The verdict in three sentences
If your SME already runs Microsoft 365, connecting internal apps to Entra ID costs EUR 5,000 to 11,000 in total and removes local accounts, multiple passwords and forgotten deactivations when someone leaves. MFA and conditional access are already paid for if you are on Microsoft 365 Business Premium (EUR 20.60 per user per month, excluding VAT). The most underestimated workstream is group-based role management, which turns the directory into the single source of application permissions.
What the SSO integration costs in 2026
| Component | 2026 budget | Timeline | Content |
|---|---|---|---|
| OpenID Connect integration (SSO login) | EUR 3,000 to 7,000 | 1 to 2 weeks | app registration, authorisation flow, session, logout |
| App roles via Entra ID groups | EUR 2,000 to 4,000 | 1 week | group-to-role mapping, per-screen permissions |
| Automatic provisioning (SCIM) | EUR 2,500 to 5,000 | 1 to 2 weeks | real-time account creation and deactivation |
| Migration of existing local accounts | EUR 1,000 to 3,000 | 3 to 5 days | matching by email, duplicate clean-up |
| Sign-in logging and alerts | EUR 800 to 2,000 | 2 to 4 days | traceability required by audits |
| Total per app (without SCIM) | EUR 5,000 to 11,000 | 2 to 4 weeks | 2026 order of magnitude |
| Additional app reusing the foundation | EUR 1,500 to 3,500 | 1 week | shared authentication module |
Cost per app drops sharply from the second one: the authentication module and role logic are reused.
Microsoft licences: what you already pay for
| Microsoft 365 plan | 2026 price per user per month (EUR, excl. VAT) | Entra ID included | MFA | Conditional access |
|---|---|---|---|---|
| Business Basic | EUR 5.60 | Free | yes, security defaults | no |
| Business Standard | EUR 11.70 | Free | yes, security defaults | no |
| Business Premium | EUR 20.60 | P1 | yes | yes |
| Entra ID P1 standalone | about EUR 5.60 | P1 | yes | yes |
| E3 | EUR 33.75 | P1 | yes | yes |
OpenID Connect SSO works with all these plans. Conditional access (blocking sign-ins from abroad, requiring a managed device) needs Entra ID P1, included in Business Premium. Indicative public prices, subject to your reseller and commitment term; USD list prices differ by region.
Steps for a clean rollout
- Inventory: list internal apps, their local accounts and roles. A 250-seat SME often has 4 to 8.
- Entra ID groups: create one group per app role (for example "App-Purchasing-Approver"). Permissions follow group membership.
- Pilot: switch a team of 10 to 20 people for a week before general rollout.
- Break-glass account: keep a protected, documented local admin account in case of a Microsoft incident.
- Leaver process: disabling the Microsoft 365 account immediately cuts access to every connected app. Check it during testing.
Mini case study
Daniel, IT manager of a 250-seat manufacturing SME near Lyon, runs 5 internal apps with local accounts. His support desk gets 45 tickets a month about passwords and access, 15 minutes each, i.e. 11 hours. Each leaver needs 20 minutes of manual deactivation across 5 tools, with 4 leavers a month.
He goes for SSO on the first app at EUR 8,000, then EUR 2,500 for each of the next 4, i.e. EUR 18,000. The company is already on Business Premium. After cut-over, tickets fall to 10 a month. Gain: about 10 support hours a month at EUR 45 an hour, i.e. EUR 5,400 a year, plus the end of former employees still having access. Meeting the cyber insurer's requirement for MFA on every app weighed as much as the time calculation.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Do I need Microsoft 365 Business Premium for SSO?
No, OpenID Connect SSO works with Entra ID Free included in every plan. Business Premium (EUR 20.60 per user) adds conditional access and Entra ID P1, useful for a complete security policy.
How long does integrating one app take?
2 to 4 weeks for the first one, testing and pilot included. Following apps take about a week each thanks to the shared module.
Can we keep external accounts (contractors, customers)?
Yes, through Entra ID B2B guests or a second identity provider. The first 50,000 monthly active external users are free in Entra External ID under Microsoft's 2026 terms.
What if Microsoft is down?
Open sessions stay valid for a few hours depending on configuration. A local break-glass account lets you administer the app during the incident.
Is SCIM essential?
Not for a 250-seat SME: group-based roles are enough in most cases. SCIM (EUR 2,500 to 5,000) pays off above 20 staff movements a month.
Let's scope your project. List your internal apps and your Microsoft 365 plan: we will price SSO, role management and the cut-over calendar per app. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
