If my experience is anything to go by it's enough to refuse to give them 2FA credentials and attempt to stick to only using a password (since I don't give a shit about a Microsoft account and didn't store any personal info there).