Microsoft Authenticator push notifications are even worse. It's super easy to lose accounts if you lose your device because they are not included in backups and there's no warning that you should have two devices registered when setting it up.

Normal users aren't going to keep a backup device, let alone keep track of which accounts are associated with which devices they own. Normal users need something in a portable format that can be backed up. Anything that can be backed up can be stolen and anything that can be stolen shouldn't be used for single factor auth like Passkeys are promising.

I don't think you can set your Microsoft account to only have push notifications as a second factor without other recovery options?

I forgot to enroll a new phone before wiping my old one this year and was looking at a 30 day wait to update my login info. That’s not technically losing the account, but it’s pretty rough.

Thankfully I was logged in on a PC and was able to get past it.