So this freaked me out! A week ago I went passwordless with my Microsoft account; which required setting up Microsoft Authenticator. While I was there, I re-evaluated my entire MFA setup:

* I had already setup Authy OTP codes, which I was actively using. So I left that alone.

* I had already setup an external email. So I left that alone.

* I setup Microsoft Authenticator for the first time.

* I added a pair of FIDO U2F YubiKeys.

* I generated and backed up an account recovery code.

* I REMOVED my cell phone number because SMS is not secure.

* I did NOT look at my aliases because I wasn't aware that was even a thing. It's not part of the Security Dashboard.

Here's what worked: I've been able to sign in with Microsoft Authenticator on my phone, the YubiKeys on supported browsers, and receive codes at my external email if neither of aforementioned devices are available. I have noticed that, even though the Authy OTP code is still listed on my Security Dashboard, I can't trigger a prompt for that code. This isn't a huge deal, since both Authy and Microsoft Authenticator are on my phone.

In reaction to your post, I went and checked out my aliases. My phone number was NOT in there. The only alias I have is my primary Microsoft email. I don't know if my phone number ever was in there. Perhaps it was, and when I deleted my number from the Security Dashboard it also deleted from the aliases? I don't know. I do know that there is no phone number listed under my Account Info or Security Dashboard.

Thanks for this post. It reminds me just how vested we are on certain accounts; accounts that can disappear in an instant. I hope you get your issues resolved!