SSO and Enterprise Authentication for an Internal App in New York

The verdict in three sentences

In a New York group of 1,500 employees that mandates Microsoft Entra ID, SSO integration for a new business application costs 3,000 to 10,000 EUR (about 3,300 to 11,000 USD) with SAML or OIDC, and role management adds 5,000 to 15,000 EUR depending on how granular permissions are. Identity provider licences, 3 to 9 EUR per user per month, are often already covered by the group's Microsoft 365 subscription. The project ships in 3 to 6 weeks, access logging included, provided the identity team approves the app registration in week one.

What each authentication building block costs

Enterprise SSO is made of several blocks, not all needed in the first release. Figures below reflect 2026 projects.

For a management application used across several subsidiaries, the full budget usually lands between 15,000 and 30,000 EUR. SCIM provisioning is the most underestimated block: without it, an employee who leaves keeps an active account in the app.

SAML, OIDC or an identity layer: which to choose

The CIO mandates Entra ID, but protocol and tooling remain open. That choice affects long-term maintenance and security.

For an internal app reserved for group employees, OIDC with the MSAL library is the cheapest and most durable choice. An intermediate service becomes relevant once external partners or a subsidiary on Google Workspace need to sign in.

Licences, compliance and logging

Entra ID licences range from 0 EUR (basic features included in Microsoft 365) to about 6 EUR per user per month for P1, required for conditional access, and 9 EUR for P2 with risk detection. In most groups, P1 is already included in Microsoft 365 E3 or E5: check before budgeting.

Logging is not optional. SOC 2 audits, state privacy laws such as the New York SHIELD Act, and GDPR for European data all require you to reconstruct who accessed which data. Keeping trails for 6 to 12 months, exported to the group SIEM, is common practice.

Mini case study

Julian, CIO of a 1,500-employee services group in New York, is launching a contract tracking app used by 600 staff across 4 subsidiaries. Without SSO, the app generates about 35 password reset requests a month at 25 EUR per ticket, or 875 EUR, plus 40 joiners and leavers handled manually, about 13 hours at 45 EUR, or 585 EUR. Total: 1,460 EUR a month.

With OIDC SSO (5,000 EUR), per-subsidiary roles (9,000 EUR) and SCIM (3,000 EUR), i.e. 17,000 EUR (about 18,700 USD), these costs drop to almost zero, with P1 already included. Payback in just under 12 months, not counting the removal of orphan account risk flagged in the last audit.

FAQ

How much does integrating an app with Entra ID cost?

In 2026, budget 3,000 to 10,000 EUR for SSO alone, and 15,000 to 30,000 EUR with roles, automatic provisioning and logging. Licences are often already covered by Microsoft 365.

Should we pick SAML or OIDC?

For a recent web app, OIDC is simpler and cheaper to maintain, with no certificate to renew every year. SAML is still useful for some packaged software that only supports that protocol.

How long does the project take?

3 to 6 weeks depending on role granularity. The main source of delay is the identity team approving the app registration, which can take 1 to 2 weeks in a large group.

Is MFA mandatory?

It is not legally required for every application, but most group security policies and cyber insurers demand it. With Entra ID P1, at about 6 EUR per user, it takes a few days to configure.

How long should access logs be kept?

Common practice is 6 to 12 months, depending on data sensitivity. Logs must be tamper-protected and exportable to the group SIEM.

Let's scope your project. Send us a description of your app and your roles, and we will price SSO, permissions and logging over 3 to 6 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.