The verdict in three sentences
For a 600-employee mid-sized company in Dublin, connecting internal apps to Microsoft Entra ID for single sign-on costs EUR 3,000 to 10,000 per application, plus EUR 4,000 to 8,000 for SCIM provisioning. The return comes from three sources: password reset tickets avoided, leavers cut off in a minute and MFA enforced everywhere. If you already hold Microsoft 365 E3 or Business Premium licences, Entra ID P1 is often included and the project becomes purely an application one.
What Entra ID SSO costs in 2026
Integration uses OpenID Connect (the simplest for a modern web app) or SAML 2.0 (common for older software). The price varies depending on whether the app already manages its own roles or they must be mapped to Entra groups.
| Item | 2026 price (order of magnitude) | Timeline |
|---|---|---|
| OpenID Connect SSO, recent app | EUR 3,000 to 5,000 | 1 to 2 weeks |
| SAML 2.0 SSO, legacy app | EUR 5,000 to 10,000 | 2 to 4 weeks |
| Mapping Entra groups to app roles | EUR 1,500 to 3,000 | 3 to 5 days |
| SCIM provisioning and deprovisioning | EUR 4,000 to 8,000 | 2 to 3 weeks |
| Conditional access and MFA (Entra setup) | EUR 1,000 to 2,500 | 2 to 4 days |
| Entra ID P1 licence | about EUR 6 per user per month | immediate |
| Entra ID P2 licence (risk detection) | about EUR 9 per user per month | immediate |
For 600 users, Entra ID P1 alone is about EUR 43,200 per year. Check this line first: most mid-sized companies already pay for it through Microsoft 365.
The gain: tickets avoided and access security
Industry studies put 20 to 40% of IT support tickets down to passwords. With 8 logins per person, a 600-employee company easily generates 150 to 250 reset requests per month.
| Indicator | Before SSO (8 logins) | After Entra ID SSO |
|---|---|---|
| Reset tickets per month | 180 | 30 to 40 (self-service SSPR) |
| Cost per ticket (internal support) | EUR 15 to 25 | EUR 15 to 25 |
| Monthly ticket cost | EUR 2,700 to 4,500 | EUR 450 to 1,000 |
| Time to revoke a leaver's access | 1 to 5 days, app by app | under 1 hour with SCIM |
| Apps covered by MFA | 1 or 2 | every federated app |
| Orphan accounts found at audit | 5 to 10% of accounts | close to 0% |
| Daily sign-in time per employee | 5 to 8 minutes | 1 to 2 minutes |
The second gain is regulatory. The NIS2 directive, transposed in Ireland, requires many mid-sized companies to demonstrate robust identity and access management. SSO with MFA and centralised logging is the most direct evidence to show an auditor or a cyber insurer, who increasingly demands MFA to cover the risk.
Technical points to settle before the quote
- Service accounts and APIs: machine-to-machine integrations do not go through SSO and must use application identities with rotating secrets or certificates.
- External users: contractors and partners can be invited as B2B guests in Entra ID, without local accounts.
- Fallback mode: keep a protected, audited local break-glass admin account in case Entra ID is unavailable.
- Rollout order: start with the most used app, then add one app every 2 to 3 weeks.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Ciarán, CIO of a 600-employee logistics company in Dublin, federates 3 internal apps (scheduling, route management, HR portal) on Entra ID, already included in his Microsoft 365 licences. Budget: 2 OpenID Connect SSOs at EUR 4,000, 1 SAML SSO at EUR 7,000, SCIM on the HR app at EUR 6,000, conditional access at EUR 2,000, i.e. EUR 23,000. Tickets drop from 180 to 35 per month at EUR 20 each: EUR 2,900 saved per month, or EUR 34,800 per year. Payback: 8 months, not counting sign-in time saved across teams.
FAQ
Do I need Entra ID P1 for SSO?
Basic SSO to enterprise apps works on the free tier, but conditional access and self-service password reset need P1, about EUR 6 per user per month. It is included in Microsoft 365 E3, E5 and Business Premium.
OpenID Connect or SAML: which one?
OpenID Connect for any app built after 2018, it is 30 to 50% cheaper to integrate. SAML remains useful for off-the-shelf software that only supports that protocol.
Can I use Okta or Google Workspace instead of Entra ID?
Yes, an OpenID Connect compatible app plugs into any identity provider. Okta costs about EUR 2 to 6 per user per month in 2026 depending on modules, which is only justified outside a Microsoft ecosystem.
What exactly does SCIM provisioning do?
It automatically creates, updates and disables accounts in the app from Entra ID. A leaver recorded in HR loses access in under an hour, versus 1 to 5 days manually.
How long to federate 5 applications?
Expect 2 to 6 weeks per app, i.e. 3 to 5 months for a 5-app programme run in sequence. The first two serve as templates and speed up the rest.
Let's scope your project. We integrate your internal apps with Microsoft Entra ID (SSO, MFA, SCIM), with a per-application estimate and a phased rollout plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
