The Microsoft account can have multiple ways to prove who you are for 2FA (two-factor authentication). When you forget your 2FA security info you can initiate the account recovery process by clicking "Forget password?". The recovery process allows to replace all of the security info of the account with a new alternative email address and you just need a single account verification method. For example, a code from an authenticator app would be enough. It takes 30 days, but it’s possible to use any email you like.

They notify you by email and you can cancel it but what if this is an account that is rarely used? Like a secondary account or a school email account that you never need during the long summer break. An attacker just needs to guess a 6 digit code, and that’s it, no need for the password.

Doesn’t it defeat the purpose of 2FA if it bypasses 2FA after the 30 days? Not sure, but it seems to me that after the 30 days someone with a stolen password can login into the account even if it had 2FA enabled, because now you can use the new alternative email address to request a code.

  • Yes, MFA recovery processes, if insecure, is a popular way to bypass MFA. And yes, protecting your email accounts, even rarely used ones, is important.
    – schroeder
    Commented Jul 4 at 15:20
  • @schroeder to me the worst thing is that you don't even need the password, a single 6 digit OTP is enough to initiate the recovery process to replace all security info with an email you like. Shouldn't this be configurable? in order to allow users to disable it.
    – MugTempest
    Commented Jul 4 at 15:51
  • 1
    It's tougher to brute-force a TOTP than you might realise.
    – schroeder
    Commented Jul 4 at 16:17
  • Yes, brute-force might not be an option, however you have a couple of retries, and you might guess some if you do it to a huge number of accounts. Is the account recovery of Microsoft considered to be slightly insecure if it doesn't force 2FA?
    – MugTempest
    Commented Jul 4 at 19:07


You must log in to answer this question.

Browse other questions tagged .