How does Microsoft store a users Multi Factor Authentication phone number?

Question

We've had some users who are hesitant to use their personal numbers for setting up Microsoft Office 365 Multi Factor Authentication. Recently we had a user who received some malicious login attempts on their account, and is now receiving phone calls from unknown numbers. They're convinced the calls are related to the attempts on their account, though they were never even successfully hacked.

Hoping for some MS documentation to point this concerned user to and others like him.

• How does Microsoft store users' MFA personal information like phone number or email?
• Do they have any sort of assurance that this information won't be shared or used for marketing purposes?

Appreciate any insight into the topic!

Answer 1

This can be closed, thanks.