The verdict in three sentences
For an enterprise of 1,400 employees opening its portal to 900 partners, integrating Microsoft Entra ID (formerly Azure AD) costs roughly EUR 15,000 to 30,000 in Dublin and ships in about 6 weeks. Employees sign in with their usual Microsoft 365 account, partners with an external account protected by MFA, and permissions are driven by role and by partner company. Licensing is light: Entra External ID stays free up to 50,000 monthly active users, far above your network size.
Two populations, two mechanisms, one front door
The classic mistake is to create local accounts in the portal for partners and wire SSO only for staff. The result is two identity stores, shared passwords inside partner firms and accounts that are never disabled when a partner's rep leaves.
The recommended 2026 architecture uses OpenID Connect and two account types in Entra:
| Population | Entra mechanism | Authentication | Lifecycle |
|---|---|---|---|
| Employees (1,400) | Company tenant, workforce SSO | Microsoft 365 account + existing MFA | Driven by HR through the directory |
| Partners on Microsoft 365 | B2B invitation (guest account) | Their own tenant, trusted MFA | Quarterly access review |
| Partners without Microsoft 365 | Entra External ID | Email + one-time code or password + MFA | Expiry after 90 days inactive |
| Portal administrators | Privileged role | Phishing-resistant MFA (FIDO2 key) | Just-in-time access |
| Service accounts (API) | Application identity | Certificate, no password | Annual rotation |
The portal stores no passwords. It receives a signed token carrying identity, partner company and roles, then applies its own display rules.
Per-partner roles: where the budget goes
The SSO connection itself is rarely more than 30% of the budget. The rest is the permission model: a reseller in Cork must only see its own orders, rebates and documents, and its manager should invite colleagues without going through central IT.
| Item | Content | 2026 ballpark (excl. VAT) |
|---|---|---|
| Tenant setup and app registration | OIDC, redirect URIs, certificates | EUR 2,500 to 4,000 |
| Custom External ID user flows | Sign-up, branding, MFA | EUR 2,500 to 5,000 |
| Role model (viewer, buyer, partner admin) | Token claims, portal-side checks | EUR 4,000 to 8,000 |
| Delegated administration for partners | Partner manager invites and revokes | EUR 3,000 to 6,500 |
| Conditional access and logging | Risky country blocking, logs to SIEM | EUR 2,000 to 4,000 |
| Testing, documentation, handover | End-to-end tests, runbook | EUR 1,000 to 2,500 |
| Total | EUR 15,000 to 30,000 |
Dublin senior contractor rates of EUR 650 to 900 a day explain the gap with smaller European markets. The top of the range fits companies wanting full delegation and permissions synced with the ERP (a partner suspended for non-payment automatically loses order access).
Recurring costs and licences
| Item | Indicative 2026 cost |
|---|---|
| Employee licences | Already included in Microsoft 365 E3 or Business Premium |
| Entra External ID, 0 to 50,000 MAU | EUR 0 |
| Above 50,000 MAU | Pay-as-you-go per active user |
| SMS MFA for partners | Paid per use, prefer the Authenticator app |
| Entra ID P2 for advanced access reviews | Per licensed administrator |
| Application maintenance | Per contract |
With 900 partners and around 2,500 partner users, you stay far below the paid threshold.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Aoife, IT director of an industrial group in Dublin, runs 2,500 local partner accounts on a legacy extranet. Her service desk handles about 140 password reset tickets a month at 12 minutes each: 28 hours a month, 336 hours a year. At a loaded EUR 55 per hour, that is EUR 18,480 a year. The audit also finds 640 accounts of former partner staff still active.
Chosen project: EUR 24,000 integration, External ID licences at EUR 0. With self-service reset and automatic expiry, tickets drop to 25 a month, 60 hours a year. Annual saving: about EUR 15,200, payback in roughly 19 months, and above all 640 orphaned accesses closed, a risk reduction no time calculation fully captures.
FAQ
Do partners need Microsoft 365?
No. Partners without a Microsoft tenant use External ID with email and one-time code or password, plus MFA. Around 60% of small resellers fall into this group.
OpenID Connect or SAML?
For a portal built in 2026, OpenID Connect is the default: simpler and suited to web and mobile apps. SAML remains useful for connecting legacy applications alongside.
How long does migrating existing accounts take?
About 2 of the 6 weeks: importing 2,500 partners, sending invitations in waves of 300 and reinforced support for 10 days.
How do we avoid locking out a partner who loses their MFA phone?
Each account gets two MFA methods and a recovery procedure delegated to the partner manager. Unlock time drops below 30 minutes.
Is the portal GDPR compliant?
Entra keeps identities in European datacentres when the tenant is set up in Europe. You still document the processing record and retention period, for instance 90 days after inactivity, for the Irish Data Protection Commission.
Let's scope your project. We map your user populations, role model and Entra tenant, then deliver a 6-week integration plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
