Microsoft's multi-factor authentication system is 100% broken. I'll just leave my anecdote that I mentioned on a previous occasion [0]: https://news.ycombinator

Microsoft's multi-factor authentication system is 100% broken. I'll just leave my anecdote that I mentioned on a previous occasion [0]: https://news.ycombinator.com/item?id=27447820 https://news.ycombinator.com/item?id=27447820 > I lost my Microsoft account years ago. I still get emails from Microsoft stating that there's suspicious activity on the account. I got two just yesterday. > Despite that, despite still having access to the email the account is on, I cannot recover the Microsoft account. Despite Microsoft notifying me that the account is still, years later to this day, being abused, cannot use any form of recovery. I cannot access the account with help from support or even after visiting a brick-and-mortar store. > It's one big reason that I've long since refused to purchase anything more from Microsoft and have ditched Windows. Funny enough, after reading the article's tl;dr it sounds exactly like what might have happened to my account: > TL, DR: If you have MFA enabled on your Microsoft account, this automatically adds your phone number as a sign-in alias, supplementing an attack surface to your account. Attempting to remedy this issue by limiting your phone number to only be used during MFA removes your phone number from the MFA backend instead while leaving it on your account. That prevents MFA from working altogether, but it does not disable it for the account. Thus, leaving your account completely inaccessible forever. Microsoft support will then blame their bug on you, the user, and refuse to acknowledge the issue clinging to an internal policy set up entirely incorrectly. If you think account recovery, MFA setup, password reset or account reinstatement forms will work, you would be wrong. All of these rely on the same system that has been allowed to enter an unsupported state and cannot recover independently.