How it works: Backup and restore for Microsoft Authenticator

"Does the backup and restore defy the point of MFA authentication? This process does potentially allows cloning Authenticator app into a secondary phone (with or without primary phone owner knowledge) and therefore defies the non-repudiation principals. What is the protection for the backup file of the authenticator? Microsoft Authenticator recommends using "Microsoft Live" account that is a personal account plus TEXT/Call/Email code for authentication. But all those methods will not stop from backing-up unlocked phone...

Is there in-app / server feature to detect two authenticator apps running simultaneously on the different phones?

P.S. There was always an option to clone an authenticator if initial QR code intercepted. But this was only limited to onboarding phase. Backup and restore opens an opportunity to get all the accounts cloned."

I've replied to your point in this thread where someone else has raised a similar point:

Cloud backup and recovery for the Microsoft Authenticator app on Android now available - Page 2 - Microsoft Tech Community