Remove Sign-In Notification Security

Question

I have a personal Microsoft account with two-factor authentication enabled.

My current security methods are:

• Password
• Backup/recovery email address
• Authentication app (Aegis)
• Microsoft Authenticator notifications

I recently moved from Microsoft Authenticator to Aegis, which I use for TOTP codes. Which is functioning correctly.

I have removed SMS as a verification method because I don't consider SMS secure.

I have completely removed my Microsoft account from Microsoft Authenticator, and removed Microsoft Authenticator from my phone.

I no longer want the Sign-In Notifications authentication method associated with my account.

However, when I go to my Microsoft account security settings and attempt to remove Sign-In Notifications, I receive this error:

I already have a backup/recovery email address configured and verified ("Up to date") on the account.

I contacted Microsoft Support and was told that I need to add a SECOND backup email address before I can remove Sign-In Notifications.

I am not attempting to remove my only recovery method. I already have a verified recovery email and a functioning authentication app (Aegis) providing TOTP codes.

I told support that the instruction to create and add a second backup email address is ridiculous, which they agreed with.

At the time, in frustration, I accepted that it was too much work and too difficult to handle and have left it enabled. But in hindsight, I think this compromises the security of my account.

Any clarification or escalation to the appropriate Microsoft account-security team would be appreciated.