The verdict in three sentences
Integrating Entra ID SSO into an internal application costs EUR 3,000 to 10,000 in 2026 depending on protocol (OIDC or SAML) and role handling, with a 2 to 4 week timeline. SCIM provisioning (about EUR 4,000 more) is the investment that actually eliminates orphaned accounts after someone leaves. To enforce MFA and conditional access, plan for the Entra ID P1 license at EUR 5.60 (about USD 6) per user per month, often already included in Microsoft 365 E3 or Business Premium.
What the integration costs, line by line
The CISO of a 600-employee company requiring SSO and MFA on every internal app must price each application separately. Cost depends mostly on the state of the existing authentication code.
| Item (2026 estimate) | Recent app, OIDC | Legacy app, SAML | Timeline |
|---|---|---|---|
| SSO connection (OIDC or SAML) | EUR 3,000 to 5,000 | EUR 5,000 to 8,000 | 1 to 2 weeks |
| Mapping Entra groups to app roles | EUR 1,000 to 2,000 | EUR 1,500 to 2,500 | 3 to 5 days |
| SCIM provisioning (create, deactivate) | EUR 4,000 | EUR 4,000 to 5,500 | 1 to 2 weeks |
| Migrating existing local accounts | EUR 500 to 1,500 | EUR 1,000 to 2,500 | 2 to 4 days |
| Testing, acceptance, documentation | Included | EUR 1,000 | 2 to 3 days |
| Total without SCIM | EUR 3,000 to 7,000 | EUR 6,500 to 10,000 | 2 to 3 weeks |
| Total with SCIM | EUR 7,000 to 11,000 | EUR 10,500 to 15,500 | 3 to 4 weeks |
OIDC is the default choice for a modern web app. SAML remains relevant when the existing framework already supports it or a partner requires it.
Entra ID licenses and features
Basic SSO works with Entra ID Free. The security features a CISO asks for, however, require a P1 or P2 license.
| Feature | Entra ID Free | Entra ID P1 (EUR 5.60/user/month) | Entra ID P2 (EUR 8.40/user/month) |
|---|---|---|---|
| SSO to third-party apps | Yes | Yes | Yes |
| MFA | Security defaults only | Yes, policy-based | Yes |
| Conditional access (location, device, risk) | No | Yes | Yes, with user risk |
| SCIM provisioning to your apps | Limited | Yes | Yes |
| Dynamic groups | No | Yes | Yes |
| Periodic access reviews | No | No | Yes |
| Annual cost for 600 users | EUR 0 | EUR 40,320 | EUR 60,480 |
Check your existing contracts: Microsoft 365 E3 and Business Premium already include P1, bringing the marginal cost to zero for many companies.
Mini case study
Nadia, CISO of a 600-employee industrial group in Grenoble, must connect 4 internal apps. Integration cost: 2 recent apps on OIDC with SCIM at EUR 8,000 each, 2 legacy apps on SAML with SCIM at EUR 12,000 each, for EUR 40,000. P1 licenses are already included in Microsoft 365 E3. Before the project, an audit found 85 active accounts belonging to former employees, and the help desk handled 150 password resets a month at 15 minutes each, or 450 hours a year. At EUR 45 per loaded hour, the help desk saving is EUR 20,250 per year, before counting the risk removed on orphaned accounts. Payback in about 2 years.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How long does Entra ID SSO integration take?
Plan 2 weeks for a recent app on OIDC without SCIM, and up to 4 weeks for a legacy app on SAML with provisioning. Security team acceptance testing often adds 3 to 5 days.
OIDC or SAML: which one?
OIDC is simpler to implement and maintain for a recent web or mobile app. SAML is still useful for legacy apps or partners who require it, at an extra EUR 2,000 to 3,000.
Is SCIM essential?
Without SCIM, disabling an account in Entra blocks sign-in, but the account stays in the app with its data and permissions. SCIM, at about EUR 4,000, automates creation and deactivation and removes orphaned accounts.
Is the P1 license mandatory?
Not for SSO alone, but yes for policy-based MFA and conditional access. At EUR 5.60 per user per month, it is often already included in Microsoft 365 E3 or Business Premium.
Can we keep local break-glass accounts?
Yes, keeping 1 to 2 protected and monitored local admin accounts is recommended, used only if Entra ID is unavailable.
Let's scope your project. We integrate Entra ID SSO, MFA and SCIM into your internal apps, from EUR 3,000 to 10,000 per application, in 2 to 4 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
