This seems to be _less_ secure. I noticed yesterday that my iPhone's Microsoft Authenticator app emitted at least three notifications to "Approve sign-in request...ABCDE".

I almost never log into my Microsoft LiveID account, the only identity that uses that app for 2-factor. I thought it was a little screwy, so largely ignored the first request. By the time the second and third notifications came in I had read the news about MSFT's move to go to a simple "Approve/Deny" single-factor. An attacker could just go through a list of LiveID's and try and authenticate. With a large enough list, a few folks will just hit "Approve", I'd wager. I doubt the app use any other factors like GPS or IP address. NB: There does seem to be a timeout.

Or am I missing something here?