Are you using Microsoft Authenticator in a corporate environment/profile? I just checked my personal install (Android) and it does not require any permissions (location is denied).
This app has access to: Photos/Media/Files
read the contents of your USB storage
modify or delete the contents of your USB storage
precise location (GPS and network-based)
find accounts on the device
read the contents of your USB storage
modify or delete the contents of your USB storage
take pictures and videos
find accounts on the device
add or remove accounts
receive data from Internet
run at startup
draw over other apps
prevent device from sleeping
create accounts and set passwords
view network connections
close other apps
control vibration
use accounts on the device
full network accessFrom Microsoft's Authenticator help page:
"You will see a prompt from Microsoft Authenticator asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources"
https://support.microsoft.com/en-us/account-billing/common-q...
The Microsoft app does have a mode which uses the internet to push a message saying "Is this you logging in?", which is weaker than TOTP but feeds into their "AI threat detection engine" mantra. It seems to fall back to TOTP if there is no network.
MS is clearly using this to their advantage and asking for everything they can provide even a thin justification for, but even if you're just giving them a fraction of what they're asking for it's still far worse than handing over a cell phone number. My work considered requiring Microsoft Authenticator but after enough people balked at handing over so much data to MS they caved and we got simple little keychains that do nothing but spit out numbers and can't collect our contacts, our location, or start listening using a microphone. It's hard to beat that.