My job's SSO moved to provider that either required an unrooted phone or a reliable Voice auth.

For 2 years the voice authentication worked fine (they call me, I type in a number) on my regular rooted phone. Then one random morning I just stopped getting the phone calls. "Network said no".

Complete lock out, nothing I could do except go out and panic-buy an unrooted phone not running Lineage and using a modern Android version. (I tried my older unofficial lineage phones without root, and no dice.)

I opted for a good phone I could postmarket later, but gosh did it set me back almost 1/5 of my monthly salary.

This does sounds like the situation where the employer should provide you with the phone.