Account accessed despite having 2FA with the authenticator app

18 minutes ago my microsoft account was accessed from germany, beind a VPN, despite having 2FA turned on with the authenticator app

I managed to change my password two minutes after but how could this happen? With google every time you try to sign in with an unrecognised ip address/device it will get you to confirm it with a known device.