I work as an IT manager and I have access to the IT systems where 2FA is used.
Currently the 2FA authenticator is installed on my personal phone.
Is it a good idea to ask my employer to provide a work phone where I can keep a backup of the authenticator, just in case if my personal phone stops working, I have a backup 2FA?
Thanks.
If your personal phone is lost/broken/etc, then you can just get the 2FA reset. Your IT department should be able to do this, and if not then whatever the third-party system it will have some process. Most people don't have a secondary device setup for 2FA (and not all systems even allow you to do that).
If you're concerned about this, it may be possible to backup your 2FA codes (some apps like Authy or AndOTP support this) - just make sure that you keep the backup secure.
Whether you should use your personal phone for 2FA in the first place is a separate question. If it's just TOTP codes than that's a bit more reasonable (as you can choose the app, and no network access/traffic is required). If they need a specific app (such as Microsoft Authenticator) installed, then it's up to you to decide whether you're happy with doing that on your own device, and your IT department to decide whether they'll allow you to. But that's a separate topic and one that's been discussed before (such as here).
Is it a good idea to ask my employer to provide a work phone where I can keep a backup of the authenticator, just in case if my personal phone stops working, I have a backup 2FA?
I would ask for a work phone so that you can do work on the work phone, and keep the personal phone for non-work activities. That is more secure for the company because they can dictate the applications on the work phone, and can make sure that all security policies are being followed. It also keeps work documents off of non-work hardware.
2FA has exactly one purpose: At some point in time a message is sent to a phone that is supposed to be in your possession, YOU (and nobody else) pulls that phone out of their pocket, and somehow acknowledge that you received that message. How owns the phone is irrelevant for this purpose, the only thing relevant is that you are in physical possession of the phone. Nothing is ever stored on your phone. There is no reason whatsoever why the company would ever want access to your phone.
People discuss whether you should use your private phone for work purposes. In this case, doing 2FA on my private phone saves me from having to carry two phones. The wear and tear on my phone and cost of data is less than any rounding error. So personally, for this purpose I would very much prefer using my own phone instead of having to use a second phone.
There are people who use a phone for significant amounts of work. Like having phone numbers of hundreds of customers and so on. That kind of thing should be done on a separate phone supplied by the company. Work emails have never been on any phone in my possession, private or work, but on a computer. But for 2FA and 2FA alone that's not a reason.
If you lose the 2FA phone, whether it's your private one or one supplied by the company makes no practical difference (assuming you would have lost that phone anyway, and it's probably more likely to lose a phone if you have two phones in your pocket instead of one). Having a second phone just to avoid interruptions when your personal phone breaks is not worth it. And if you want a works phone for this person only then at the time your private phone breaks, your work phone will be somewhere in a drawer and you can't remember where, you won't know where the charger is, and so on.
Is it a good idea to ask my employer to provide a work phone where I can keep a backup of the authenticator, just in case if my personal phone stops working, I have a backup 2FA?
Rather than asking for a new device I would speak to whomever implemented and manages your company's 2FA.
Ask them what happens in the case where the 2FA device ( it doesn't matter if it is personal or company provided ) is lost or stops working. Let them decide how this situation is handled and then simply follow through with that. If that means that the company needs to provide a "backup" device then that is the solution.
This won't work in 100% of cases, but if standard 2FA is used (i.e. not a proprietary/custom 2FA technology), Microsoft Authenticator has a feature to back up against a nominated account.
To echo a previous answer, depending on what the service is (i.e. Azure AD), your IT department will have ways and means to reset various security concerns with regards to your login.
This doesn't answer your question re: "should work give me a mobile phone". As an employee and a manager, you probably should be issued a mobile phone, but not just for the reason you've stated. If you're expected to make phone calls for the company and have constant access to work emails, it could be argued that the company should foot the bill for the phone calls and the internet access respectively. This is a typical arrangement, especially in larger organisations.
To start with, I think it is not good practice for you to use a personal device for a thing like this. But I guess the company doesn't mind which makes it the more worrisome.
That being said like someone already pointed out earlier, you should be able to recover your account with the help of an admin which I'm guessing you're not.
Yes. Technically speaking your phone is your phone. not office phone. They are not supposed to use your phone for office purposes.
But countries like India, office takes employee-s personal time, belongings for granted. Especially because no employee complains. So, first thing is for you to see the practice in your company, in your region, in your friends circle.
I would suggest you to weave a story why its important for the company to give you official phone (example: Your 2y niece uses your phone to play and in the past he has broken it. It takes you 3-4 months to get a new phone; research etc.. )
[edit1] Between, you can use Google Chrome/ Firefox plugins for authenticator. Or Bluestax android and get a virtual android phone on your laptop --subject to office security policy
