Azure MFA (but dont always have a phone)?

Windows Azure officially supports DeepNet SafeID hardware tokens which are OATH compliant. You might want to check it out:

http://www.deepnetsecurity.com/authenticators/one-time-password/safeid/
http://wiki.deepnetsecurity.com/display/KB/How+to+Import+SafeID+Token+into+Azure+MFA+Server

Hi Brent,

For users not having (or not willing to use their own) mobile phones, the solution is to use hardware tokens. MFA Server on-prem is allowing to use standard OATH TOTP tokens, however, with Cloud MFA the only solution is the programmable tokens.

Regards,

Guy

Disclaimer: I am affiliated with Token2

Two things - it doesn't have to a be a mobile phone - it could be any predefined phone such as a landline.

I have customers where the 1st MFA phone is a users mobile, but the backup is the "Secretary" administrative assistant person.

The protocol is if UserX call the AA and gives a heads up that he (the AA ) will be getting a phone call from MSFT auth. The AA puts UserX on hold and checks with UserX boss or userX calendar to confirm that offsite and also tries to call user X to confirm no answer.

Then the AA tells UserX to go ahead and trigger Auth.

Cumbersome - but provides the some level of identification anti-spoofing verification.

The business could also look into providing a non-smart phone with a text only plan (aka pager). 

There is also this for the "I forgot my phone at home" : https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#one-time-bypass

You can configure an alternative phone, but apart from that, no. The On-Prem version has a bypass option and alternative method via security questions, this is not yet available for Azure MFA (but I believe it's coming).