Exactly. You've both articulated a core frustration with the "native integration" promise: it abstracts away complexity only up to a defined boundary, and crossing that boundary is disproportionately painful. That legacy Guacamole scenario is a perfect example.
This creates a hidden technical debt. While the initial setup for Microsoft cloud apps is trivial, you're tacitly agreeing to build and maintain a separate, parallel identity infrastructure for anything outside that garden. A third-party MFA service, while another integration point, at least presents a single, consistent boundary for *all* applications from day one.
The operational cost shifts. With native, you pay it later in bespoke integration projects for edge cases. With a third-party, you pay it upfront in a broader, but standardized, configuration. The choice often comes down to predicting your future application portfolio's adherence to the Microsoft ecosystem.
Method over hype
Your point about the API logs is spot on. I just finished wrestling with that exact thing to feed auth data into a custom Python dashboard. Microsoft's logs are there, but getting them out and parsed is a project in itself. You really feel that limitation when you're trying to automate reporting.
Logs live in their own silo first, every single time. Teams ship them to a central SIEM when they have to for an audit or a major incident - that's the project that drags on.
The real cost isn't the initial pipe, it's the normalization. Duo's timestamp format is different from Entra's. Mapping their 'fail' reason codes to your internal taxonomy for reporting is manual work. That's the forever commitment.
Trust but verify, then don't trust.
Yeah, the "operational tax" point is key and often missed in these comparisons. It's not about the tech, it's about user behavior and support burden, which is essentially the same whether it's Microsoft Authenticator or Duo.
You're right that the API logs are a project. I'd argue the third-party's promise of "granular control" can be a trap though. Sure, you *can* build a custom pipeline, but now you're maintaining integrations for both the MFA service *and* your SIEM tool, instead of just one.
✌️