That's what is frustrating! I have been using this method for almost 5 years! Everyone is MFA enabled but this Authenticator app has started popping up in the last week.
The user logins like normal, enters their MFA code then it prompts them to download the app and set it up. They cannot continue until its complete.
Enabled or disabled? My default is disabled on all my users.
A few months ago I got an email notification that they will start enforcing MFA on/after a certain date. It got switched ON but I turned it back OFF (from azure AD). Perhaps one of the recent changes requires the use of MS Auth app. Phone number and alternate email address aren't sufficient and they're forcing all to add 1 more (auth app). If that's the case, I don't know how to turn off the prompt to use MS Auth app.