The verdict in three sentences
An extranet with its own credentials breeds weak passwords and orphaned accounts after an employee or partner leaves. Connecting it to SSO (Microsoft Entra ID, Google Workspace, Okta) with multi-factor authentication costs roughly 6,000 to 18,000 CAD in integration over 3 to 6 weeks. The quickest visible win: up to 60% fewer password tickets and one-click access removal.
SAML or OIDC: which protocol for your extranet
| Criterion | SAML 2.0 | OpenID Connect (OIDC) |
|---|---|---|
| Age and usage | Long-standing enterprise standard | Modern standard built on OAuth 2.0 |
| Format | Signed XML | JSON tokens (JWT) |
| Mobile apps and APIs | Poor fit | Strong fit |
| Entra ID, Okta, Google support | Yes | Yes |
| Integration effort (estimate) | 4 to 8 days | 3 to 6 days |
| Typical case | Large partner enforcing its IdP over SAML | New extranet, web and mobile app |
For a recent extranet, OIDC is the default. Add SAML when a key partner only accepts that protocol, common in automotive and aerospace supply chains around the Greater Toronto Area.
The real issue: external partners
| Option | How it works | Identity provider cost (2026) | Integration effort | Limit |
|---|---|---|---|---|
| Entra B2B guests | Partners sign in with their own Microsoft account or an e-mail code | Free up to 50,000 monthly active users, then usage-based | Low | Sometimes confusing for non-Microsoft users |
| Entra External ID | Separate customer directory, branded sign-in page | Free up to 50,000 monthly active users, SMS MFA billed extra | Medium | More technical setup |
| Per-partner federation | Each major partner connects its own IdP | Included | 1 to 3 days per partner | Strategic accounts only |
| Okta Workforce | Dedicated identity platform | About 3 to 9 CAD per user per month | Medium | High recurring cost at scale |
| Self-hosted Keycloak | Open source on your servers | 0 CAD licence, hosting 45 to 220 CAD per month | High | Maintenance and security on you |
For MFA, prefer an authenticator app or FIDO2 keys/passkeys over SMS: cheaper to run and phishing-resistant. A hardware key costs 35 to 90 CAD for admin accounts.
Integration budget and timeline
| Work package | Content | Duration | Indicative budget (market estimate) |
|---|---|---|---|
| Scoping | Map user groups, roles, federated partners | 2 to 3 days | 2,000 to 3,200 CAD |
| OIDC integration (and SAML if needed) | Login, logout, token refresh | 4 to 8 days | 3,000 to 7,000 CAD |
| Role mapping | Entra groups to extranet permissions | 2 to 4 days | 1,400 to 3,500 CAD |
| SCIM provisioning | Automatic account creation and removal | 2 to 3 days | 1,000 to 2,800 CAD |
| Migrating existing accounts | Linking old accounts, communication | 1 to 2 days | 600 to 1,500 CAD |
| Total | 3 to 6 weeks | 6,000 to 18,000 CAD |
A project manager's tip: keep a local break-glass account, protected by a FIDO2 key, so you can still reach the extranet if the identity provider goes down.
Mini case study
Daniel, CISO of a 500-employee hydraulic equipment maker in Mississauga, opens the extranet to 350 employees and 220 partners. Support handles 90 password tickets per month at 15 minutes each, 22.5 hours. He picks OIDC on Entra ID, B2B guests for partners and SCIM for staff: 13,500 CAD integration, no extra licence since staff already have Microsoft 365 E3. With 60% fewer tickets he saves 13.5 hours per month, about 945 CAD at 70 CAD per loaded hour, or roughly 11,300 CAD per year. Payback comes in about 14 months, before counting the risk removed by deactivating former partners' accounts.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Our staff have Microsoft 365: is MFA already paid for?
Basic MFA is included in Entra ID Free and Microsoft 365. Conditional access, which enforces MFA by location or device, requires Entra ID P1, about 8 CAD per user per month, included in Microsoft 365 E3.
How long to connect a partner with its own IdP?
One to 3 days if the partner provides its SAML or OIDC metadata quickly. The real delay usually depends on their IT team, sometimes 2 to 4 weeks.
Do we need to rebuild the extranet to add SSO?
No, in about 90% of cases the authentication module is replaced without touching the rest. A very old application with tangled authentication may need 3 to 5 extra days.
Does SSO help with Canadian privacy obligations?
Yes. PIPEDA and Ontario guidance expect safeguards proportionate to data sensitivity, and MFA with access reviews through SCIM is concrete evidence of those safeguards in an audit.
Is SMS-based MFA good enough?
It beats nothing, but it is exposed to SIM-swap fraud and costs a few cents per message. An authenticator app is free and safer.
Let's scope your project. Tell us your identity provider, how many employees and partners to connect and your current extranet: we price the SSO integration, MFA and timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
