Given the preference I’d rather not carry around an additional phone or hw token. But I fully understand those who don’t appreciate it. You can possibly force

Given the preference I’d rather not carry around an additional phone or hw token. But I fully understand those who don’t appreciate it. You can possibly force bespoke token apps into google Authenticator or the ms variant if they use standard Totp or hotp (ms auth on AAD does not by default but you can force it to provide one during the workflow).