SSO and MFA Integration Cost for a Business Web App in Berlin (2026)

The verdict in three sentences

When a CISO mandates Microsoft Entra ID and multi-factor authentication (MFA) for every internal application, each custom business app must be connected via SAML 2.0 or OpenID Connect, at a Berlin market cost of 6,000 to 18,000 EUR per application and 3 to 6 weeks. Reworking role management often adds 4,000 to 10,000 EUR, but it is what removes orphan accounts and excessive rights. With the NIS2 directive now applying to essential and important entities in Germany, this project moves from nice-to-have to documented obligation.

Why a Berlin mid-sized company cannot wait any longer

A mid-sized industrial or logistics company in Berlin or Brandenburg often runs 6 to 15 internal applications: supplier portal, production management, expenses, quality tool, intranet. Each has its own credentials, and a departing employee leaves active access for weeks.

NIS2, transposed into German law, covers thousands of mid-sized companies in manufacturing, transport, energy and food. It requires access management and strong authentication measures proportionate to risk, with direct accountability for management.

Integration budget per application and per component

The gap between 6,000 and 18,000 EUR comes down to the state of the code. A recent app on a modern framework integrates quickly. A legacy app with a home-grown user table, hard-coded rights and several entry points (web, API, exports) needs real refactoring.

Pitfalls to avoid

• Keeping a local fallback account without MFA: it is the first door attackers use.
• Forgetting APIs and service accounts, which must move to short-lived OAuth tokens.
• Not mapping roles to Entra ID groups, which brings back manual rights management.
• Relying on SMS-only MFA: authenticator apps or FIDO2 keys are far more robust.

Mini case study

Illustrative example: Jonas, CISO of a 650-employee logistics company in Berlin, must connect 8 internal applications before the NIS2 audit. He budgets 4,000 EUR for the audit, an average of 10,000 EUR per application (80,000 EUR) and 15,000 EUR of role redesign on the 3 most sensitive apps, 99,000 EUR in total.

On the other side, he counts 1,400 password tickets a year at 22 EUR, or 30,800 EUR, cut by 80%, and 2 days a month of manual access reviews avoided, about 12,000 EUR a year. The direct gain is about 36,600 EUR a year, with payback in roughly 2 years and 8 months, not counting the lower risk of an incident, whose average cost for a mid-sized company runs into hundreds of thousands of euros.

FAQ

Should we choose SAML or OpenID Connect?

OIDC is simpler and better suited to modern web apps and APIs, while SAML remains common in older software. Entra ID supports both, and the integration cost gap rarely exceeds 1,000 to 2,500 EUR.

How long does it take to connect one application?

Plan 3 to 6 weeks per application, testing included. In a batch of 5 to 8 apps, standardization cuts the average timeline by about 30%.

Is Entra ID P1 enough?

P1, at about 6 EUR per user per month, includes conditional access, which covers most NIS2 needs. P2 adds risky sign-in detection and privileged identity management, useful for administrators.

What happens if Entra ID is unavailable?

Microsoft targets 99.99% availability, but a break-glass account protected by a FIDO2 key and held in escrow must be in place. Auditors also expect a documented emergency access procedure.

Can external contractors sign in with their own account?

Yes, through Entra ID B2B, generally at no extra cost for the first 50,000 monthly active external users. Their access can expire automatically when the contract ends.

Let's scope your project. Send us the list of your internal apps, your directory and your NIS2 requirements: we will define the scope, an indicative budget per application and the timeline, then send you a free quote. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.