Nothing is plausible about this phishing mail - writing "update your password now" would be understandable but "update your 2FA now"? Never EVER seen this on any real site and it doesn't make sense (rotating passwords doesn't make sense either but not everyone got the memo).

I literally, just a couple of days ago, got an email from Microsoft Azure asking me to update my 2FA. And I had already set up a passkey, so 2FA shouldn't even have been needed!

I wonder how well this correlates with people for whom 2FA adoption was not a choice they made in the first place, but a thing that "NPM insists we do". For them, this email is not all that different from the emails that required them to set up 2FA in the first place.