Hi Shahram WALI,
Thank you for your post in our forum.
As for your question, we would sincerely explain it’s legal. As for its source, you will receive the email when someone shares a file or folder with you. And you can enter the verification code to access the file or folder. Here is the official article for your reference: Information about changes to the address that is used to send notification email messages from SharePoint.
Meanwhile, you can see the related about ******@sharepointonline.com:
Is email from OneDrive <no-reply-sharepointonline[at]microsoft[dot]onmicrosoft[dot]com> safe?
No SharePoint verification code received.
verification-code-not-coming from Sharepoint to external email.
No verification code when external recipients access shared secure links.
Best regards,
Cindy
* Beware of scammers posting fake support numbers here.
* Kindly Mark answer and Vote Yes on this thread if it helps, as it will be beneficial to more community members reading here.