Microsoft may still require a verification code even when two-step verification and passwordless sign-in are turned off, especially if:
- The sign-in looks unusual (new device, new location, VPN, or long time since last sign-in).
- Security info needs to be confirmed or updated.
This behavior cannot be fully reverted to “password-only, no code prompts ever,” but the prompts can be reduced and made more predictable.
Use these steps and checks:
- Confirm security info and prompts
- When seeing “make sure you can receive a security code” or similar, follow the prompt once to verify or update security info.
- After verification, these prompts should appear less often, though they may still show occasionally as a security check.
- If the phone/email shown is not recognized
- When the verification screen shows a phone/email that is not recognized, confirm:
- The correct email domain is being used (for example,
.comvs.co.uk). - The email name is typed correctly (for example,
rachelvsrachael).
- The correct email domain is being used (for example,
- If the account details are correct but the security info is wrong, use the account recovery process: select the recovery link provided on the page or follow the guidance under “recover your account.”
- If the backup security info must be changed
- If access to the current phone/email is lost or another method is needed, on the verification screen select I don't have any of these and follow the prompts to update backup security info.
- Do not remove all security info at once, or the account may be restricted for 30 days.
- Understand why codes and prompts still appear
- Even with two-step verification off, Microsoft can:
- Ask for a one-time code when sign-in appears risky.
- Ask periodically to confirm that security info is current.
- This is by design and cannot be fully disabled.
If the goal is to avoid SMS/email codes as much as possible, consider using a passwordless method such as Microsoft Authenticator or Windows Hello. These methods replace many of the code prompts with an approval on a trusted device while still protecting the account.
References: