I have no experience with MS AAD, but I saw something similar with GWorkspace. The TOTP option is not shown by default, you need to add a security key (e.g. Yub

I have no experience with MS AAD, but I saw something similar with GWorkspace. The TOTP option is not shown by default, you need to add a security key (e.g. YubiKey) or maybe (never tested) an Android phone. You can then add a TOTP, remove the other method and continue using TOTP. Maybe MS AAD has something similar? Then temporarily using a throwaway profile on a phone might be enough to get around that.