But MS Authenticator isn’t a normal 6-digit Authenticator; it scans your Face ID (or finger print) and in many cases (like my work) it can be support password less accounts (relying only on something you have and something you are).

And in regard to your point that you don’t want to install apps you don’t need, it sounds like you do in fact need this app.

🤷‍♀️

reasons why restricting users to MS Authenticator would be preferable

As a security professional:

1. Under most situations, it is equally as good as any other 2FA app.
2. Within the Microsoft ecosystem, it provides additional security features above and beyond simple 2FA.

If your workplace is leaning heavily on the Microsoft ecosystem, especially their cloud offerings like Azure, then restricting employees to the Microsoft app is a no-brainer, and actually quite reasonable.

For example, if they happen to have a hybrid domain with an on-prem domain controller syncing with Azure (forgive me for using obsolete terms, I’m a greybeard), then they can control all access to all company assets, including 2FA. If an employee leaves the company, they can also disable the Microsoft app at a moment’s notice by disabling the employee’s Microsoft account. Because everything is hooked into Azure, it sends push notifications down to all company assets - like the Microsoft 2FA app - to unhook all of the company’s credentials and prevent employee access after the fact.

You cannot do this with other 2FA apps.

I'm guessing they never mentioned that it tracks your location? That's why they insist on using it not any of the other bullshit.