I'm getting numerous 2FA requests for access to my outlook account

Question

I'm getting numerous 2FA requests for access to my outlook account

David Oxford 20

I'm getting numerous 2-Factor authentication requests for access to my outlook account. All times of the day and night. How do I figure out where this is coming from and/or stop this behavior?

0 comments

Answer accepted by question author

EmilyS726 265.1K Independent Advisor

Hello,

Sign into the account here: https://account.microsoft.com, then go to Security to review the sign in activities. When you reviewed the account's sign in activities, Click into those labeled as "unsuccessful sign in", you can click on it to expand it to review the Session activity. If it is incorrect password, it won't generate a code. If it is request denied xxx, that means this activity had your password entered correctly, and a code was generated, but it didn't pass the two factor verification. In the latter scenario, you want to change the password asap.

If you can NOT find any unsuccessful sign-in with the "request denied" labeling, it can mean that someone only knows your email address for the account, they don't know the password, but they click on "forget password", this can trigger the code as well. In this case, you can do the following:

Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc. As for the new addrss, please do not share it with anyone, don't use it on public platform/forum, don't use it to sign up for services/newsletters, etc.

Steve Bachmann 0 Reputation points

2026-01-14T23:28:00.3566667+00:00

I am having the same problem, 20 requests a day. When I review recent sign in activity, there is nothing there other than my sign-ins. Not sure if this is because it is a personal email as my work email account displays a history of sign-ins so that advice is NA in my case. I changed the password yesterday but nothing changed so perhaps someone is just repeatedly clicking Forgot Password as they know my email address. I also tried signing out of all devices this morning but no change in the onslaught. I guess I will need to try the alias approach as nothing else seems to be working.
Steve Bachmann 0 Reputation points

2026-01-14T23:54:32.9533333+00:00

OK, I changed my primary email alias (my main personal email address) to another one by clicking "Make Primary" on the new one (which was already there as an account username; there was no box to uncheck for the old alias as the comment above said) but my old alias is still listed as an account username (and I think it said when I changed it that I could still use the old one to sign in but wasn't the point to stop that?). Do I need to remove the old one? The "old" address is my primary email account so I cannot stop using it for sending and receiving emails. I also have my phone number listed as a username. I would not be surprised if someone could be trying to use that too to try to sign in (which I never do) but it was never marked as primary. Should I remove that altogether?
EmilyS_726 27,750 Reputation points Volunteer Moderator

2026-01-15T00:09:54.25+00:00

@

Steve, In my instruction, I specifically said not to remove the old alias. but if you want to remove it, you totally can, however, if it is an outlook.com/hotmail.com address, once removed, it is gone forever. So if you need to receive emails on those addresses, then do NOT remove.

Bolded section below is the key step you missed, that's why you didn't find the option to uncheck the box:

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc. As for the new addrss, please do not share it with anyone, don't use it on public platform/forum, don't use it to sign up for services/newsletters, etc.
Steve Bachmann 0 Reputation points

2026-01-15T00:51:30.58+00:00

Thank you, I did miss that extra step. And my old account was not Outlook.com. I managed to get online in a chat with MSFT on this topic after I commented above and they told me the same thing you did. Only tweak was they suggested making up a new Outlook.com email that was very random/not guessable (as it will not be used for anything else); they also suggested removing my phone number as a sign-in method (which I also did).

1 additional answer

Your answer

Steve Bachmann 0 Reputation points

2026-01-14T23:28:00.3566667+00:00

I am having the same problem, 20 requests a day. When I review recent sign in activity, there is nothing there other than my sign-ins. Not sure if this is because it is a personal email as my work email account displays a history of sign-ins so that advice is NA in my case. I changed the password yesterday but nothing changed so perhaps someone is just repeatedly clicking Forgot Password as they know my email address. I also tried signing out of all devices this morning but no change in the onslaught. I guess I will need to try the alias approach as nothing else seems to be working.
Steve Bachmann 0 Reputation points

2026-01-14T23:54:32.9533333+00:00

OK, I changed my primary email alias (my main personal email address) to another one by clicking "Make Primary" on the new one (which was already there as an account username; there was no box to uncheck for the old alias as the comment above said) but my old alias is still listed as an account username (and I think it said when I changed it that I could still use the old one to sign in but wasn't the point to stop that?). Do I need to remove the old one? The "old" address is my primary email account so I cannot stop using it for sending and receiving emails. I also have my phone number listed as a username. I would not be surprised if someone could be trying to use that too to try to sign in (which I never do) but it was never marked as primary. Should I remove that altogether?
EmilyS_726 27,750 Reputation points Volunteer Moderator

2026-01-15T00:09:54.25+00:00

@

Steve, In my instruction, I specifically said not to remove the old alias. but if you want to remove it, you totally can, however, if it is an outlook.com/hotmail.com address, once removed, it is gone forever. So if you need to receive emails on those addresses, then do NOT remove.

Bolded section below is the key step you missed, that's why you didn't find the option to uncheck the box:

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc. As for the new addrss, please do not share it with anyone, don't use it on public platform/forum, don't use it to sign up for services/newsletters, etc.
Steve Bachmann 0 Reputation points

2026-01-15T00:51:30.58+00:00

Thank you, I did miss that extra step. And my old account was not Outlook.com. I managed to get online in a chat with MSFT on this topic after I commented above and they told me the same thing you did. Only tweak was they suggested making up a new Outlook.com email that was very random/not guessable (as it will not be used for anything else); they also suggested removing my phone number as a sign-in method (which I also did).

Answer 1

If you are receiving numerous 2-Factor Authentication (2FA) requests for your Outlook account, it may indicate that someone is attempting to access your account or that there are misconfigurations in your security settings. Here are some steps you can take to investigate and mitigate this issue:

Check Sign-in Activity: Review your sign-in activity to see if there are any unfamiliar locations or devices trying to access your account. You can usually find this in your account security settings.
Change Your Password: If you suspect unauthorized access, change your password immediately to secure your account.
Review Connected Devices: Check the devices that are connected to your account. Remove any that you do not recognize or no longer use.
Enable Security Notifications: Ensure that you have security notifications enabled, which can alert you to suspicious sign-in attempts.
Contact Support: If the issue persists, consider contacting Microsoft support for further assistance. They can help you identify any security breaches or provide additional steps to secure your account.
Consider Using App Passwords: If you are using legacy applications that do not support modern authentication, you may need to set up app passwords for those applications.

By following these steps, you should be able to identify the source of the 2FA requests and take appropriate actions to stop them.

References: