^^^ As I understand ClaireStan's post, TCL, his/her username and password actually work but, having recognised a valid log-in, Microsoft is now saying "Tough luck, mate. We can see who you are but you're not going any further because this account is now locked".
It's at that point that he/she is invited to provide a mobile number, so the text can only be sent to someone who has successfully completed the log-in process. (i.e. it's not the same as when someone has forgotten their password where, clearly, a text couldn't be sent out to just anyone who tried to log in without it).