How Xbox verification works through your Microsoft account
Xbox does not keep a separate login of its own. Your gamertag, purchases and subscriptions sit on a Microsoft account, and that account has a list of security info: email addresses, phone numbers and authenticator apps that can receive codes. When Microsoft wants extra proof, it lets you pick one of them.
An Xbox verification code by SMS is a short message from Microsoft with a numeric security code to type on screen. It can be used for sign-ins that look unusual, for two-step verification if you have turned it on, for a password change, and for adding or removing other security info.
When you create a new account, Microsoft may also ask for a phone number to confirm you are a person. Whether this step appears depends on Microsoft's own checks, so you may not see it at all.
Why your Xbox verification code is not arriving
First check where the code went. The prompt shows a partly hidden email or phone number. If it is an old number you no longer have, the code will not reach you, and you will need to pick another method or use Microsoft's account recovery form.
For SMS, check the country code and leave out any leading zero. Some numbers are refused, including some VoIP numbers and numbers already used by many accounts. If Microsoft says it cannot send a code to a number, a different type of number is usually the answer, not more requests.
Many requests in a short time can trigger a temporary limit. Wait before trying again, and use the Authenticator app or an email code if one is offered.
Choosing a number for Xbox that will not cause trouble later
A number you add becomes a way into the account. If someone else can read texts to it, they can receive a security code too. That is why a free shared number, whose inbox anyone can open, should never go on a Microsoft account. Shared numbers are also often already used on big platforms, so Microsoft may refuse them anyway.
For a number that stays on the account, rent a private non-VoIP number from $4.99. The inbox is yours alone, SMS is unlimited, and you can keep it from 1 day up to 12 months depending on the country. Renew it for as long as it stays in your security info.
Microsoft may apply a waiting period before new security info fully replaces old info, as protection against takeover. Plan for it: add the new number while you still have access to the old one.
Using a per-code number for a one-time Xbox verification
On the /otp page you pick Xbox, see its price and stock, and pay for one code from $0.50. The number is private to you while the order is open. If no code arrives, the order is refunded automatically.
Try the VoIP High Quality pool (US, +1) first, since it is the cheapest. If Microsoft will not send to it, a United Kingdom (+44) number is the next option. For a number you plan to leave on the account, go straight to a rental.
Once you are in, consider making the Authenticator app or a passkey your main sign-in method, so everyday sign-ins do not depend on SMS.
Keeping your personal number off your gaming account
Plenty of people would rather not put their personal mobile number on a gaming account. It is one more place it can leak from, and it can end up attached to a console the whole household uses. A rental gives the account a separate line that you still control.
Because Xbox runs on a Microsoft account, the same advice covers your whole Microsoft account: keep a number you control on anything you care about, and save free shared numbers for low-stakes sign-ups elsewhere.
If the account is for a child, manage it from a parent's Microsoft account with Microsoft's family settings rather than with a separate number. Those settings exist to control what a child's account can do.