Why does Microsoft not adhere to 2FA?

Question

Hello, I have a small question.

Why is it, that when I log in to my microsoft account (especially after suspicious activity) I have to confirm my identity via my e-mail and phone number, I have to change my password (because I can't log in with the old one), THEN CHANGE IT AGAIN, meanwhile I have like 30 successful log-in attempts from all around the world, AND NOT EVEN A SINGLE 2FA MAIL IN MY INBOX?

Can you answer this question logically? I have no malware, I haven't fell victim to any phishing scam, nothing. explain.

Answer 1

Microsoft does adhere to 2FA, but several security and configuration behaviors can explain what is being seen:

1. 2FA only triggers when it is correctly configured and available
   For consumer Microsoft accounts, verification codes are sent only to:
   • The primary alias, or
   • Email/phone numbers explicitly added as security info “as a way to verify sign in.”
     If 2FA/security info is not fully configured, removed, mis-typed, or limited (for example VOIP numbers, blocked SMS, junk-mail filtering), Microsoft may fall back to password + recovery flows instead of sending 2FA codes every time.
2. Microsoft may temporarily block sending codes due to risk signals
   Microsoft evaluates the trustworthiness of each sign-in. If activity is flagged as unusual or risky, the system can:
   • Temporarily block sending verification codes at all.
   • Slow or delay delivery of codes, especially if there is heavy compromised traffic from a region.
     This is explicitly documented: if actions trigger alerts or deviate from typical patterns, Microsoft may interpret it as risky behavior and temporarily block sending codes, even while still allowing some sign-ins or password-reset flows to proceed.
3. Excessive or repetitive requests can suppress 2FA delivery
   If there are many repeated requests for codes to different emails/phone numbers, Microsoft can block further code delivery as an anti-abuse measure. That can result in successful sign-ins (e.g., with a newly reset password) but no new 2FA messages being sent.
4. Email/SMS delivery issues can make it look like 2FA is “not used”
   Even when Microsoft sends codes, they may not appear because of:
   • Email going to junk/spam instead of the inbox.
   • Phone blocking texts from unknown numbers.
   • Full SMS inbox or malfunctioning messaging app.
   • Regional limitations or temporary unavailability of Microsoft’s SMS services.
     In these cases, sign-ins that do not require a fresh code (for example, existing sessions, trusted devices, or flows that rely on previously validated security info) can still succeed, giving the impression that 2FA is not being applied.
5. Account lockouts and security flags can change normal 2FA behavior
   If an account is flagged for unusual activity or locked for security reasons, verification messages might not go through until the issue is resolved. The system may instead force password changes, security-info checks, or recovery flows, rather than sending standard 2FA prompts for every attempt.
6. Using one Microsoft account to verify another can cause confusion
   If a Microsoft alias (Outlook/Hotmail/Live/MSN) is used as the alternate email for another Microsoft account, browser sign-out/sign-in behavior can make it hard to see the codes, even though they are being sent. Private/incognito windows are recommended in that scenario.
7. What to check and adjust
   From the documented behavior, the logical steps are:
   • Verify security info: sign in to the Security basics page → Update info and confirm phone/email entries are correct and still accessible.
   • Avoid excessive code requests: repeated attempts can cause temporary blocking of code delivery.
   • Check junk/spam for messages from @accountprotection.microsoft.com and mark as trusted.
   • Ensure the phone can receive SMS from unknown numbers and that the inbox/app is not blocked or full.
   • If using another Microsoft email as the alternate address, use a private browsing session to read the code while staying signed in to the original account.

In summary, Microsoft’s systems do enforce multi-factor verification, but risk-based blocking, delivery issues, configuration gaps, and anti-abuse protections can result in successful logins without visible 2FA emails, especially around periods of suspicious activity.

---

References:

• Troubleshoot Microsoft verification code issues
• Common problems with two-step verification for a work or school account