The verdict in three sentences
Integrating Microsoft Entra SSO into an internal app costs between USD 4,000 and 12,000 per app in New York in 2026, plus about USD 5,000 for automated SCIM provisioning. For a 700-employee company, the most visible gain is the near disappearance of the 20 % of help desk tickets tied to passwords, and the most important one is instant access revocation when someone leaves. The realistic timeline is 2 to 4 weeks per app, including acceptance testing and account cutover.
OIDC, SAML, SCIM: what you are actually buying
The CISO says "SSO", but pricing depends on the protocol and the state of the app. A recent Node or .NET app accepts OIDC in a few days; a 2012 PHP app with its own user table needs deeper work.
| Component | Role | Indicative 2026 cost (USD) | Timeline |
|---|---|---|---|
| OIDC login (recent app) | Authentication via Entra ID | 4,000 to 6,000 | 1 to 2 weeks |
| SAML 2.0 login (legacy app) | Authentication via Entra ID | 6,000 to 9,500 | 2 to 3 weeks |
| Local account rework | Link existing accounts to Entra identities | 2,000 to 2,500 | 1 week |
| MFA and conditional access | Policy by group, location, device | Included in Entra, 700 to 1,300 setup | 2 to 3 days |
| SCIM provisioning | Automatic account creation and removal | 5,000 | 1 to 2 weeks |
| Role mapping from Entra groups | App permissions driven by the directory | 1,300 to 3,300 | 3 to 5 days |
| Logging and alerts | Sign-in traceability for audits | 1,000 to 2,000 | 2 to 3 days |
A full integration on a legacy app (SAML, account rework, role mapping, logging) therefore reaches the top of the range, around USD 12,000 excluding SCIM.
Microsoft licenses and prerequisites
Basic SSO works with Entra ID Free, included with Microsoft 365. Conditional access and risk-based MFA require Entra ID P1, included in Microsoft 365 E3 and Business Premium, or sold for about USD 6 per user per month. SCIM provisioning to a custom app is available from P1.
| Setup | Required license | License cost for 700 users |
|---|---|---|
| Basic SSO, default MFA | Entra ID Free | USD 0 |
| SSO + conditional access + SCIM | Entra ID P1 | About USD 50,400 per year if not included |
| Risk-based identity protection | Entra ID P2 | About USD 75,600 per year if not included |
| Company already on Microsoft 365 E3 | P1 included | USD 0 extra |
Check your Microsoft 365 agreement before pricing: most mid-size New York firms in finance and professional services already run E3, so P1 is already paid for.
Mini case study
Sarah, CISO of a 700-employee financial services firm in New York, must connect 6 business apps to Entra ID after an NYDFS Part 500 review. The help desk handles 6,000 tickets a year, 20 % of them password-related, at an internal cost of USD 30 per ticket.
- Investment: 4 recent apps on OIDC at USD 5,300, 2 legacy apps on SAML at USD 11,300, plus SCIM at USD 5,000. Total: 21,200 + 22,600 + 5,000 = USD 48,800.
- Licenses: P1 already included in Microsoft 365 E3, USD 0 extra.
- Help desk gain: 1,200 password tickets a year, cut by 75 %, i.e. 900 tickets and USD 27,000 saved per year.
- Security gain: accounts disabled within 15 minutes of an employee leaving, versus 3 to 10 days before.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Payback on help desk savings alone: about 22 months, a 2026 order of magnitude. Lower orphan-account risk and regulatory compliance justify the rest.
FAQ
Do we need to rewrite the app to add SSO?
No. The login page is replaced by an OIDC or SAML redirect and existing accounts are linked to Entra identities. The rest of the app stays the same, for USD 4,000 to 12,000.
OIDC or SAML?
OIDC for any recent or mobile app, since it is simpler and cheaper. SAML for legacy apps or vendors that only support it, with 1 to 2 extra weeks of work.
What if Entra ID goes down?
Microsoft commits to 99.99 % availability. We also set up a protected, logged local break-glass account for 2 administrators at most.
Is SCIM essential?
Not to start, but it automates account creation and removal. For 700 employees and 10 % turnover, it avoids about 70 manual deactivations a year.
How long for 6 apps?
In parallel, 6 to 10 weeks. Each app takes 2 to 4 weeks, including acceptance testing with a pilot group of 20 users.
Let's scope your project. List your internal apps, their tech stack and your Microsoft 365 license, and we will price the integration app by app with a cutover plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
