Single sign-on (SSO) with Microsoft 365 or Google

Your teams juggle dozens of passwords, and every time someone leaves, access has to be closed tool by tool. Single sign-on (SSO) solves that: the business app hands identity checks over to Microsoft 365 or Google Workspace. Here is how I set it up, what it costs, and the decisions to make before development.

How single sign-on works

The principle is simple. When an employee clicks “Sign in with Microsoft” or “Sign in with Google,” the app redirects them to their company’s sign-in page. Microsoft or Google verifies their identity (password, two-factor authentication), then sends the app a signed proof: who they are, their email address, sometimes their groups. The app never sees the password.

Two standard protocols do this job:

• OpenID Connect, built on OAuth 2.0: the most common choice for modern web apps. Google states that its OAuth 2.0 APIs conform to the OpenID Connect specification (Google Identity documentation, checked in October 2026).
• SAML 2.0: older, and still widespread in large organizations and corporate directories.

For a custom-built app, I prefer OpenID Connect, which is simpler to maintain. SAML remains an option when the client’s IT team requires it.

Microsoft 365 or Google: what changes

Sources: Microsoft Entra pricing, which lists “unlimited SSO across any SaaS app” for the Free plan and says it is included with Microsoft 365 subscriptions; Google Workspace help on custom SAML apps. Public prices checked in October 2026, billed per user per month with an annual commitment.

If your company uses both, the app can offer both buttons. I recommend planning for that during scoping: the extra cost is small at the start and much higher once the app is in production.

What SSO costs in a project

In a new project, single sign-on is part of the accounts and roles module, priced at $1,700 (€1,500)excl. VAT in the estimator. It comes on top of the base price of a business app, which is $6,800 to $22,400 (€6,000–€20,000)excl. VAT depending on scope.

What changes the workload:

1. The number of identity providers. Microsoft only, Google only, or both.
2. Reading group membership. Automatically assigning a role in the app based on the employee’s Microsoft or Google group takes a little more configuration, but saves you managing permissions by hand.
3. Automatic account creation. Either the account is created on first sign-in, or an administrator has to approve it first. The second option is safer for sensitive data.
4. External users. Customers, partners and subcontractors are not in your directory, so they keep a different sign-in method.

For an existing app, the cost depends on how authentication was built. I price it after an audit (express audit at $660 (€589)excl. VAT), because poorly structured authentication can require more rework than just adding a “Sign in with Microsoft” button.

What to settle with your IT team

SSO touches company security, so your IT department or managed service provider should be involved from day one. Here is what I get approved during scoping:

• who registers the app in Entra ID or the Google Admin console, and who keeps control of it;
• which accounts are allowed: the whole domain, or only certain groups;
• what information is shared: name, email, groups. Only what is needed, in line with the GDPR data minimization principle;
• how groups map to roles in the app;
• what happens when someone leaves: immediate deactivation, and what happens to their history.

Fine-grained permissions are covered in the page on role-based access, and account security in the page on two-factor authentication.

When SSO is not worth it

I do not recommend it by default. It adds little when:

• the app is mainly used by external customers or partners who are not in your directory;
• the company does not manage Microsoft 365 or Google Workspace centrally;
• there are few users and the app is not sensitive: email sign-in with two-factor authentication is enough.

On the other hand, once more than twenty or so employees use the tool, or your enterprise customers require strict access policies, SSO becomes a security and convenience argument that easily pays for itself.

Where to start

1. List the accounts: who needs to sign in, with which directory, and which profiles are external.
2. Bring your IT team to the free 30-minute discovery call.
3. During scoping, we settle the identity providers, the group-to-role mapping and the fixed quote.
4. During development, sign-in is tested with a test account in your directory before it opens to everyone.

For a first estimate of your app, including the accounts and roles module, the estimator gives you a range in one minute.