The short answer: Both!
You have the option to choose which device to use for 2-Step each time you authenticate. We strongly recommend enrolling more than one device (such as a work phone and a personal phone) to prevent being locked out of your account if you lose, break, or forget your primary device.
Best Practice: Having a backup device enrolled is the most effective way to avoid getting locked out of your account. You can get help from the service desk if you are locked out, but they are available only during regular business hours and you must be able to verify your identity with a government-issued photo ID to proceed. Save yourself the headache and be prepared by enrolling more than one device.
To learn how to enroll multiple phones, tablets, or security keys, please see: How to Get Started with 2-Step (KB0011939).
Note: Windows Phones are no longer supported by the Duo Mobile app.