Managing personal Outlook.com account settings, security, and privacy
You are correct that the ACSR recovery form cannot bypass two-step verification. First, check Other ways to sign in for Microsoft Authenticator, another email/phone, a security key, or the 25-digit recovery code created when 2FA was configured. If the page appears to request the same number twice, those are two separate identity checks; one security method cannot satisfy both. Microsoft support agents cannot manually reset 2FA or alter the account’s security information.
If you know the password but no longer have access to any registered method, select I don’t have any of these on the verification screen and follow the prompts to replace the security information. Microsoft normally imposes a 30-day security waiting period before the replacement takes effect.
Unfortunately, if no replacement option is offered and you have neither an existing verification method nor a previously generated recovery code, Microsoft states that the account cannot be recovered by support.