The verdict in three sentences
In a regulated group, an internal app without SSO and fine-grained access control is now blocked by security before it ever reaches production. The realistic 2026 budget: 3,000 to 10,000 EUR (about 3,300 to 11,000 USD) to connect an application to Entra ID (formerly Azure AD), plus 5 to 15 days for a clean RBAC role model and audit-ready logging. These costs are far below those of remediation after an incident or an inspection.
What the CISO will require, and why
Pharmaceutical and healthcare companies in Singapore operate under the Personal Data Protection Act, the Cyber Security Agency's Cyber Trust mark expectations, Health Sciences Authority GMP rules on computerised systems and, for many multinationals, group policies aligned with the EU's NIS 2. In practice, every internal app must prove who accessed what, when, and with which rights.
| Requirement | Baseline level | Hardened level (pharma, finance) | Indicative development effort |
|---|---|---|---|
| Authentication | SSO via OpenID Connect or SAML | SSO + MFA enforced by conditional access | 2 to 5 days |
| Account provisioning | Created at first login | SCIM sync, automatic deactivation on departure | 3 to 6 days |
| Rights model | 3 to 4 fixed roles | RBAC per site and department, with segregation of duties | 5 to 15 days |
| Logging | Logins recorded | Tamper-proof audit trail of sensitive actions, kept 5 years or more | 3 to 8 days |
| Access review | Manual, yearly | Quarterly export for manager review | 2 to 4 days |
| Electronic sign-off | None | Re-authentication when approving a batch or document | 4 to 8 days |
The most expensive part is not the SSO connection itself, often quick with a proven library, but the role model: you must map who does what in each department before writing any code.
Cost by security level
| Level | Content | 2026 development cost (market estimate) | Recurring cost |
|---|---|---|---|
| 1. Simple SSO | Entra ID login, basic roles | 3,000-5,000 EUR | Included in existing Microsoft 365 licences |
| 2. SSO + RBAC | Department roles, MFA, login log | 6,000-12,000 EUR | 0 to 6 EUR per user per month depending on identity provider |
| 3. Audit compliance | Fine RBAC, SCIM, tamper-proof log, access review | 12,000-25,000 EUR | Log storage 20 to 100 EUR per month |
| 4. GxP validated systems | Level 3 + e-signature + validation file | 25,000-50,000 EUR | Revalidation at every major change |
| Third-party identity provider (Okta, Auth0) | If no Entra ID | Integration included in levels above | 2 to 6 EUR per user per month |
For a group already on Microsoft 365 E3 or E5, Entra ID and conditional access are usually covered by existing licences: the extra recurring cost is close to zero. That is a strong argument for aligning every internal app on the same identity provider.
The mistakes that fail the audit
Three mistakes recur in apps built without security scoping. First, local 'backup' accounts with shared passwords: they cancel the whole benefit of SSO. Second, rights assigned to people rather than roles, impossible to review once headcount passes 100 users. Third, logs stored in the application's own database, editable by an admin, and therefore worthless as evidence.
Best practice: roles come from Entra ID groups, the app stores no passwords, and logs flow to write-only storage.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Wei Ling, CISO of a 450-employee pharmaceutical laboratory group in Singapore, must secure an internal quality deviation app used by 180 people. Chosen option: level 3, estimated at 18,000 EUR, with Entra ID already included in licences. Previously, the yearly access review took 12 managers half a day each, plus 4 days of consolidation by her team, around 10 person-days at 550 EUR, or 5,500 EUR a year. With automatic group-based exports it drops to 2 days, saving 4,400 EUR every year, not counting the avoided risk of a major inspection finding.
FAQ
How much does adding SSO to an existing app cost?
As an order of magnitude, 3,000 to 10,000 EUR depending on the app's architecture and number of roles. A well-structured app often connects in 2 to 5 days.
SAML or OpenID Connect?
For a modern web app, OpenID Connect is simpler and widely supported by Entra ID. SAML remains useful for older software or some providers; both take comparable effort.
Do we pay extra for Entra ID?
With Microsoft 365 E3 or E5, SSO and conditional access are usually included. Otherwise, Entra ID P1 costs about 6 USD per user per month.
How long should access logs be kept?
It depends on your policy and obligations: 1 year is a common minimum, 5 years or more for pharmaceutical quality data. Storage remains cheap, 20 to 100 EUR per month.
Is RBAC enough for compliance frameworks like NIS 2 or Cyber Trust?
It is an essential building block, not the whole picture. These frameworks also require incident management, backups and continuity measures, handled at group level.
Let's scope your project. Tell us your identity provider, number of users and audit requirements: we estimate SSO integration, the role model and logging, with scope, indicative budget and timeline through our quote form. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
