For Office365 / AzureAD this is a configuration choice, admins can enable the numbers option which reduces the chances of accidental allows

Administrators can enable it. If they have it set to 'Microsoft managed', number entry is enabled by default but not additional context. https://docs.microsoft.com/en-us/azure/active-directory/auth...

Oof. I wonder if admins can disable push notifications and just fall back to TOTP instead? Though it does sound like that would not be convenient if you have to enter a TOTP every time an RDP connection get interrupted.

Sorry but the parent poster is correct. For both my corp account as well as my personal Microsoft account , I’m prompted to enter the validation number after I’ve faceid’d. If this doesn’t happen when you are authenticated, then it’s a setting with the system you’re logging into.

Same here. We disabled the push notification for Corp, but my personal account requires me to select a matching value.

... you can still do the code based flow if you want...

I want to see what the execs use, not the code monkey "requirements"