[ntoskrnl_exe]

Pretty sure the same applies to all the passwords/passkeys/2FA codes stored in the Authenticator app with cloud backup on.

[bdavbdav]

Use 1Password or similar instead. They’re keyed against a key they don’t have access to.

[morshu9001]

How do you avoid losing that key?

[zekica]

Only if that authenticator/password manager app is not end-to-end encrypted.

[mcsniff]

No, not "only". E2EE is now used as a dog whistle.

Who holds/controls the keys on both ends?

[ntoskrnl_exe]

That's right, and Microsoft Authenticator isn't.