I had to make a new MS account to migrate a 2nd minecraft account. The account has only ever been used from the game launcher, and they have the analytics that the account was created for the migration. But apparently there was "suspicious activity" that violates TOS and they auto locked it, and rather than contact the gmail address I used for the account, they demand a phone number.

Tbf, I'm considering just raising this with the authorities, given a lot of relevant authorities, as not everyone migrating an account will be ab adult, and asking for kids phone numbers seems like a GDPR slamdunk.