Get a used /cheap phone or tablet, only turn it on or enable wifi when you need the app. Don't use it for anything else. I think that covers all the bases.

Declare yourself a member of The Church of Emacs and claim your religious rights are being violated.

While it’s not technically safer, MS does make it a lot easier to set policy’s where you check a box for MSAuth.

Since the config is less complex and easier, it’s demonstratably safer to implement it this way.

I managed to get around the MS auth app and am using aegis right now.

If you're in the US, that could very well get you fired in any "at will employment" state. It's shitty, fucked up, and should be illegal, but the legislators seem to represent wealthy corporations way more than they represent their human constituents (GOP especially).

You can just use FreeOTP

My company has the same policy

We let anyone use any authentication app. The Microsoft one is the best one. I'm pushing to make us exclusive because I'm sick of the IT support guys trying to support a dozen apps. You don't have to use your Microsoft account provided to use the app or back up your credentials.

I used bluestack to emulate android and us MS Auth when I had no choice.

It's a waste of space, but it doesn't go on your phone at least

Authentication methods in Entra ID (which is presumably what we are talking about as the identity provider) include Microsoft Authenticator and software otp.

Authenticator is push authentication, as described elsewhere here. If for some reason you're not getting push notifications, you can use an OTP code instead, but this still requires that you have push authentication configured in Microsoft Authenticator.

You can only use Software OTP in other applications if your administrator has explicitly allowed use of Software OTP as an authentication method, and also excluded you from being required to use Authenticatior - otherwise Authenticatior would always 'win' as choice of mechanisms because it is more secure.

Several states in the USA require that employees who are made to use their personal phone for business purposes be compensated. The enforcement method and process for requesting same is naturally very obscure.

If MS Authenticator still works with totp urls just like any other authenticator then you can just use some open source authenticator. Some password managers even have one built it.

You have the right not to use your personal hardware for work, and the employer must provide the necessary equipment to accomplish your job.

Ask if you could get a hardware token (ie: Yubikey Security Key) instead of using Microsoft Authenticator to fulfill the security requirements. It's low cost and doesn't require a subscription unlike a cellphone plan.

Lots of great conversation here, I also work somewhere where this is required. If I didn't need my phone for access to chat, I just wouldn't use it for work. Alternatively, my phone has a work profile so I use that for any work related or non-FOSS apps. My IT guy even approved of my methods and said do the minimum and never more with tech.

Grab the shelter app from f Droid, add the Play store in shelter, move over to the work side Play store and install the authenticator.

Pause your work apps except for when you need to use the authenticator.

Prosper???

If your company is enforcing geographic location as a security qualifier then MS Authenticator can poll your device. Also you can use push authentication with the MS suite.

You can't just have microsoft text you a code? That's what I do

What is your concern about installing MS Authenticator.

I mean I can understand the principle of being forced to install anything on your phone.

But just stepping into the practical for a second: What do you worry will happen by installing this app to your phone?

At what point can you tax deduct your phone as a business expense?

And here I am wishing they would come out with an authenticator watch app, so I didn't have to do all the work of taking my phone out of my pocket and swiping a few times.