2FA Troubles: Microsoft Authenticator Granting Access without Password

Question

Hi,

I started using Microsoft Authenticator for my business accounts. In it, the password is always requested first, regardless of the device, followed by the code in the Microsoft Authenticator. Additionally, every 7 days, the Authenticator prompts for verification again.

Recently, I added two-factor authentication (2FA) to my personal accounts, expecting a similar behavior. However, I noticed that it allows access to the accounts only with confirmation in the app, without prompting for the password (no, the option to sign in without a password is not activated; I never activated it, and it is not activated by default).

In my view, this is a significant security flaw. If a third party gains access to my smartphone, they could log into my emails and accounts without needing to enter the password, and this has been a cause for concern.

I would appreciate any guidance or assistance on how to address this security issue.

Thank you very much for your help!