Repeated unauthorized login attempts triggering 2FA notifications — how can I block the source?

Question

Repeated unauthorized login attempts triggering 2FA notifications — how can I block the source?

Ryan Cope 30

Hello,

I am receiving numerous unauthorized login attempts per day on my Microsoft / Outlook account. Each attempt triggers a 2-factor authentication notification requesting a code, which I did not initiate.

To be clear, my account is already configured with maximum available security, including:

Passwordless sign-in

Multi-factor authentication enabled

Microsoft Authenticator app

Up-to-date recovery information

Regular review of sign-in activity

No login attempts have been successful, and I do not approve any of these requests. However, the volume of attempts is persistent and disruptive.

My question: How can I block or prevent the source of these repeated login attempts? Is there any way to:

Block specific IP addresses, regions, or devices?

Rate-limit or suppress repeated authentication prompts?

Escalate this as a targeted or automated attack against my account?

I understand that Microsoft does not disclose attacker details, but I would like to know if additional protections or controls are available beyond the standard security features already in place.

Thank you for any guidance on how to fully stop or mitigate these ongoing attempts.Hello,

I am receiving numerous unauthorized login attempts per day on my Microsoft / Outlook account. Each attempt triggers a 2-factor authentication notification requesting a code, which I did not initiate.

To be clear, my account is already configured with maximum available security, including:

Passwordless sign-in

Multi-factor authentication enabled

Microsoft Authenticator app

Up-to-date recovery information

Regular review of sign-in activity

No login attempts have been successful, and I do not approve any of these requests. However, the volume of attempts is persistent and disruptive.

My question:
How can I block or prevent the source of these repeated login attempts?
Is there any way to:

Block specific IP addresses, regions, or devices?

Rate-limit or suppress repeated authentication prompts?

Escalate this as a targeted or automated attack against my account?

I understand that Microsoft does not disclose attacker details, but I would like to know if additional protections or controls are available beyond the standard security features already in place.

Thank you for any guidance on how to fully stop or mitigate these ongoing attempts.

Marcos Losa 11 Reputation points

2026-01-12T20:15:22.86+00:00

I had the same. Increasing a the last month. What i did is to change my email alias to a name difficult to get known by the bots and block all the other alias for sign in. I think the issue is that with the AI there are a lot bots trying to recover passwords using mobile numbers or alias and this triggers the MFA.
Matthew Thompson 25 Reputation points

2026-01-13T01:34:21.5966667+00:00
This has become unbearably frequent for me as well.

I have tried everything I can think of to fix this. I reset my complex >20 character password to a new strong >20 characters password. I initiated "Sign out everywhere" over 24h ago. I changed my primary sign-in alias (new MFA prompts now reference this new alias). I turned off all app access and have waited several hours. I still get pummeled with MFA access requests. I was going to change to passwordless login next, but from OP, this is apparently insufficient.

Edit: I realize that my original alias was not unchecked in my Sign-in preferences. I just unchecked that in favor of the new primary alias. I will see if that helps and share.

Update: This seems to have worked. >12h later and no more fraudulent MFA notifications.

I will share here the exact steps to make this change.
It is notably inconvenient and unintuitive for what I would view as the average user.

Sign in to https://www.microsoft.com/

Click on your name in the top right of the screen ("Account manager for [user]").

Click "My Microsoft account".

Click "Your info" on the left of the screen.

In the "Account info" section, click "Edit account info".

Under "Account username", you should see your username. Click "Add email".

Select "Create a new email address and add it as a username".

Type a new username before "@outlook.com" that would be hard to guess, such as a random word and a few numbers. Record this new username, as it will be the only way you can sign in once this is completed. Note that this is not a new email address that you'll need to monitor. It is just an alias for your account that the fraudulent party does not know about.

Click the blue "Add username" button.

Select "Make primary" for the new username just created.

Under "Sign-in preferences", click "Change sign-in preferences".

Check the box for your new alias/username, and crucially, uncheck the box for your other old username.

Click "Save".

Now, when you attempt to sign in to Microsoft with your old username, you should see "That Microsoft account doesn't exist. Please enter a different account." Simply use the new alternative username alias you created with your existing password to log in.

I now receive emails addressed to both the old username and the new alias username.
Hornblower409 13,000 Reputation points

2026-01-13T03:25:34.2+00:00

As @Matthew Thompson suggested. Separate Login Only and Email Only Aliases

https://www.outlook-tips.net/tips/keeping-hackers-microsoft-accounts/

This does not stop all possible attacks on your account. But if all the Bad Guys have is your Email Only alias (that you use for everything except logging on to your Microsoft account) then they get a "This username has been turned-off for sign in" at the very first step of the logon process and can not continue.

Don't forget to change your default Send From to your EMail Only alias.
View -> View Settings -> Mail -> Sync email -> Set default From address.

https://learn.microsoft.com/en-us/answers/questions/4695951/if-i-change-the-primary-alias-on-my-outlook-accoun
Marcos Losa 11 Reputation points

2026-01-13T14:55:01.4466667+00:00

thats exactly what I did
Hornblower409 13,000 Reputation points

2026-01-13T15:11:40.92+00:00

@Marcos Losa

I am sorry that I missed your suggestion. I tried to edit my answer to give you credit as well but this question is hoarked and I can't change my answer.

Off topic content removed by Moderator
k w 0 Reputation points

2026-02-18T19:21:34.1966667+00:00

This is happening to me too, and it’s honestly frustrating.

At some point people are just going to tap a random number to make it stop. That’s not a user problem, that’s how MFA fatigue attacks work.

Why can someone trigger an Authenticator push without successfully entering a password first? If all they need is my email address, that feels like a design flaw.

It’s even worse for passwordless accounts. If the push is the first step, then you’re basically letting anyone spam the primary authentication factor until someone gets tired and approves it.

And “just change your login username” is not a real solution. Most people have had the same email for years. Security shouldn’t depend on hiding your username.

This feels like something that needs to be fixed in the authentication flow, not worked around by users.

4 answers

Your answer

Marcos Losa 11 Reputation points

2026-01-12T20:15:22.86+00:00

I had the same. Increasing a the last month. What i did is to change my email alias to a name difficult to get known by the bots and block all the other alias for sign in. I think the issue is that with the AI there are a lot bots trying to recover passwords using mobile numbers or alias and this triggers the MFA.
Hornblower409 13,000 Reputation points

2026-01-13T03:25:34.2+00:00

As @Matthew Thompson suggested. Separate Login Only and Email Only Aliases

https://www.outlook-tips.net/tips/keeping-hackers-microsoft-accounts/

This does not stop all possible attacks on your account. But if all the Bad Guys have is your Email Only alias (that you use for everything except logging on to your Microsoft account) then they get a "This username has been turned-off for sign in" at the very first step of the logon process and can not continue.

Don't forget to change your default Send From to your EMail Only alias.
View -> View Settings -> Mail -> Sync email -> Set default From address.

https://learn.microsoft.com/en-us/answers/questions/4695951/if-i-change-the-primary-alias-on-my-outlook-accoun
Marcos Losa 11 Reputation points

2026-01-13T14:55:01.4466667+00:00

thats exactly what I did
Hornblower409 13,000 Reputation points

2026-01-13T15:11:40.92+00:00

@Marcos Losa

I am sorry that I missed your suggestion. I tried to edit my answer to give you credit as well but this question is hoarked and I can't change my answer.

Off topic content removed by Moderator
k w 0 Reputation points

2026-02-18T19:21:34.1966667+00:00

This is happening to me too, and it’s honestly frustrating.

At some point people are just going to tap a random number to make it stop. That’s not a user problem, that’s how MFA fatigue attacks work.

Why can someone trigger an Authenticator push without successfully entering a password first? If all they need is my email address, that feels like a design flaw.

It’s even worse for passwordless accounts. If the push is the first step, then you’re basically letting anyone spam the primary authentication factor until someone gets tired and approves it.

And “just change your login username” is not a real solution. Most people have had the same email for years. Security shouldn’t depend on hiding your username.

This feels like something that needs to be fixed in the authentication flow, not worked around by users.

Answer 1

Kris 0

Same issue. Its annoying and stupid. I want to be able to force those bots to insert a correct password before they can prompt for 2FA. Currently its not possible.

Hornblower409 13,000 Reputation points

2026-06-25T17:21:10.59+00:00

@Kris said

I want to be able to force those bots to insert a correct password before they can prompt for 2FA

Until Microsoft adds something like this, the best you can do is add a Login Only Alias and disable Sign-In for your current email address. Then, if all the Bad Guys have is your email alias, they get "This username has been turned-off for sign in" at the very first step of the logon process and can not continue.

For detailed instructions See the answer by "Hornblower409 Feb 27, 2026" in
https://learn.microsoft.com/en-us/answers/questions/5789093/i-get-a-few-2fa-notifications-from-canada-daily-us

Answer 2

John Q Richardson 0

I have exhausted all options. I'm preparing to go extreme and delete all Microsoft accounts from all my devices.

Hornblower409 13,000 Reputation points

2026-05-25T12:34:21.2333333+00:00

@John Q Richardson said

I have exhausted all options.

You can setup a Login Only Alias and disable Sign-In for your current email address. Then, if all the Bad Guys have is your email alias, they get "This username has been turned-off for sign in" at the very first step of the logon process and can not continue.

See the Answer by "Hornblower409 on Feb 27, 2026" in
https://learn.microsoft.com/en-us/answers/questions/5789093/i-get-a-few-2fa-notifications-from-canada-daily-us

Answer 3

@David Pace Sr said

if the "passwordless" accounts are better or worse to fix the problem.

@k w said

“just change your login username” is not a real solution. Most people have had the same email for years. Security shouldn’t depend on hiding your username.

The solution being proposed has nothing to do with passwords, or the lack thereof, and does not impact the ability of your old email address to send and receive mail.

Login Only Alias

You create a new "secret" alias that only you know. You use it ONLY to logon to your account. Then you remove the Sign-In privilege from your existing email alias so it can not be used to logon to your account but can still be used to send and receive email. Now, if all the Bad Guys have is your old alias, they get "This username has been turned-off for sign in" at the very first step of the logon process and can not continue.

1 -- Create a new Log In Only (LIO) alias. (e.g. "JohnDoe.LIO@...")

https://account.live.com/AddAssocId

2 -- Make the LIO alias your Primary Alias.

https://account.live.com/names%2FManage

3 -- Log out of your account.

Click on your Initials/Profile Picture at the top right and choose "Sign out"

4 -- Verify that you can login using the new LIO alias.

https://login.live.com/

5 -- Uncheck the Sign-in privilege from your old alias. It's now an Email Only (EMO) alias.

https://account.live.com/SignInPreferences

6 -- Change your default "Send From" in Outlook to your old EMO alias.

https://outlook.live.com/mail/0/options/mail/forwarding

-> Email aliases -> Set default From address

References:

https://support.microsoft.com/en-us/office/add-or-remove-an-email-alias-in-outlook-com-459b1989-356d-40fa-a689-8f285b13f1f2

https://www.outlook-tips.net/tips/keeping-hackers-microsoft-accounts/

Answer 4

David Pace Sr 0

I'm having the same problem with at least 10 to 12 login attempts to my account per day.

However, before the attempts/attacks started I received a message that my Microsoft Login information was found on the Dark web.

My questions are to find out if the "passwordless" accounts are better or worse to fix the problem.

Did everyone else here get a warning also, about having your login information compromised, before getting the login attempts?

And if not, and you're sure that your login info was not compromised, were you using a password with login or using the "passwordless" feature?

Because, after reading that the solution was "changing your alias" it makes me wonder if that's all anyone needs for bruteforce attempts to trigger the confirmation requests.

Hornblower409 13,000 Reputation points

2026-02-10T18:56:08.7433333+00:00

@David Pace Sr said

if the "passwordless" accounts are better or worse to fix the problem [of unauthorized login attempts triggering 2FA notifications]

No. Using other forms of authentication instead of a password will not stop the Bad Guys from triggering 2FA notifications on your account. If they have a "Sign-In enabled" email address, that is all they need to start the authentication process.

my Microsoft Login information was found on the Dark web. Did everyone else here get a warning also, about having your login information compromised, before getting the login attempts

No. Numerous email addresses are exposed thru data breaches and normal information sharing that are never reported.

"changing your alias" it makes me wonder if that's all anyone needs for brute force attempts to trigger the confirmation requests

No sure I understand. If someone has you Login/Sign-in enabled email address they can trigger a 2FA notification. If they only have an Email-Only address (one that does not have Sing-In Enabled) then they get "This username has been turned-off for sign in" at the very first step of the logon process, can not continue, and you do not get a 2FA notification.

For more details on how to setup Separate Login Only and Email Only Aliases, see:

https://learn.microsoft.com/en-us/answers/questions/5725931/how-to-stop-multiple-2fa-requests-that-are-not-min

Don't forget to change your default Send From in Outlook to your Email Only alias. (It defaults to your Primary Alias). e.g. For New Outlook: View -> View Settings -> Mail -> Sync email -> Set default From address.