Microsoft account (Outlook, Hotmail) without your phone
A single Microsoft account unlocks your email, your OneDrive and, if you game, your Xbox. Microsoft doesn't offer printable backup codes like Google: its safety net is several contact methods at once.
Short version: Microsoft spreads verification across your password, your "security info" (phone, alternate email, the Authenticator app) and, if all that fails, a recovery form that depends on how much you can prove. The more methods you have registered and accessible without your current phone, the less you depend on that form.
Why this account is critical
If you use Outlook or Hotmail for email, this account is your inbox. If you have Windows with a Microsoft sign-in, it also unlocks your computer. Add OneDrive, Office and, in many homes, the family Xbox: losing access isn't just losing your email, it's losing several things at once.
This matters more than it seems on laptops and desktops: if you sign in to Windows with your Microsoft account (instead of a local account), your Windows password is the same as this account's. Losing access to the account can complicate access to the computer itself too, not just the online services.
What Microsoft asks for from a new phone
If you have two-step verification turned on, Microsoft can ask for a code generated by the Microsoft Authenticator app, a code sent by SMS to your registered number, or a code to an alternate email. The Authenticator app also lets you sign in without a password by approving a notification on your phone: convenient while you have that phone, a blind spot if you don't.
Microsoft's own guidance is explicit about this: it recommends having three different contact methods registered just in case, not just two. The logic is that any single method can fail for a different reason (losing your phone, changing your number, closing an alternate email), and three reduces the odds of all of them failing at once compared to having just one or two. This also works both ways: Microsoft also uses these same methods to warn you if it detects a suspicious sign-in, so keeping them up to date isn't only for the day you lose your phone.
What recovery paths it offers
Microsoft's central piece is called "security info": you can register a phone number, an alternate email (not another equally vulnerable Microsoft account) and the Authenticator app. Microsoft recommends having several methods at once, precisely to not depend on just one if it fails.
Unlike Google, Microsoft doesn't offer a batch of single-use codes to print and keep outside your phone. All the security here rests on those contact methods (phone, email, Authenticator) being genuinely spread out, not on the same device or the same account you're trying to protect. If your only alternate email is another inbox that also depends on the lost phone, in practice you don't have a second method, you have the same one with another name.
A typical case: someone sets another Outlook account as their alternate email, opened on the same phone and protected by the same type of verification. The day the phone is missing, both accounts fail at once, for the same reason. A useful alternate email is one from a different provider, one you can open from a computer without depending on any particular device.
If you lose access and can't use any of those methods, there's an official account recovery form. It asks for everything you can provide: the account's email, your full name, an alternate email where you can be contacted (not the one you're trying to recover), the approximate date of your last password change, the country where the account was created, and Xbox or linked-device details if you have them. The more information matches what Microsoft already has on file, the better the odds of validating the account is yours.
What to check today
- Do you have more than one verification method registered (phone, alternate email, Authenticator)?
- Is your alternate email a separate account with its own security?
- Would you be able to say, today, which country and with what details the account was created?
- Do you know roughly when you last changed your password?
- Do you sign in to your computer with this same Microsoft account?
If you can no longer get in
First use the sign-in help tool on the login screen itself ("Can't access your account?"); if that doesn't work, fill out the official recovery form with as much information as possible. If the first attempt isn't validated, you can try again with more details; avoid resubmitting identical information expecting a different result.
If the account belongs to a school or a company (a Microsoft 365 account managed by an organization, not a personal Outlook or Hotmail account), the process changes: real control sits with that organization's administrator. Before filling out any personal form, contact whoever manages accounts at your company or school, since they're usually the one who can reset your access or your security info directly.
If the locked account belongs to a minor inside a Microsoft family group, the parent who manages the group has their own management tools; again, that route is usually faster than the generic recovery form.
Official sources: Guidance notes for the Microsoft account recovery form · Two-step verification for Microsoft accounts