In November 2021 an optional geolocation feature was added to MSFT Authenticator to allow admins to block foreign access.

https://techcommunity.microsoft.com/t5/azure-active-director...

https://support.microsoft.com/en-us/account-billing/common-q...

Exactly, IIRC you can do policies related to locations. It's an optional feature, you don't need to enable it and the app will overall work just fine.

I wondered the same thing about needing access to the cameras and microphones. Turns out they justify it by saying it's for reading QR codes (as if phones had no other way to do this).