Bogus Microsoft Authenticator Push Notifications

Question

I keep getting fraudulent Microsoft Authenticator push notification requests, which I deny approval each time. I have logged out of all my devices and reset the password multiple times, but this keeps happening. Please advise. How do I change the settings to require the password, BEFORE the mfa Authenticator request is sent?

Answer 1

How do we access any of these points?

Answer 2

To address the issue of receiving fraudulent Microsoft Authenticator push notifications, it's important to ensure that your account is secure and to adjust your settings appropriately. Here are some steps you can take:

1. Review Security Info: Check your security information in your Microsoft account to ensure that there are no unauthorized devices or apps linked to your account. Remove any unfamiliar entries.
2. Enable Additional Context: Configure your Microsoft Authenticator notifications to include the application name and geographic location. This can help you make informed decisions about whether to approve a sign-in request.
3. Use Number Matching: Consider enabling number matching for push notifications in Microsoft Authenticator. This feature requires you to enter a number displayed on the sign-in screen into the Authenticator app, adding an extra layer of security.
4. Report Suspicious Activity: Enable the "Report suspicious activity" setting in the Microsoft Authenticator app. This will allow you to flag any unexpected prompts, which can help in identifying unauthorized access attempts.
5. Contact Microsoft Support: If the problem persists, contact Microsoft Support for further assistance, especially if you suspect that your account may have been compromised.

Unfortunately, there isn't a direct way to require a password before the MFA request is sent, as the MFA process is designed to enhance security by providing a second layer of authentication after the password.

---

References:

• Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
• Zero Trust security recommendations