The verdict in three sentences
SSO (Single Sign-On) lets your partners access all your portals with one identity, cutting password tickets by 50% and strengthening security. In 2026, an OAuth2/SAML integration with directory and provisioning runs between 6,000 and 18,000 EUR depending on the number of applications and users. Beyond convenience, it is a security gain: instant account deactivation, centralised MFA and access traceability.
What SSO costs in 2026
The budget depends on the protocol, the number of applications to connect and automatic account provisioning. Here are the 2026 orders of magnitude in Dublin.
| Scope | Cost (EUR) | Timeline |
|---|---|---|
| SSO 1 to 2 apps (OAuth2) | 6,000 - 9,000 | 3 - 5 weeks |
| SSO 3 to 5 apps + directory | 10,000 - 14,000 | 6 - 9 weeks |
| SSO + automatic provisioning (SCIM) | 14,000 - 18,000 | 8 - 12 weeks |
| Annual maintenance | 15 - 20% of project | recurring |
The choice of identity provider (Keycloak open source, Azure AD, Auth0) drives the recurring cost: Keycloak avoids per-user licence fees but requires hosting and operations.
OAuth2 or SAML: which to choose
Both protocols deliver SSO but suit different contexts. The choice depends on your existing applications and your partners.
| Criterion | OAuth2 / OIDC | SAML 2.0 |
|---|---|---|
| Modern / mobile apps | Excellent | Limited |
| Legacy enterprise apps | Medium | Excellent |
| Integration complexity | Low | Medium |
| Provisioning (SCIM) | Native | Via extension |
| 2026 adoption | Growing | Established in B2B |
In practice, many extranets combine OIDC for recent apps and SAML for legacy partner tools, with a modern identity provider handling both at once.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Aoife runs IT at an industrial company in Dublin, with 4 partner portals and about 900 external users. Support received around 120 password tickets a month, each taking 15 minutes, or 30 hours/month. Deploying a Keycloak SSO (OIDC + SAML) cost 13,500 EUR plus maintenance. Tickets fell to 60 a month (-50%), freeing 15 hours/month of support. Above all, deactivating a partner account, which took days across 4 apps, is now done in a single action, a major security gain that is hard to price but decisive in an audit.
FAQ
How long to deploy SSO? From 3 to 12 weeks depending on the number of apps and provisioning. A simple SSO over two apps ships in a month; automatic multi-portal provisioning needs more testing.
Do we need to change our existing apps? Not necessarily. Apps compatible with OIDC or SAML connect without rewriting. Older tools may need a connector or an authentication proxy, priced case by case.
Does SSO improve or weaken security? It improves it, provided you enable centralised MFA. A single well-protected entry point (MFA + password policy) is safer than dozens of weak, scattered passwords.
Keycloak or a SaaS solution? Keycloak (open source) avoids per-user licence costs, ideal at high volume, but requires operations. A SaaS like Auth0 reduces operational load in exchange for a recurring per-user cost.
What does automatic provisioning add? Provisioning (SCIM) creates and deactivates accounts automatically when a partner joins or leaves. It removes orphan accounts, the main extranet vulnerability, and saves considerable administration time.
Let's scope your project. Tell us your portals, user count and provisioning needs, and we'll price the SSO (OAuth2/SAML, directory) suited to your context. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
