Microsoft is well known to not take security serious at all. Some years ago people was able to contact Skype business support and change the password of accounts as long as they could tell them some of the contacts and the email of the account. Absolutely insanely irresponsible.