Start with the right checks.
First check whether you requested the code and whether the displayed recovery destination belongs to you.
What to do next.
Confirm the intended Microsoft account and read the masked destination carefully.
Check the relevant email folder or phone, including filtering that may hide the message.
Avoid repeatedly requesting codes in rapid succession. Follow any waiting instructions shown by the provider.
Use Microsoft’s verification troubleshooting or sign in helper if the method is unavailable.
Check the result.
Complete only the sign in you started and check that the account is the one you expected.
Stop and get help if…
The recovery destination is unfamiliar, every method is unavailable or requests arrive without your action. Record what happened and review the account through a trusted route.