The verdict in three sentences
For a Singapore group with 5 subsidiaries and 900 users, single sign-on with multi-factor authentication pays for itself mainly through fewer support tickets and the end of orphaned accounts. Integrating 6 applications costs SGD 40,000 to 90,000 (about USD 30,000 to 67,000), delivered in 8 weeks. The key choice is between Microsoft Entra ID (P1 licence at about USD 6, or SGD 8, per user per month) and Keycloak (open source, no licence, but you host and maintain it).
Entra ID or Keycloak: the 2026 comparison in Singapore
If the group already runs Microsoft 365, Entra ID is usually the shortest path: accounts exist, you only plug the business apps in through SAML 2.0 or OpenID Connect. Keycloak makes sense when apps are mostly built in-house, licence budgets are tight or identity data must stay in a specific environment.
| Criterion | Microsoft Entra ID P1 | Self-hosted Keycloak |
|---|---|---|
| Licence for 900 users | about SGD 7,200 a month | SGD 0 |
| Hosting | Microsoft cloud (Singapore region available) | Own servers or cloud, SGD 400 to 1,200 a month |
| MFA and conditional access | Included in P1 | MFA included, conditional rules to build |
| Integrating one SAML or OIDC app | 3 to 6 days | 4 to 8 days |
| Annual maintenance | Low | 15 to 25 engineer days a year |
| Link with on-premise Active Directory | Entra Connect, simple | LDAP federation, to configure |
| Regulatory fit | MAS TRM and PDPA documentation available | Controls to document yourself |
Regulatory note: for banks, insurers and payment firms, the MAS Technology Risk Management Guidelines expect strong authentication, privileged access control and prompt revocation. The PDPA applies to all organisations handling personal data. For comparison, the same project for a group in Dakar costs 6 to 12 million FCFA.
The detailed quote for 6 business apps
The 6 typical apps of a regional group: ERP, payroll and HR, CRM, a custom inventory app, intranet, ticketing tool. Recent apps support OIDC; older ones need a connector or code changes.
| Item | Effort (days) | 2026 cost (SGD) |
|---|---|---|
| Scoping, account and role inventory | 4 to 6 | 4,000 to 7,500 |
| Directory and MFA configuration | 4 to 8 | 4,000 to 10,000 |
| Integrating 4 OIDC or SAML-ready apps | 12 to 20 | 12,000 to 25,000 |
| Adapting 2 legacy apps | 10 to 20 | 10,000 to 25,000 |
| Automatic provisioning (SCIM or HR script) | 5 to 10 | 5,000 to 12,500 |
| Testing, training and support for 900 users | 5 to 8 | 5,000 to 10,000 |
| Total | 40 to 72 | 40,000 to 90,000 |
Roll-out goes subsidiary by subsidiary, starting with the smallest: a 2-week pilot with 80 users catches edge cases (shared accounts, external contractors, shop-floor terminals).
What SSO changes day to day
When an employee leaves, one click disables every access instead of 6 separate actions, one of which gets forgotten a third of the time. App-based MFA blocks most fraudulent logins using stolen passwords. For field teams without company phones, plan FIDO2 hardware keys at SGD 40 to 70 each, or SMS OTP as a last resort.
Mini case study
Daniel, CIO of a distribution group in Singapore with 5 subsidiaries and 900 users, handles 1,200 tickets a year, 25% of them password resets, so 300 tickets. At 20 minutes of technician time and 25 minutes of user downtime per ticket, the loss is about 225 hours a year, roughly SGD 13,500 of paid time.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
He picks Entra ID, already included in part of his Microsoft 365 Business Premium licences, and buys P1 only for 400 users, about SGD 3,200 a month. The integration project costs SGD 62,000. Resets drop by 80% thanks to self-service. Above all, the annual audit finds 70 former employees' accounts still active: SSO removes them for good, which is what convinces the audit committee.
FAQ
Can SSO work with apps built in-house?
Yes, if the app can delegate authentication through OIDC or SAML. Allow 5 to 10 days to adapt a legacy app, SGD 5,000 to 12,500.
Does MAS TRM require MFA?
For financial institutions, MAS expects MFA for privileged users and for access to critical systems from untrusted networks. Non-financial groups are not bound by TRM but often use it as a benchmark.
Must every user have MFA?
It is strongly recommended, at least for admins, finance and remote access. A phased roll-out over 4 weeks keeps helpdesk calls down.
How long for a 900-user group?
About 8 weeks: 2 for scoping, 4 for integration and pilot, 2 for general roll-out. Each extra subsidiary adds 1 to 2 weeks.
Can we keep current Microsoft 365 licences?
Business Premium and E3 already include Entra ID P1. Check your contract before buying separate licences, the saving can reach SGD 86,000 a year for 900 users.
Let's scope your project. Send us your app list, users per subsidiary and current Microsoft licences: we will price SSO with MFA between SGD 40,000 and 90,000, delivered in 8 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
