Re: Surely there's a design fault here
The other flaw is using the same generic screen and not saying where the MFA request is coming from. Is it Outlook, Teams, Azure, or what? Just that would help the user narrow down issues and authorize appropriately.