If my Microsoft authenticator app gets triggered does this mean someone has my password?

Tim 26

Hello, so I am wondering if my password has been compromised and I know my question is specific, but im looking for a general answer here. I recently went on my outlook email to see my recent login activity and it seems like someone with a vpn is trying to brute force my account. I've changed my password and double checked any other accounts that might be compromised. I just want to know if the condition to trigger the app to ask for the code requires a successful password to be used or if a incorrect password use would do this. Also the prompt the app was giving me was the standard approve or deny with 3 a choice of 3 numbers that should be on the screen of the person who is trying to login. Thanks

Accepted answer

Dave Patrick 426.1K Reputation points MVP

2022-12-27T02:20:26.643+00:00

Yes, it could trigger so don't approve unless it was you that triggered the logon attempt.
https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/advanced-microsoft-authenticator-security-features-are-now/ba-p/2365673

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.

1 person found this answer helpful.
Tim 26 Reputation points

2022-12-27T04:47:54.407+00:00

Blockquote

So someone had my password. Scary good thing I had 2 step auth, ive done all I could to narrow down how someone managed to get my password and my conclusion is a database leak possibly. Make sure to change your passwords every now and then! I really wish I could see my login activity beyond 28 days that way I can figure out how long someone has been trying to get into my account.

Bjoern Peters 8,781 Reputation points

2022-12-27T13:09:01.627+00:00

Hi @Tim

Your password may or may not have been stolen!

The auth request also can be triggered, e.g., by an open outlook application which (sometimes) tries to reconnect, or the Teams application also periodically tries to reauth... and sometimes this triggers an auth request in the app.

So if your PC/Laptop is not running and there is not a possibility that an application might re-auth when this request pops up... then it is very suspicious.

I hope my answer is helpful to you,

Your
Bjoern Peters

If the reply was helpful, please upvote and/or accept it as an answer, as this helps others in the community with similar questions. Thanks!

Tim 26 Reputation points

2022-12-27T22:32:47.03+00:00

Interesting thanks!
Sign in to comment

If my Microsoft authenticator app gets triggered does this mean someone has my password?

0 additional answers