There's one big data leak which Android/iOS deliberately don't let you control: internet access. TOTP apps don't need it, and yet. The Microsoft app does have

There's one big data leak which Android/iOS deliberately don't let you control: internet access. TOTP apps don't need it, and yet. The Microsoft app does have a mode which uses the internet to push a message saying "Is this you logging in?", which is weaker than TOTP but feeds into their "AI threat detection engine" mantra. It seems to fall back to TOTP if there is no network.