From the play store (https://play.google.com/store/apps/details?id=com.azure.auth...):

This app has access to: Photos/Media/Files

    read the contents of your USB storage
    modify or delete the contents of your USB storage

Location

    precise location (GPS and network-based)

Contacts

    find accounts on the device

Storage

    read the contents of your USB storage
    modify or delete the contents of your USB storage

Camera

    take pictures and videos

Identity

    find accounts on the device
    add or remove accounts

Other

    receive data from Internet
    run at startup
    draw over other apps
    prevent device from sleeping
    create accounts and set passwords
    view network connections
    close other apps
    control vibration
    use accounts on the device
    full network access

As with most (all?) Android apps, support for permission requires user consent; Camera, "Files and media" and Location are all set to "Not allowed" on my device. From what I can tell based on Microsoft's help page, location may be a requirement of a work/school account and as far as I can remember, I've never been prompted for the location permission - it's possible I denied access if I was, but the app works without it.

From Microsoft's Authenticator help page:

"You will see a prompt from Microsoft Authenticator asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources"

https://support.microsoft.com/en-us/account-billing/common-q...

There's one big data leak which Android/iOS deliberately don't let you control: internet access. TOTP apps don't need it, and yet.

The Microsoft app does have a mode which uses the internet to push a message saying "Is this you logging in?", which is weaker than TOTP but feeds into their "AI threat detection engine" mantra. It seems to fall back to TOTP if there is no network.

The problem with android is that it's designed to leak your data like a sieve, so permissions are overbroad and all or nothing. Most people will accept any and every prompt for a permission they're told is required in order to use the app, even when the app doesn't always need it to function.

MS is clearly using this to their advantage and asking for everything they can provide even a thin justification for, but even if you're just giving them a fraction of what they're asking for it's still far worse than handing over a cell phone number. My work considered requiring Microsoft Authenticator but after enough people balked at handing over so much data to MS they caved and we got simple little keychains that do nothing but spit out numbers and can't collect our contacts, our location, or start listening using a microphone. It's hard to beat that.