Depends on config. Bare minimum (mainstream?) is just a "blah blah service login" Accept|Deny.

If you are in and out administering things and accessing protected documentation I could see how the login-to-mfa-popup latency and difference in tenancy names could give a window for a misclick.