If the security code email is not arriving, use these checks first:
- Check the Junk/Spam folder for a message from the Microsoft account team.
- Confirm the sender domain is @accountprotection.microsoft.com. That is the valid Microsoft domain for account security notifications and verification codes.
- Avoid making repeated code requests. Excessive requests can trigger a temporary block and stop codes from being sent.
- If the verification email is being sent to another Microsoft address such as @outlook.com, @hotmail.com, @live.com, or @msn.com, open the requesting account in one private browsing window and the mailbox receiving the code in a second private browsing window. This prevents one sign-in from signing out the other.
- If access to the listed security email or phone is no longer available, at the Verify your identity prompt select I don't have any of these and follow the prompts to replace the security info.
Important:
- Do not change all security info at the same time, or the account may be restricted for 30 days.
- If all security info is replaced, there is a 30-day wait before sign-in is allowed.
- If the code was not requested, do not respond to it. Without the code, the account remains safe.
If the goal is to cancel a pending security-info change, a legitimate Microsoft security email comes from @accountprotection.microsoft.com. If a later email says the account recovery process was canceled, that confirms the replacement was stopped.
If codes still do not arrive, the account may be temporarily blocked due to unusual activity, or delivery may be delayed. In that case, wait and try again later, or use the account recovery process if access to security info has been lost.
References: