Comment by joezydeco

I'm a little confused. Does the code get generated on any attempt to log in, or only those that have the password and MFA is activated? Or when someone attempts password recovery?

Because I'm a bit concerned if Microsoft passwords are leaking.