The verdict in three sentences
In 2026, nearly every enterprise security questionnaire requires SSO via SAML or OIDC (Microsoft Entra ID, formerly Azure AD, Google Workspace, Okta) and often SCIM provisioning. A B2B vendor should plan EUR 6,000 to 15,000 excl. VAT for SSO, EUR 4,000 to 8,000 for SCIM, then EUR 0.02 to 0.05 per active user per month if it relies on a managed identity service. This project unlocks contracts and shortens the sales cycle by 30 to 45 days by avoiding back-and-forth with the client's IT department.
What SSO integration costs in 2026
| Component | Content | Lead time | Indicative cost excl. VAT |
|---|---|---|---|
| OIDC SSO (Google, Entra ID) | Login via the client's provider, account mapping | 4 to 6 days | EUR 4,000 to 6,000 |
| Multi-tenant SAML 2.0 SSO | Per-client configuration, metadata, certificates | 6 to 10 days | EUR 6,000 to 10,000 |
| SAML + OIDC + self-service setup screen | Client admin configures SSO alone | 10 to 15 days | EUR 10,000 to 15,000 |
| SCIM 2.0 provisioning | Automatic account creation, update and deactivation | 5 to 8 days | EUR 4,000 to 8,000 |
| MFA (TOTP, FIDO2 keys) for non-SSO accounts | Configurable mandatory second factor | 2 to 4 days | EUR 1,500 to 3,500 |
| Exportable login audit log | Export to the client's SIEM | 2 to 3 days | EUR 1,500 to 2,500 |
These are 2026 orders of magnitude for a well-structured existing application. A poorly decoupled home-grown auth layer can add 3 to 6 days of refactoring.
Build it yourself or use a managed identity service
| Option | Setup cost | Recurring cost | Advantage | Limitation |
|---|---|---|---|---|
| Open source library (self-hosted Keycloak) | EUR 8,000 to 15,000 | Hosting EUR 80 to 200 / month + maintenance | No per-user cost, data in France | Security updates are on you |
| European managed service | EUR 5,000 to 10,000 | EUR 0.02 to 0.04 / active user / month | EU hosting, easier compliance | Vendor dependency |
| US managed service (Auth0, WorkOS, Clerk) | EUR 4,000 to 8,000 | EUR 0.03 to 0.05 / active user, or USD 100 to 125 per SSO connection / month | Fast integration, SCIM included | Cost grows with clients, data leaves the EU |
| Native framework feature | EUR 6,000 to 12,000 | Near zero | Full control | SAML coverage sometimes incomplete |
Watch out for pricing billed per SSO connection: at USD 125 per enterprise client per month, 20 clients add up to USD 30,000 a year. Beyond 15 to 20 SSO clients, Keycloak or a European per-user service usually becomes more cost-effective.
What enterprise clients check
| Security questionnaire requirement | Frequency in 2026 | Expected answer |
|---|---|---|
| SAML or OIDC SSO | Over 90% of tenders | Yes, Entra ID, Google, Okta tested |
| Automatic provisioning and deprovisioning (SCIM) | 50 to 70% | Deactivation within 1 h of an employee leaving |
| MFA enforceable by the client admin | 80% | Yes, per-tenant policy |
| Login audit log | 70% | 12-month retention, CSV or API export |
| Data hosted in the EU | 60 to 80% for European clients | Yes, region specified |
| Annual pentest | 60% | Report summary less than 12 months old |
Answering "yes" to these six lines moves many bids from "exception to handle" to "standard file", hence the 30 to 45 day gain on the cycle.
Mini case study
Thomas, founder of a Bordeaux vendor of construction site management software, loses 3 tenders in a year for lack of SSO, with an average deal of EUR 36,000 per year. He invests EUR 11,000 excl. VAT (self-service SAML + OIDC) and EUR 6,000 for SCIM, i.e. EUR 17,000 excl. VAT, and picks Keycloak hosted in France at EUR 120 per month. The following year he wins 2 contracts of that size: EUR 72,000 of annual recurring revenue against EUR 18,440 of first-year cost. Payback in under 4 months on the first signed contract.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
What is the difference between SAML and OIDC?
SAML is an older XML-based standard, still dominant in large companies running Entra ID or ADFS. OIDC is more modern and simpler; supporting both covers over 95% of client requests for EUR 6,000 to 15,000 excl. VAT.
Is SCIM essential from day one?
Not always: about 50 to 70% of enterprise clients ask for it. Start with SSO, then add SCIM (EUR 4,000 to 8,000) as soon as a client with more than 500 users requires it.
Should SSO be sold as an add-on?
Many vendors reserve it for the enterprise plan, with a 20 to 40% uplift on the subscription. Enterprise clients accept it and it funds the identity service's recurring cost.
How long does it take to connect a new client?
With a self-service setup screen, 30 minutes to 2 hours on the client IT side. Without one, expect half a day of technical exchanges per client, about EUR 400 to 600 of internal time.
Does SSO really improve security?
Yes: deactivating an employee in the client's directory cuts their access immediately, and the client's MFA applies. It removes most orphan accounts, a frequent cause of data leaks.
Let's scope your project. Send us your current authentication architecture and your prospect's security questionnaire: we will cost SSO, SCIM and MFA (EUR 6,000 to 23,000 excl. VAT depending on scope) with a 3 to 6 week lead time. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
