Hello MK-0111
Microsoft is an international company which means the MS setting the sever all of the world.
The sever will do the reactions according to the MS "process". Let's say if the 2fa is the fake one that your access should be failed for the access.
Microsoft uses many different numbers to send out SMS messages. If those were ones that were generated by you then there is nothing to worry about. Microsoft will send the verification codes from different phone numbers, as we have services on different locations.
Furthermore, I want to let you know that protecting your data Microsoft’s highest priority. When you use Microsoft business cloud services, you are entrusting us with your most valuable asset your data. You trust its privacy will be protected and that it will only be used in a way that’s consistent with your expectations.
If the text message included a code only (normal 2FA) and if this code verifies your login request and proceeds with successful login attempt, then nothing to worry about you are safe.
or they might be another reason
-Sometimes, services allow you to log in using a third-party identity provider like Microsoft, Google, Facebook, or even Xing. It’s possible that at some point:
You linked your Microsoft account to Xing, or
You used your Microsoft account to sign up or log in to Xing, or vice versa.
In this case, trying to log into Microsoft could depending on how the accounts are linked trigger an authentication or verification from Xing. This is uncommon but technically possible in federated login systems. You may have used the same phone number or email for both Microsoft and Xing accounts. Some authentication systems can be shared via identity providers (e.g., using your Microsoft account to log into Xing or vice versa).
If you were using Single Sign-On (SSO) and had previously linked accounts, Xing might have triggered the code request.
I hope this clarifies things.