I have a fully stock, not jailbroken/unrooted, up-to-date, relatively new, device that Microsoft randomly determines is "rooted" and blocks access (until rebooted). This happens a few times a month, frequently enough that the false positive rate is very concerning with this change.

Wow, they're actively removing data off the app on your phone? Good reason to never use MS authenticator for anything important. This is also assuming that they're never wrong about this, and that it is foolproof with no false positives.

It seems that there's a big difference between "not supported" and actively removing account/auth data from someones phone. This has made me reconsider my 2fa providers. I might have to look at some sort of hosted option that doesn't have this issue. I wonder what the policies are for this kind of thing with authy and okta (and other major 2fa auth platforms).

GrapheneOS user. Disappointing they consider our OS rooted when its actually more secure than stock Android.

So if I'm locked out of my 365 sysadmin user by this, what then?

Hopefully disabling the hardened memory allocator, as suggested by the article, holds them off for a while..