Outlook's "sign in with app notification" feature is such an awful security footgun - it should not exist. It allows you to login to your email without any info, just clicking approve in the app, meaning you are just one misclick away from giving away your email. It gets enabled as an option by default if you install the Outlook app and I immediately started getting login approval requests.