≥ and force Microsoft Authenticator on the (private) phones of both employees and volunteers.
Refuse to use the service until they provide you with a work appointed phone. Volunteers admitedly have a more difficult time with that but as someone else said you can indeed do text/call options.
you should really use FreeOTP+ instead. https://f-droid.org/en/packages/org.liberty.android.freeotpplus/