MS auth also supports SMS via phone number. That’s a whole new level of insecure, but lets you migrate to a new phone rather easily.

I’m 90% sure, all that 2FA crap is a sham anyway.