If you set it up this way. An admin can choose not to or could allow e. g. 8 previous codes. That would allow four and a half minutes to put in any code of this timespan.
There is some pretty surprising service that doesn't support this, the moment it disappears from your phone the code is no longer valid. It might be Microsoft if you're not using MS's auth app? Like I said I forget which one it is so I always just wait if I'm <5 seconds from expiry, but it is big enough that I was very surprised when it happened.
