2FA is free even on a basic license but you need to use the Microsoft Authenticator App which can be installed from the Google Playstore or Apple Store.
here is the super secret setup link
You will need access to your phone AND a computer to complete this procedure.
After changing phones M$ Authenticator shows a greyed out account in the Android app that can’t be deleted. Use the link above to disable 2fa for any accounts in your Authenticator that are still Blue/active. Uninstall the M$ Authenticator App via the Playstore and reboot the phone.
Install the M$ Authenticator App. there should be no greyed out accounts now. Used the link above to add account into M$ Authenticator. Sign into your microsoft account before clicking the link, and make sure you have NO browser tabs open running other microsoft apps.
After adding you should see 2 devices listed
Verify your phones’ model number (don’t assume) On Android goto the Settings/Gear, About Phone. Keep the phone that matches your model#.
Might be useful to add the Authenticator App on an old phone as a backup. Make sure it has a screen lock.