Microsoft Entra ID SSO for an internal web app in Amsterdam: cost in 2026

The verdict in three sentences

Connecting an internal web app to Microsoft Entra ID with OpenID Connect SSO costs, as a 2026 ballpark, 3,000 to 9,000 EUR excl. VAT per application in Amsterdam, plus 2,000 to 6,000 EUR if you want automatic SCIM provisioning of accounts. The Entra ID P1 licence (about 6 EUR per user per month) is often already included in your Microsoft 365 E3 or Business Premium subscriptions, which changes the calculation entirely. A 600-employee mid-sized company can aim for 20 to 40% fewer password-related tickets and instant access removal when an employee leaves.

What an SSO project costs, component by component

SSO means delegating your app's authentication to Entra ID: the user signs in once with their Microsoft account, MFA included, and reaches the app without another password. SCIM provisioning goes further by automatically creating, updating and disabling accounts in the app based on the directory.

A modern internal app (recent framework, simple roles) is wired to SSO for 3,000 to 4,500 EUR excl. VAT. A legacy app with its own user table, fine-grained roles and SCIM reaches 9,000 to 14,000 EUR excl. VAT in total.

Licences: what you may already pay for

For a 600-employee company, buying P1 on top would cost about 3,600 EUR per month. If you are already on E3 or E5, the extra licence cost is zero and only the integration project needs funding. Check this before any budget decision.

Points to watch before launching

• Service accounts and break-glass access: plan a protected, audited local admin fallback account in case Entra ID becomes unreachable.
• External users: contractors and temps go through guest (B2B) accounts; their lifecycle must be defined.
• Sign-out: session end in the app must follow revocation in Entra, otherwise a departed employee keeps access until the session expires.
• Logging: centralise sign-ins to meet audit requirements and the NIS2 directive if your company falls under it.

Mini case study

Daan, CIO of a 600-employee manufacturing company in Amsterdam (illustrative persona), runs 3 internal business apps, each with its own passwords. The service desk handles about 200 password-related tickets a month, at an average cost of 18 EUR per ticket.

• Current cost: 200 tickets x 18 EUR, so 3,600 EUR a month and 43,200 EUR a year.
• Project: SSO on 3 apps at 4,500 EUR each, plus SCIM on the HR app for 4,000 EUR, so 17,500 EUR excl. VAT. The company is already on Microsoft 365 E3: no licence to add.
• Conservative assumption of 35% fewer tickets: 70 tickets avoided, so 1,260 EUR a month and 15,120 EUR a year.

The project pays back in about 14 months on tickets alone, not counting instant access removal on departures, which eliminates a risk that is hard to quantify.

FAQ

Do we have to rewrite the app to move to SSO?

Not in most cases: the login module is replaced by a proven OIDC library and existing accounts are linked. Allow 3 to 6 development days for a mid-sized app.

OIDC or SAML: which one?

For a recent web app, OIDC is simpler to implement and maintain. SAML remains useful for off-the-shelf software that only supports that protocol; the effort is comparable, 3 to 6 days.

Is SCIM essential?

It pays off beyond a few dozen joiners and leavers a year. For 600 employees with 10% turnover, about 60 moves a year, it prevents orphan accounts and forgotten deactivations.

Will MFA slow teams down?

With conditional access, MFA can be required only outside the corporate network or on an unknown device. Users sign in once a day instead of typing 3 different passwords.

How long does an SSO project take?

Allow 2 to 4 weeks for one app, 6 to 10 weeks for a batch of 3 to 5 apps with SCIM, acceptance included.

Let's scope your project. List your internal apps, their technology and your current Microsoft licences: we will price the SSO integration, SCIM and cutover plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.