business logic everywhere, plan for the 20-day upper range.

Let's scope your project. Share your application architecture and audit report: we will assess the SSO integration, role mapping and a cutover plan with no service interruption. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.