If two-step verification is not enabled, the supported recovery path is still the Microsoft account recovery form and the sign-in helper.
Based on the described lockout, these are the available next steps:
- Try unlocking the account online again at https://account.microsoft.com and request a security code.
- Any phone number that can receive text messages can be used.
- It does not need to be associated with the account.
- The code expires after 10 minutes.
- If the security code path fails or the account shows as blocked, use the sign-in helper.
- If the account says it does not exist, use the Microsoft account sign-in helper.
- If sign-in is blocked, the sign-in helper is also the recommended troubleshooter.
- Continue using the account recovery form, since two-step verification is not on.
- Microsoft reviews the submitted answers and sends the result to the working email address provided within 24 hours.
- If the account is not verified, the form can be retried up to two times per day.
- Use a working email address that can receive the recovery result.
- If verification methods are being blocked, reduce repeated attempts and wait before retrying.
- High-volume or repetitive requests can trigger temporary blocks.
- Waiting 24 hours may remove a block; if not, waiting longer, up to 1 week, is recommended.
- Trying another verification method or another network can also help.
- If the sign-in page does not show the Next option and instead indicates the account was locked for suspicious activity or a terms violation, use the aka.ms/ link shown in that window and submit the reinstatement form there.
- After submission, a Microsoft Online Safety support agent reviews it and contacts by email.
- Do not submit additional reinstatement requests, because that can slow the response.
- Phone support will not manually restore access or change account details for this scenario.
- Support agents are not allowed to send password reset links or access and change account details outside the supported recovery/reinstatement processes.
The main point is that there is still a path forward when 2FA is off, but it remains limited to the online unlock flow, sign-in helper, recovery form, and possibly the reinstatement form shown on the lock screen. Purchase history and account age are not listed as a manual override path in the available guidance.
References: