There are many questions here involving using ones personal phone as a phone for work purposes, and the answers tend to indicate that it is quite reasonable, even recommended, not to use a personal phone for work purposes, at least for voice calls.
It is getting more common these days for IT services for work (email, VPN) to use a authentication application to algorithmically generate a code that is generated from a key and the time. This is defined in HMAC-SHA1 and implemented by many different applications such as google or microsoft authenticator and the oathtool CLI. These are marketed as multifactor authentication, though strictly that should be different types of information (eg. something you know and something you have), rather that two different things you know. These tools can be run on the same device that is doing the connection, meaning that the two different things you know are stored in the same place, potentially reducing security.
Assuming one was assigned a work laptop but not a work phone, and required to access such services protected by such a system. What are the possible consequences for refusing to use ones personal phone for the authentication and install all the tools required on the single device that is assigned? Is there some other way for multi factor verification? Is it possible to do this without using my personal phone.