Bunch of clueless management folk think everything must be personally tailored and become your best friend or something.

This also stood out to me, but then I remembered this weird question asking how people are using Firefox for shopping. At least based on that thread it seems FF management have disappointing and unnecessary future plans similar to Pocket acquisition.

Your question was why GPS permission is needed, you should now know why.

I am using MS Authenticator and Aegis. Using MS authenticator only for work accounts that have been setup for number matching feature, it is pretty nice to simply enter 2 digits in app than entering 6 digits in client itself any time you need to approve MFA.

Everything else that supports standard TOTP whether work related or personal is on Aegis - it is a much better TOTP app.

It’s a security / compliance policy. There is a very high chance your company has not even enabled it, have not seen anyone using it.

As I see it, you would and could use it only if you force MS Authenticator notification as the only MFA method and it is important in which country MFA prompt originates. Usually it is IP based block / whitelist which checks IP from which login originates which seems like a much more useful info, then you can also allow any MFA method.

You can always deny permissions to apps.

Sounds more like a bad design than purposefully left backdoors. Very few devices are rooted and usually you cannot get root without fully wiping your device in process. As for cloud upload, that indeed is convenient for most regular users. I prefer encrypted offline backup like Aegis does, but you need to think about regular folk if they would loose or wipe their device.

As per their FAQ:

Permission to access your location

Q: I got a prompt asking me to grant permission for the app to access my location. Why am I seeing this?

A: You will see a prompt from the Authenticator app asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources. You’ll need to share your location once every hour to ensure you are still within a country where you are allowed to access the resource.

Are there well known TOTP apps with backdoors?