News to me: "Microsoft is committed to advancing security standards and as such, we will start phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts."

This note was added some time in 2026. https://support.microsoft.com/en-gb/account-billing/how-to-use-two-step-verification-with-your-microsoft-account-c7910146-672f-01e9-50a0-93b4585e7eb4

Not something they can do quickly, but it does show the direction they want to go.

How to use two-step verification with your Microsoft account - Microsoft Support

Get answers to some basic questions about what two-step verification is, and how to set it up and use it to help keep your Microsoft account more secure.

"For increased security, you can no longer add a phone number."

I literally saw Windows ask to add a phone number last Tuesday.
https://support.microsoft.com/en-gb/account-billing/microsoft-account-security-info-verification-codes-bf2505ca-cae5-c5b4-77d1-69d3343a5452

Microsoft account security info & verification codes - Microsoft Support

Learn how to manage your Microsoft account security info and troubleshoot verification code issues.

I have a (test) @outlook.com email account which doesn't have a mobile number. They're now insisting I cannot unlink my third-party email account.

To have an @outlook.com email, you need to have... another email account?

Even though this @outlook.com account is linked to both Microsoft Authenticator, and a passkey.

They have this whole nag screen that *forces* you to add an email or a mobile number, and now they're saying the only option is to add a third-party email?
https://support.microsoft.com/en-gb/account-billing/troubleshoot-microsoft-verification-code-issues-409090c4-92b5-42b9-8ae6-bcc97e62fc48
Microsoft to stop sending SMS codes for personal accounts - Microsoft Support

I tested the implications of the updated #Microsoft account system. My results are written up here:
https://sourcejedi.github.io/2026/04/20/microsoft-contact-info.html
Do Microsoft accounts require a recovery email address or mobile number?

Shortly after I finished writing up their security and recovery system, Microsoft decided to change it. So I went back again and checked how everything works. These are my test results.

Blog?