A tool for managing user identities, credentials, and access across on-premises and cloud environments
A single-use (verification) code email that was not requested usually means one of the following:
- Someone is trying to sign in to the account.
- Someone mistyped their phone number or email when trying to sign in.
- A code that was legitimately requested earlier was delayed in delivery.
Do not use or reply to any codes that were not requested. Without the code, an attacker cannot complete sign-in, so the account remains protected.
Microsoft support and community moderators cannot see who requested the code or provide that information. To improve security and reduce unwanted codes, enable or move to passwordless sign-in methods such as Windows Hello, Microsoft Authenticator, SMS or email codes, or physical security keys, as described in the passwordless guidance.
If unexpected codes continue, review and harden the account’s security settings and consider going passwordless using the documented steps.
References: