Identity security with push-based MFA, device posture checks, and adaptive access policy — broadly the most-deployed enterprise MFA, and for good reason. The differentiator isn't the auth protocols (everyone has those); it's the user experience and the breadth of integrations. Duo had its own brand equity before Cisco acquired it and still does — for legitimate reasons.
Duo handles the identity layer of Zero Trust: MFA, device trust, and adaptive access policy. The push-MFA UX is meaningfully better than SMS or hardware tokens — which sounds trivial but is the difference between an MFA program that ships company-wide and one that gets exceptions carved into it forever. Device posture (corporate vs personal, OS patch level, security agent presence) feeds into per-session policy decisions.
You're retiring SMS MFA, retiring legacy hardware tokens, and you want one MFA platform across the SaaS estate and your remote access. Duo is the default winner here.
Duo + Entra is a frequently-paired combination. Adaptive access on top of Microsoft identity is the strongest play in this category for M365 customers.
Duo coexists with Okta and others, but if you've already standardized on a different identity platform that has its own strong MFA, the value-add narrows.
If your problem is network-layer access control rather than authentication, Appgate is the right brief — Duo is at a different layer.