The verdict in three sentences
For a 900-employee company, connecting each internal app to Microsoft Entra ID SSO with MFA costs EUR 5,000 to 15,000 per application, with a 3 to 6 week project. SCIM provisioning (automatic account creation and removal) adds EUR 3,500 to 7,000 but eliminates the top audit finding: accounts of former employees still active. Under NIS2, the question is no longer whether to do it but in which order to tackle your applications.
Why the CISO demands it now
Germany's NIS2 implementation act (NIS2UmsuCG) brings a large share of mid-sized industrial and service companies into scope as "important" or "essential" entities. It requires least-privilege access management, strong authentication and traceable logins. A business app built five years ago with its own username/password form becomes a weak spot: reused passwords, no MFA, accounts never disabled.
| Current situation | Risk | What Entra ID SSO fixes |
|---|---|---|
| App-specific username/password | Reuse, phishing | Central authentication + MFA |
| Manually created accounts | Orphan accounts after departure | Automatic SCIM provisioning |
| No usable login log | NIS2 non-compliance | Entra sign-in logs exportable to the SIEM |
| Permissions managed inside the app | Privilege creep | Roles driven by Entra groups |
| Access from any device | Data leakage | Conditional access (managed device, country, risk) |
| Password resets by the helpdesk | Cost and delay | Entra self-service password reset |
Detailed 2026 budget
Cost depends mostly on the app's condition: a recent Node.js, .NET or Next.js app integrates with OIDC in a few days; a legacy app with permissions tangled into the code needs more rework. Berlin rates run about 20 % above Nantes.
| Item | 2026 range (excl. VAT) | Duration |
|---|---|---|
| OIDC integration on a recent app | EUR 5,000 to 8,500 | 1 to 2 weeks |
| SAML integration or auth module rewrite on a legacy app | EUR 8,500 to 15,000 | 2 to 4 weeks |
| SCIM provisioning (create, update, deactivate) | EUR 3,500 to 7,000 | 1 to 2 weeks |
| Mapping app roles to Entra groups | EUR 2,000 to 5,000 | 3 to 5 days |
| Testing, security acceptance and documentation | EUR 2,000 to 3,500 | 1 week |
| Entra ID P1 licence (conditional access) | about EUR 6/user/month | Often included in Microsoft 365 E3/Business Premium |
Watch out: check licences before budgeting. If the company already runs Microsoft 365 E3 or Business Premium, Entra ID P1 is included and the licence surcharge is zero. Otherwise, for 900 users, expect about EUR 64,800 per year, to be negotiated with your reseller.
Mini case study
Julia, CISO of a 900-employee food manufacturer in Berlin, lists 5 custom internal apps: production planning, quality portal, expense management, sales tool and HR intranet. She prioritises the 3 apps exposing sensitive data. Budget: 3 OIDC integrations at EUR 7,000, 1 SAML integration at EUR 12,000 for the legacy production tool, and SCIM on all 4 at 4 × EUR 4,500, for a total of EUR 51,000, delivered in 10 weeks. Gains: the helpdesk handled 180 password tickets a month at EUR 30 fully loaded; a 40 % drop means 72 tickets avoided, EUR 2,160 a month or EUR 25,920 a year. The project pays back in two years on that line alone, before counting the reduced incident risk, whose average cost for a mid-sized company runs into hundreds of thousands of euros.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
How much does Entra ID SSO integration cost for a custom app?
Budget EUR 5,000 to 15,000 depending on the app's age and protocol (OIDC or SAML). SCIM provisioning adds EUR 3,500 to 7,000.
OIDC or SAML: which one?
OIDC is the modern standard, simpler to implement and suited to recent web and mobile apps. SAML remains relevant for legacy apps or vendors that only support it, at 30 to 50 % higher integration cost.
Is SSO enough for NIS2 compliance?
No, but it covers a large part of the access-control requirements: MFA, account lifecycle and logging. NIS2 also requires risk analysis, an incident response plan and supplier management.
Do we need an Entra ID P1 licence?
Basic SSO works with Entra ID Free, but conditional access requires P1, about EUR 6 per user per month. It is included in Microsoft 365 E3 and Business Premium.
How long does a project for 5 apps take?
Between 8 and 12 weeks if apps are handled in waves, starting with those exposing personal or financial data.
Let's scope your project. Send us your list of internal apps and your Microsoft licence level, and we will price SSO, MFA and SCIM integration app by app (indicative budget EUR 5,000 to 15,000 each, 3 to 6 weeks). Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
