To this day, there is significantly better security in your XBox account to protect your in-game collectables than can be achieved by huge enterprises trying to protect their corporate secrets on Microsoft 365.

E.g.: the corporate default settings for MFA show zero additional information. Literally just an “accept” button. The XBox equivalent shows location, etc…