But to get to the auth request, do you not need to pass the password stage first?
I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.
I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator.
Since they talked about the authenticator app, it depends on how it's set up. You can enable it for passwordless logins, so you'd get the prompt for knowing the account name.