The verdict in three sentences
For a lab with 1,100 staff across 3 sites, a single intranet app with Entra ID SSO and MFA can replace three or four scattered tools, provided traceability is designed in from the start. A realistic budget is 70,000 to 140,000 EUR excl. VAT, including 8,000 to 15,000 EUR for authentication and 6,000 to 12,000 EUR for penetration testing. What derails pharma projects is GxP validation: audit trails, electronic signatures and validation documentation must be budgeted up front, not bolted on.
Scope and cost
The app brings together three uses: reading current quality procedures, internal requests (purchasing, access, maintenance) with approval flows, and a directory linked to Active Directory.
| Module | 2026 order of magnitude (excl. VAT) | Comment |
|---|---|---|
| Discovery, risk assessment, URS | 7,000 to 12,000 EUR | User requirements expected under GxP |
| Entra ID SSO, MFA, conditional access | 8,000 to 15,000 EUR | Roles synced from AD groups |
| Quality document library | 15,000 to 30,000 EUR | Versions, distribution, read receipts |
| Internal requests and workflows | 14,000 to 28,000 EUR | 6 to 10 approval flows |
| Directory and org chart | 5,000 to 9,000 EUR | Microsoft Graph sync |
| Audit trails and e-signature | 9,000 to 18,000 EUR | 21 CFR Part 11 and EU Annex 11 style requirements |
| Pen test, validation, IQ/OQ pack | 12,000 to 28,000 EUR | Includes 6,000 to 12,000 EUR pen test |
| Total | 70,000 to 140,000 EUR | Excluding Microsoft licences |
Most labs already hold Microsoft 365 E3 or E5 licences, which makes conditional access and MFA available at no extra licence cost.
Security and traceability: the choices that matter
| Requirement | Minimum | Recommended for pharma |
|---|---|---|
| Authentication | SSO with app-based MFA | Phishing-resistant MFA (FIDO2) for quality roles |
| Sessions | 8 h expiry | 30 min idle timeout on GxP modules |
| Audit trail | Who, what, when | Before and after values, reason, server time, tamper-proof |
| Log retention | 1 year | Product lifetime plus 1 year |
| Hosting | EU cloud | EU cloud with customer-managed keys |
| Security testing | Automated scans | Annual pen test and code review |
Inspectors from the Dutch Health and Youth Care Inspectorate (IGJ) or the EMA do not ask for a specific tool: they ask for proof that it is validated, access is controlled and every change is traced. As an essential or important entity under NIS2, the lab must also document these controls. Our cybersecurity practice covers this part, and the build is a high-complexity custom web application, quoted on request.
Typical 5 to 7 month plan
Month 1: discovery, risk assessment and specifications. Months 2 to 4: build in two-week increments, with demos to quality leads on each site. Month 5: pen test, fixes and qualification. Month 6: rollout on the first site, then the other two. A seventh month is often needed if migration of the 1,500 to 3,000 existing procedures was not planned early.
Choosing the right partner
Pharma intranet projects fail more often on process than on technology. When comparing suppliers, ask for three things: a sample validation pack (URS, risk assessment, test scripts) from a previous GxP project, the list of people who will actually work on your app, and their approach to change control once the app is live. Every release after go-live must be assessed for GxP impact, documented and approved by quality assurance, which typically adds 1 to 3 days per release. A supplier that cannot explain this cycle will cost you more during your next inspection than it saved you at contract signature. Also check that the supplier accepts your own SOPs for incident management and that support staff can be named in your access control matrix.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Pieter, CISO of an Amsterdam lab with 1,100 staff, counts three tools (an ageing DMS, a request spreadsheet, a separate directory) and about 900 password reset tickets a year at 25 EUR each, i.e. 22,500 EUR.
With SSO he targets 70% fewer tickets, saving 15,750 EUR per year. Staff lose an average of 10 minutes a week searching for procedures: across 1,100 people and 45 weeks at a 45 EUR loaded hourly cost, that is 371,250 EUR per year; halving it is worth about 185,600 EUR. For a 115,000 EUR app, payback comes within a year, before counting the retired DMS licence (around 18,000 EUR per year).
FAQ
Does an intranet need full GxP validation?
Only the modules touching quality procedures and signatures fall under validation. A risk-based approach limits the pack to those modules and cuts validation cost by 30 to 40%.
Why is SMS-based MFA not enough?
SMS is exposed to SIM swap attacks. For quality and admin accounts, FIDO2 keys at 40 to 60 EUR each are recommended.
What does the pen test cost?
Plan 6,000 to 12,000 EUR excl. VAT for 5 to 10 days of testing on the app and its authentication. Repeat it yearly or after any major change.
Can we host the app in our own Azure tenant?
Yes, it is often the simplest route for Entra ID integration, using the West Europe region in the Netherlands. Hosting runs 400 to 1,200 EUR per month depending on redundancy.
How long does migrating existing procedures take?
For 2,000 documents, allow 4 to 6 weeks with a migration script and a 10% sample check.
Let's scope your project. We define modules, authentication, traceability requirements and a 5 to 7 month plan agreed with your quality assurance team. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
