D'oh. But fair.
> There are many other 2FA authenticators available.
Specified by job, so no choice in this matter.
> I would refuse anything work-related on my personal phone.
Quite reasonable as a general rule, though my then-employer only required the 2FA app and nothing else, and in this case it would've just meant "get an additional phone".
I suspect the next thing you're going to say is along the lines of "then just switch jobs", though.
I mean even that might not work out. We just switched to MS Teams last year and Microsoft uses a push-based app, not TOTP or other offline keys like we'd used before. And Teams just seems to be getting more popular...
What a wonderful privileged position you hold. If only everyone could afford to tell their employer to pound sand in the same heroic manner you have undertaken.
So brave.