SSO and Role-Based Access for a Business App in Dubai (2026)

The verdict in three sentences

For a multi-subsidiary group in Dubai, connecting business applications to Microsoft Entra ID SSO with role-based access control (RBAC) costs, as a 2026 estimate, AED 120,000 to 300,000 excluding VAT (roughly USD 33,000 to 82,000), depending on the number of apps, roles and legacy integrations. Delivery takes 6 to 10 weeks, and payback comes mostly from lower support load (up to 60% fewer password reset tickets) and from evidence you can hand to your ISO 27001 auditor. The real trap is not technical: a poorly defined role matrix is what blows up budgets mid-project.

What an SSO and RBAC project actually covers

SSO lets an employee sign in once with their Microsoft 365 account and reach every internal tool: in-house ERP, HR portal, procurement app, sales dashboard. RBAC then decides what each person can see and change. In a 5-subsidiary group you usually end up with 8 to 20 roles: subsidiary director, financial controller, buyer, warehouse lead, HR, internal auditor, administrator, read-only.

The building blocks are well known: OpenID Connect or SAML 2.0 with Entra ID, mandatory MFA through Microsoft Authenticator, mapping Entra groups to application roles, per-subsidiary data partitioning, a timestamped audit log (who did what, when, from which IP) and automatic deprovisioning when someone leaves.

The Entra ID licence is often already paid for: Microsoft 365 Business Premium and E3/E5 plans include Entra ID P1 or P2, which unlocks conditional access and advanced MFA at no extra cost.

Three architectures and what they cost

Groups do not start from the same place. Some run in-house apps, others run off-the-shelf software that already supports SAML, and many have a mix including older tools with no authentication standard at all.

For a group already on Microsoft 365, the second option is the most common: Entra ID stays the identity source and fine-grained permissions live inside the apps. If your application estate needs modernising anyway, rebuilding it as a custom web application lets you design SSO in from day one, which is far cheaper than retrofitting it.

Security, compliance and watch-outs in the UAE

ISO 27001:2022 control 5.15 (access control) and 5.18 (access rights) expect documented role definitions, periodic access reviews and traceability: a clean RBAC model plus an audit log covers most of the evidence. The UAE Personal Data Protection Law (PDPL) and, for DIFC entities, the DIFC Data Protection Law also require that access to personal data is limited to authorised staff. On the cybersecurity side, three settings matter most: conditional access (block sign-ins from unmanaged devices or unexpected countries), phishing-resistant MFA for sensitive roles, and quarterly access reviews.

Budget overruns almost always come from three places: roles invented mid-project, legacy apps discovered late, and no business owner signing off the matrix. A 5 to 8 day scoping workshop before any build removes most of those surprises.

Mini case study

Omar, CIO of a trading group in Dubai with 5 subsidiaries and 420 users, was receiving about 110 password reset or locked account tickets a month, each taking a technician 20 minutes on average. That is 110 × 20 = 2,200 minutes, about 37 hours a month. At a loaded cost of AED 120 per hour, that is AED 4,440 a month, or AED 53,280 a year, before counting the lost time of blocked staff.

After an SSO + RBAC project of AED 200,000 across 4 apps, delivered in 9 weeks, access tickets dropped to 44 a month (60% fewer). Support savings: 66 tickets × 20 minutes = 22 hours a month, about AED 31,700 a year. Direct payback on support alone is roughly 6 years, but Omar also removed 37 orphan accounts belonging to former employees and passed his ISO 27001 surveillance audit with no access control finding, which no spreadsheet would have priced.

FAQ

How long does an Entra ID SSO rollout take?

Plan 6 to 10 weeks for 3 to 5 applications, scoping included. A single SAML-ready app can be connected in 1 to 2 weeks.

Do we need an extra Microsoft licence?

Usually not: Microsoft 365 Business Premium includes Entra ID P1, which covers SSO, MFA and conditional access. Entra ID P2 is only needed for risk-based detection and privileged identity management.

How many roles should a 5-subsidiary group plan for?

Typically 8 to 20. Beyond 25 the matrix becomes hard to maintain, and it is better to combine roles with scopes (subsidiary, department).

What should the audit log contain for ISO 27001?

At minimum identity, action, timestamp, IP address and the object changed, kept for 12 months or more. A monthly CSV export for internal audit adds 2 to 3 days of development.

Can we connect a legacy app with no SAML or OIDC?

Yes, through an authentication gateway or reverse proxy, which adds roughly AED 40,000 to 70,000 as a 2026 estimate. If the app is near end of life, rebuilding it is often the better investment.

Let's scope your project. Send us your list of applications, subsidiaries and current roles, and we will scope the SSO and RBAC perimeter and the rollout schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.