Single Use Code received when user account already have MFA activated. Why?

Question

User claim she did not sign-in at all based on email time of single use code sent.
However, I have already activated MFA for user sign-in. What kind of microsoft services would send a single use code in this case?

I suspect that there is unauthorized access to user account. Given that, my user received a single-use code email from microsoft, i believe that this unauthorized person has successfully entered my user's password.

correct me if i am wrong? need help to explain what is going on.

Answer 1

Hi techno0b,

Good day.

Thank you for sharing some information with me.

As you mentioned below information:

User claim she did not sign-in at all based on email time of single use code sent

My company is using a Microsoft Business Basic Account. The email that receive this single use code belongs to one of the staff.

==============================================================================

Regarding this situation, as Office 365 global admin can check Sign in logs Sign-in logs in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn to check or track sign in activities of user account.

Furthermore, as an Office 365 global admin may need to contact our Office 365 support team on the back-end side via an open service request so they can diagnose this specific scenario through some more technical resources, if needed, they may be collecting some logs information for further diagnosis. Since we forum moderators have limited permissions and access resources, due to this reason we are unable to collect certain detailed information in the public forum for data privacy. After diagnosing the scenario via technical support team, they can provide possible information on their side.

For this standard process, here's the official document for the global admin: Get support - Microsoft 365 admin | Microsoft Learn

Note: End users need to contact Office 365 global admin department in your organization to do some standard and particular procedure.

Important note: If any organization's Office 365 Business/Business/Education subscription is from a syndicated partner or reseller, and if the global admin can't open the service request on your end, you may need to contact the reseller's support provider so they can help the global admin open the service request on your end. after the Office 365 support team can participate in the service request.

I would really appreciate your valuable time. Thank you for your kind cooperation.

Sincerely

Darpan

Answer 2

Hi

My company is using a Microsoft Business Basic Account. The email that receive this single use code belongs to one of the staff.

Thank you.

Answer 3

Hi techno0b,

Good day.

Thank you for connecting with us in the Microsoft Community.

According to the description, before moving forward, could you please allow me to gather the following important information?

1. What type of subscription email account is it? Is Microsoft 365 Business Basic/Standard/Premium/Education or Microsoft 365 Home & Business/Family or personal subscription account, or personal email account Outlook.com?

Initially, I asked for this information because I was unable to find this information in the topic description so that we can both understand a specific situation. This information is necessary to know your specific scenario. Different subscriptions and different types of email accounts have different service and support options.

I'll wait for your next update on it. In addition, I will provide you with certain information accordingly.

Thank you again for your valuable time and kind cooperation.

Sincerely

Darpan