SHA-256 token with MS Authenticator returns wrong TOTP

Question

Greetings,

We (company) are using MS365. MFA is enforced for all users, everyone uses MS Authenticator and it works fine.

Now I tried to set up MFA on our Sophos (UTM 9) Firewall. When I set SHA-1 token MS Authenticator works fine. When I set SHA-256 (security concerns) token MS Authenticator return wrong TOTP.

I tested SHA-1 and SHA-256 with Google authenticator which returns proper TOTP (ofc different one as MS) and login works. So we have workaround but having 2 apps for same purpose is not the best...

I went through Sophos manuals and they recommend either Google or Sophos authenticator. Their support cannot help me either ("you should contact MS regarding this issue").

Does MS Authenticator even support 'above' SHA-1 tokens? Can anything be done on our end? I found plenty of people struggling with this exact problem but I find it hard to believe that in 2023 MS does not support 'safer' version.

Thanks.

Ziga