Managing personal Outlook.com account settings, security, and privacy
Hello,
Microsoft is phasing out SMS-based phone verification. As a result, you may no longer be able to add or use a phone number for two-factor authentication (2FA) or account recovery.
Microsoft to stop sending SMS codes for personal accounts
So, since you’ve forgotten your account password, you’ll need to use another verification method, such as a recovery email address or an authenticator app to verify your identity.
If you don’t have access to any other verification methods, you’ll need to replace your security information. To do this, you must first verify your identity with Microsoft by completing the account recovery form.
Note:
If you remove all of your previous security information and replace it with something new, your account will be put into a restricted state for 30 days.
When filling out the recovery form, remember to use a familiar device from which you've frequently accessed your Microsoft account, as well as a familiar location. This will improve the chances of account recovery. Once verified, you will be given the option to update your security info, which takes 30 days to take effect.