What closeparen said. Normally the phone gives you the PIN and you type it into the application you just signed into. Gives you some amount of assurance that th

What closeparen said. Normally the phone gives you the PIN and you type it into the application you just signed into. Gives you some amount of assurance that the second-factor is going to the desired party. Instead, MS's 2FA send a notification to your phone where you type in a static, pre-defined PIN. There is no way of knowing what actor or application triggered the 2FA request.