Microsoft Authenticator requires an:
- Outlook account
- Verification account
- iCloud account
The first two are required to set up the authenticator on a new device, the latter stores all the data to be restored.
Ideally, your "verification account" should be supported by a further "restoration account" that can be used to restore its forgotten passwords etc. This account should not be one of the other accounts linked to Microsoft Authenticator as, if these are breached they can simply be used to change the password of the "verification account" and bypass the verification step. This account should also not be in the file manager in case this is breached.
In summary, I'm asking whether it is necessary/ideal to have a complete divorce between the accounts in the file manager and those required to setup the 2fa on a new device. Would a further "restoration" account associated with your "verification account" but not with 2fa directly also be useful?
I would be happy to learn I don't need to memorize 4 additional complex passwords.