Senegal SME MFA deployment: Google Authenticator vs Microsoft vs Duo complete guide (2026)

MFA in Senegal SMEs 2026: the non-negotiable baseline

Out of 100 Senegal SME incidents 2024-2025 I've seen: 78% would have been prevented by widespread MFA. CFO phishing handing over Gmail password → Drive exfiltration in 4 minutes. Without MFA.

MFA = Multi-Factor Authentication. Second factor on top of password (something you know + something you have or are). Cost: usually free or 1-6 EUR / user / month by tool.

ROI: blocks 99.9% of credential-based attacks (Microsoft 2024). Cybersecurity measure #1 for SMEs.

H2: The 3 MFA types (least to most secure)

1. SMS / Email OTP

• 6-digit code via SMS or email.
• Pros: zero app to install.
• Cons: SIM swapping (criminal hijacks your number), SMS interception, email compromise = MFA broken.
• Verdict: Avoid for critical accounts. Acceptable fallback consumer only.

2. TOTP (Time-based One-Time Password) — RFC 6238

• App generates 6-digit code / 30 seconds (based on shared secret).
• Apps: Google Authenticator, Microsoft Authenticator, Authy, 2FAS, 1Password / Bitwarden (integrated).
• Pros: offline, free, open standard.
• Cons: phishable (user can type code on fake site), phone loss = recovery.

3. Push / FIDO2 / Passkey

• Push notification: Duo, Microsoft Authenticator ("Approve?" notification on phone).
• FIDO2 / WebAuthn: YubiKey, Apple Touch ID, Windows Hello. Hardware-stored crypto key, unphishable.
• Passkey: 2024+ standard, synced iCloud / Google. Replaces password.
• Verdict: Prioritize for admin, dev, finance accounts.

H2: 2026 MFA tools comparison

Google Authenticator

• Price: free.
• Type: TOTP only.
• Pros: ultra-simple, Google cloud sync (since 2023). Works everywhere (Gmail, Workspace, Facebook, GitHub).
• Cons: no push, no centralized admin management.
• For: individuals, TPE < 10 employees.

Microsoft Authenticator

• Price: free (Microsoft 365 integrated).
• Type: TOTP + Push + number matching (anti-fatigue) + Passkey.
• Pros: centralized management via Entra ID, conditional access, mandatory number matching 2023+.
• Cons: best in Microsoft 365 ecosystem.
• For: SMEs on Microsoft 365 / Entra ID.

Duo Security (Cisco)

• Price: Duo Essentials 3 EUR/user/month, MFA 6 EUR/user/month, Premier 9 EUR/user/month.
• Type: Push + TOTP + FIDO2 + SMS fallback.
• Pros: very powerful conditional access (by device, IP, geo), top-tier reporting, VPN/SSH/RDP/AnyConnect integration.
• Cons: price.
• For: SMEs 25+ employees, banks, regulated sectors.

Authy (Twilio)

• Price: free individual, paid business.
• Type: TOTP + multi-device sync.
• Pros: best cross-device sync historically.
• Cons: Twilio announced desktop app end in 2024.
• For: reconsider in 2026.

1Password / Bitwarden integrated

• Price: included in plan (cf password manager article).
• Type: TOTP integrated to vault.
• Pros: 1 app for password + 2FA.
• Cons: vault compromise = password + 2FA lost. For critical accounts, separate.
• For: daily non-critical account use.

H2: Conditional Access (the real power)

Beyond "MFA on / off", configure contextual policies:

• MFA mandatory if IP outside Senegal (login from Russia = MFA + SOC alert).
• MFA not required if device "compliant" (managed company laptop Intune/Jamf + up to date).
• Block if risky country (North Korea, certain regions by context).
• Force re-auth every 8h for admins.
• MFA + FIDO2 mandatory for patient data access (clinic), financial data (bank).

Tools: Microsoft Entra Conditional Access (included Entra ID P1, ~5.4 EUR/user/month), Google Workspace Context-Aware Access (Enterprise), Okta Adaptive MFA, Duo Beyond.

H2: Pitfalls to avoid

1. MFA fatigue attack

Attacker triggers 50 push notifs/hour. Frustrated user clicks "Approve" to stop. Solution: number matching (user must type number shown on login screen) — Microsoft Authenticator, Duo have it since 2023.

2. Poorly handled recovery codes

Recovery codes (10 single-use codes) stored in... the password manager vault protected by MFA. Vicious circle. Solution: printed recovery codes + physical safe.

3. Exclusions too broad

"We exclude the CEO from MFA, it's annoying for him." CEO is target #1 (whaling). Solution: MFA mandatory for ALL, especially CEO/CFO.

4. No phone-loss plan

Employee loses iPhone. No more TOTP. Full reset = 2h IT. Solution: recovery codes + 2nd registered device + backup FIDO2 key.

5. SMS as only fallback

See section 1. SMS bypassable via SIM swap (technically feasible in Senegal). Prefer recovery codes or FIDO2 key.

H2: 30-day MFA deployment roadmap, 20-employee SME

• D1-3: tool selection (recommendation: if Microsoft 365 → Microsoft Authenticator + Entra Conditional Access P1; else → Duo Essentials).
• D4-7: IT + management pilot (4-6 people). Test workflows, recovery.
• D8-15: wave 1 rollout (admins, devs, finance). Communication + 30 min training/group.
• D16-25: wave 2 rollout (sales, HR, operations).
• D26-30: audit (who hasn't activated?), force activation, conditional access live.

H2: 20-user SME costs (annual)

Reco 20-person Senegal SME not on Microsoft 365: Duo Essentials 720 EUR/year = 60 EUR/month = ~40 KFCFA/month. Unbeatable.

FAQ

TOTP or Push? Which to choose?

Push (Microsoft Auth, Duo): better UX, anti-phishing via number matching. TOTP: universal standard, works offline, free. SME: start TOTP everywhere then migrate Push for admins/finance.

FIDO2 / YubiKey worth it?

For admin / dev / finance / leadership accounts: yes. ~30-55 EUR / key, lasts 5-10 years. Unphishable (cryptographic domain validation). For rest of company: TOTP enough.

Does MFA slow users down?

TOTP: +5 seconds login. Push: +3 seconds. FIDO2: +1 second (touch). Acceptable if applied smartly (not every 30 min, rather per 8h session or device trust).

Which accounts MFA in priority?

• All admin accounts (cloud, AD, GitHub). 2. Finance/banking accounts. 3. CEO/CFO mailbox (whaling target). 4. All critical SaaS (CRM, Drive, Slack). 5. Rest of company. Goal 100% in 30 days.

Is MFA bypassable?

Push fatigue + social engineering = yes (Uber 2022 case). FIDO2/Passkey: no, cryptographically phishing-resistant. For truly critical accounts: FIDO2 mandatory.

Let's discuss your case

If you want to deploy MFA in your Senegal SME in 30 days, we can run the project and train the teams. WhatsApp +221 77 596 93 33.