This question already has an answer here:
I can check my office webmail through https://webmail.example.com. When my username and password match a 5 digit SMS is sent to my phone that has to be entered on the website as well. This way my phone is the second factor.
However, on my mobile phone or on any tablet I can also configure an 'Exchange' e-mail account. This way I only need a username and the password during initial configuration. There is never the need for a second factor.
I believe this is possible because 'Outlook Anywhere' is enabled on the Exchange server.
I wonder whether the SMS second factor really adds security: anyone who intercepted my username/ password can simply configure an Exchange e-mail account on their own phone and will never be asked for an SMS-code?