Two-step verification suddenly required for mail apps?

Enjoying the quiet here at the end of the week before the holidays, when out of the blue a user gets this message in Mail on their iPhone:

They're currently unable to send or receive emails from their phone. I've looked around at all of our settings, but we don't have two-factor enabled for anyone right now, so I'm stumped. I haven't heard reports from any other users (though a lot of them use the Outlook app), but I haven't changed any of our Exchange or Security setting in a few weeks, either, so I'm not sure what would have triggered this all of a sudden. Any thoughts before I open a support ticket?