Managing personal Outlook.com account settings, security, and privacy
Hi Ryan, this is Marc. Thanks for reaching out to the community.
If the recovery request was rejected, it means the automated system did not find enough information to confirm ownership. Since your client still has access to the email address and password but cannot pass verification due to the old phone number, the next step is to retry the account recovery process with as much accurate information as possible. Start here: https://support.microsoft.com/en-us/account-billing/i-can-t-sign-in-to-my-microsoft-account-475c9b5c-8c25-49f1-9c2d-c64b7072e735.
If the password reset does not work with the available methods, complete the recovery form at https://account.live.com/acsr, including old passwords, approximate account creation date, or services where the account was used. For tips on increasing the chances of success, see https://support.microsoft.com/help/17875. If recovery still fails, you can submit a reinstatement request as a last resort: https://www.microsoft.com/concern/AccountReinstatement?SilentAuth=1&wa=wsignin1.0.
Please note that account recovery is fully automated, and if ownership cannot be verified, support staff cannot override it. Encourage your client to provide the most complete and accurate details possible when resubmitting the form.
Best regards,