The security of their personal devices on which they must install Microsoft spyware and accept it's terms, before being allowed to complete their education.
The school should be providing phones if the students require them. I strongly believe 2fa is important, but it is even more important to acknowledge that not everyone owns the gadgets that you do. And they may not want to. So if a service requires 2fa they should also supply the necessary hardware to all of their users.