The verdict in three sentences
On a portal open to external customers, multi-factor authentication (MFA) stops being optional after a first account takeover attempt: according to Microsoft, it blocks more than 99% of automated password attacks. The right choice in 2026 combines passkeys or an authenticator app by default, with SMS OTP as a fallback only, to keep recurring costs low. Budget EUR 3,000 to 12,000 excl. VAT for integration and 2 to 6 weeks depending on the state of your identity layer.
MFA methods compared for a customer portal
A customer portal is not an intranet: your users are not trained, use their own phones and give up quickly if logging in becomes painful. The method you choose drives security, recurring cost and support ticket volume.
| Method | Phishing resistance | Unit cost 2026 | User friction | Recommended use |
|---|---|---|---|---|
| SMS OTP | Low (SIM swap, interception) | EUR 0.04 to 0.08 per message | Low | Fallback only |
| Email OTP | Low | Near zero | Medium | Account recovery |
| TOTP app (Google, Microsoft Authenticator) | Medium | EUR 0 | Medium at enrolment | Regular customers |
| Push notification | Medium (MFA fatigue) | EUR 0 to 3 per user per month depending on vendor | Low | In-house mobile apps |
| Passkeys (FIDO2 / WebAuthn) | Strong | EUR 0 | Very low once created | Default method in 2026 |
| FIDO2 hardware key | Very strong | EUR 25 to 60 per key | Medium | Admin accounts |
The practical recommendation: offer a passkey at first login, a TOTP app as the alternative, and keep SMS only for customers with nothing else. Across 3,000 customers, this approach often brings SMS below 20% of logins.
Integration budget and recurring cost
Cost depends mostly on your starting point: a home-grown login written ten years ago, or an identity provider (Auth0, Microsoft Entra External ID, Keycloak, Supabase Auth) already in place.
| Item | 2026 range (order of magnitude) | Comment |
|---|---|---|
| Audit of the existing login flow | EUR 1,000 to 2,500 excl. VAT | Sessions, password reset, APIs |
| MFA on an existing identity provider | EUR 3,000 to 6,000 excl. VAT | Configuration, screens, tests |
| MFA on home-grown authentication | EUR 6,000 to 12,000 excl. VAT | WebAuthn, TOTP, account recovery |
| External identity provider licence | EUR 0.02 to 0.25 per active user per month | Free below some thresholds |
| SMS OTP for 3,000 customers (2 logins a month, 20% SMS) | EUR 50 to 100 per month | At 100% SMS: EUR 240 to 480 |
| User support in the first month | 10 to 30 h | Plan a FAQ and a recovery flow |
The most underestimated item is account recovery: a customer who changes phone must be able to regain access without calling support, otherwise customer service absorbs the security gain. Provide printable backup codes and stronger identity checks for resets.
Rollout plan in 2 to 6 weeks
| Week | Deliverable | Main risk |
|---|---|---|
| 1 | Audit, method choice, screen mock-ups | Underestimating API access and integrations |
| 2 to 3 | WebAuthn, TOTP and SMS fallback development | Older browser compatibility |
| 4 | Security tests and recovery flow | Bypass through password reset |
| 5 | Progressive rollout to 10% of customers | Rise in support tickets |
| 6 | General rollout, mandatory MFA for sensitive accounts | Login abandonment |
Roll out on a voluntary basis first, measure adoption, then make MFA mandatory for risky actions: changing bank details, exporting data, adding a user. This risk-based approach avoids locking out every customer on the same day.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Illustrative scenario: Claire, CISO of a mid-sized manufacturer in Lyon, runs an ordering portal used by 3,000 business customers. After detecting a takeover attempt on a buyer account, she prices two options.
Option A, 100% SMS: EUR 4,000 excl. VAT integration, then 3,000 customers x 2 logins x EUR 0.06 = EUR 360 per month, or EUR 4,320 a year. Option B, passkeys and TOTP with SMS fallback: EUR 8,000 excl. VAT integration, SMS limited to 20% of logins, so EUR 72 per month and EUR 864 a year. Over three years, option A costs EUR 16,960 and option B EUR 10,592, with much stronger phishing protection. Claire picks option B.
FAQ
Is SMS MFA still acceptable in 2026?
It is much better than a password alone, but it is vulnerable to SIM swapping. Use it as a fallback and prefer passkeys or TOTP, which cost nothing per login versus EUR 0.04 to 0.08 per SMS.
Should MFA be mandatory for every customer from day one?
No, a progressive rollout over 4 to 6 weeks limits drop-off. Start with admin accounts and sensitive actions, then generalise once adoption passes 60 to 70%.
Do passkeys work on every device?
They are supported by recent versions of iOS, Android, Windows and macOS, which covers the vast majority of devices in 2026. Keep TOTP or SMS for the 5 to 10% of users on older equipment.
Is MFA required by regulation?
GDPR requires security measures proportionate to risk, and the NIS 2 directive tightens these requirements for covered entities. After an incident, not having MFA on an exposed portal is hard to justify to a data protection authority.
How long for a portal already on Auth0 or Entra?
Plan 2 to 3 weeks and EUR 3,000 to 6,000 excl. VAT, since most of the work is configuration and screens. Home-grown authentication usually needs 4 to 6 weeks.
Let's scope your project. Send us your current login architecture and number of active customers: we will price the MFA integration, recurring cost and rollout plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
