Asklemmy

Get a used /cheap phone or tablet, only turn it on or enable wifi when you need the app. Don't use it for anything else. I think that covers all the bases.

Thanks people, some good replies here. I could demand a work phone, but that's impractical, dragging around two phones etc. I'd like all my 2FA in Aegis and not have to think and pick the right app first, let alone pick and unlock the right phone. The Shelter option is very nice, didn't know about that. If my company won't budge I'm doing that. When push comes to shove I could even use outlook that way on my phone.

I won't allow any MS stuff on any of my devices.

While it’s not technically safer, MS does make it a lot easier to set policy’s where you check a box for MSAuth.

Since the config is less complex and easier, it’s demonstratably safer to implement it this way.

If you're in the US, that could very well get you fired in any "at will employment" state. It's shitty, fucked up, and should be illegal, but the legislators seem to represent wealthy corporations way more than they represent their human constituents (GOP especially).

You can just use FreeOTP

My company has the same policy

Declare yourself a member of The Church of Emacs and claim your religious rights are being violated.

We let anyone use any authentication app. The Microsoft one is the best one. I'm pushing to make us exclusive because I'm sick of the IT support guys trying to support a dozen apps. You don't have to use your Microsoft account provided to use the app or back up your credentials.

Lots of great conversation here, I also work somewhere where this is required. If I didn't need my phone for access to chat, I just wouldn't use it for work. Alternatively, my phone has a work profile so I use that for any work related or non-FOSS apps. My IT guy even approved of my methods and said do the minimum and never more with tech.

Authentication methods in Entra ID (which is presumably what we are talking about as the identity provider) include Microsoft Authenticator and software otp.

Authenticator is push authentication, as described elsewhere here. If for some reason you're not getting push notifications, you can use an OTP code instead, but this still requires that you have push authentication configured in Microsoft Authenticator.

You can only use Software OTP in other applications if your administrator has explicitly allowed use of Software OTP as an authentication method, and also excluded you from being required to use Authenticatior - otherwise Authenticatior would always 'win' as choice of mechanisms because it is more secure.

Several states in the USA require that employees who are made to use their personal phone for business purposes be compensated. The enforcement method and process for requesting same is naturally very obscure.

I used bluestack to emulate android and us MS Auth when I had no choice.

It's a waste of space, but it doesn't go on your phone at least

Grab the shelter app from f Droid, add the Play store in shelter, move over to the work side Play store and install the authenticator.

Pause your work apps except for when you need to use the authenticator.

Prosper???

And here I am wishing they would come out with an authenticator watch app, so I didn't have to do all the work of taking my phone out of my pocket and swiping a few times.

If your company is enforcing geographic location as a security qualifier then MS Authenticator can poll your device. Also you can use push authentication with the MS suite.

At what point can you tax deduct your phone as a business expense?

You can't just have microsoft text you a code? That's what I do