SSO Entra ID Integration for a Custom App in New York

The verdict in three sentences

About 80 % of access incidents handled by an IT help desk are password related: forgotten passwords, resets, shared accounts. Connecting a custom business app to Microsoft Entra ID with multi-factor authentication costs USD 10,000 to 25,000 in New York in 2026 and takes 2 to 4 weeks. Choose OpenID Connect for a modern app, SAML for an older tool, and add SCIM once you pass 100 users.

What the CISO actually expects

In a New York company preparing a SOC 2 Type II audit, the security policy usually comes down to a few non-negotiable rules: no internal app with its own password store, MFA enforced through Conditional Access, automatic account deactivation when an employee leaves, and sign-in logs shipped to the SIEM. A business app built five years ago with a username and password form fails every one of these controls during the audit.

The protocol choice drives the budget. OpenID Connect (OIDC) is the modern, lightweight standard for web and mobile apps. SAML 2.0 is still widespread and well supported by older tools. SCIM 2.0 does not handle sign-in but account synchronisation: creation, group changes, deletion.

Detailed 2026 budget for New York

The final amount mainly depends on three factors: the quality of the existing code, role handling (one role or a 15-profile matrix) and the level of testing required by security and SOC 2 auditors.

On licensing, Conditional Access and stronger MFA require Entra ID P1, included in Microsoft 365 E3 or billed at about USD 6 per user per month. For 400 employees already on E3, the extra licence cost is zero.

The rollout in 2 to 4 weeks

Week 1: kickoff with the Entra ID administrator, app registration in the tenant, choice of claims and groups, staging environment. Week 2: sign-in flow development, session and sign-out handling, role mapping. Week 3: SCIM if selected, logging, tests with 5 to 10 pilot accounts. Week 4: security testing, runbook for the operations team, phased rollout by department.

A common trap: service accounts and emergency access. Plan a documented break-glass account, otherwise an Entra ID outage locks everyone out of the app.

Mini case study

David, CISO of a 1,200-employee distribution company in Midtown Manhattan, has to bring a supplier rebate management app used by 350 people into compliance before the SOC 2 audit. Choice: OIDC with SCIM, budget USD 18,000, delivered in 3 weeks.

The math: the help desk handled 45 password reset requests a month on this tool, at USD 30 each fully loaded, i.e. USD 16,200 a year. After cutover, these requests drop to almost zero. Add 6 hours a month saved on manual joiner and leaver handling, i.e. USD 5,040 a year at USD 70 an hour. Annual gain: about USD 21,240, a payback in under 11 months, not counting the closed audit finding.

FAQ

Do we have to rewrite the whole app to add SSO?

No. Only the authentication layer changes, usually 5 to 10 % of the code. Screens and data stay the same.

Is MFA handled by the app or by Entra ID?

By Entra ID, through Conditional Access policies. The app receives an already validated token, so you avoid building and maintaining a second MFA system.

Can we keep local accounts for external contractors?

Better to invite them as B2B guest accounts in Entra ID, free up to 50,000 monthly active users. You keep a single security policy.

What does maintenance cost after go-live?

Plan 1 to 2 days a year, i.e. USD 1,200 to 2,400, mainly to rotate certificates and secrets, which expire every 12 to 24 months.

Does SSO help with SOC 2?

Yes, it directly supports the logical access controls (CC6.1 to CC6.3) auditors test. It does not replace the rest of the control set, such as change management and vendor risk.

Let's scope your project. Tell us how many apps and users you have and your target protocol: we will price the integration between USD 10,000 and 25,000, delivered in 2 to 4 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.