> The smart thing would be for MSFT/o365 to give you the option to switch to a TOTP token and other authenticators with a better experience so people can switch

> The smart thing would be for MSFT/o365 to give you the option to switch to a TOTP token and other authenticators with a better experience so people can switch organically. It already does, both through an app notification using the Microsoft Authenticator TOTP app, as well as through the app-agnostic TOTP method. (Just checked my own settings.) It's just not the easiest thing to find the settings page where you do it, because Microsoft helpfully hides it behind "advanced security options" instead of just putting it next to the "change password" UI like the other major sites do. > Most security people still don't distinguish between authenticators and identities, as federation concepts like identity providers are still in the rarefied space of enterprise. Who are you counting as "security people" in this case? I feel like the distinction for that kind of thing has been around for a long, long time, as evidenced by SSH public key configs and Active Directory certificate based login configuration both allowing multiple keys/certs per user, or Github allowing multiple keys as access tokens, etc. If we're talking about OTP keyrings issued by banks to consumers, again I don't think those things have been equated to identity as much as being treated like a second key for a second lock on the same door.