That's a bad comparison, as you're comparing a full authentication process against just one step: with Office 365 (and SMS verification for DigiD) you additionally need to provide a username and password, which you don't need to do with the app.

I think the only part that can reasonably be simplified without compromising security is to use a push notification instead of having to scan the QR-code.