Some organizations disable totp entirely. Instead, everytime there's a login attempt a pop-up notification with "allow" & "deny" options is pushed to the registered device.