We use DUO for our MFA with M365 on cell phones. For most users it works without a problem. I do have 2 users who also need to have Microsoft Authenticator for access to a specific website. On initial setup if Microsoft Authenticator is not installed Company Portal and Outlook all setup without a problem. If Microsoft Authenticator is installed, it attempts to do 2FA before Duo. The same issue appears for these users when they have to change their password and MFA is attempted again. I can force this to happen on my device by installing Microsoft Authenticator and reset my password.
I have checked our Conditional access it it only requires DUO and have looked at MFA and PerUser MFA is disabled. Any ideas on a setting anywhere that would stop Microsoft Authenticator from trying to get involved where not wanted. My users only have Iphones...