Suspect Authenticator Request

Question

I have gotten an authenticator request for a login action that I did not requests. It is coming from the Netherlands but I am based in the USA (I don't use a VPN). I denied it and changed my password but have gotten the request since then. I reviewed the login history but I don't see that anyone else logged in except me.

Answer 1

The fact that you see prompts but no successful foreign logins usually means Conditional Access and MFA are blocking them, but they already know your UPN/email and are repeatedly trying to authenticate. Changing the password helps but doesn’t stop someone from continuing to trigger MFA challenges.

Log into https://mysignins.microsoft.com and https://myaccount.microsoft.com from a clean trusted device and review everything carefully. Check “Security info” and remove any authentication methods you do not explicitly recognize. Regenerate and replace any existing MFA methods rather than just leaving the old ones in place. If you have push notifications enabled in Microsoft Authenticator, enable number matching and location context and consider temporarily removing push approvals entirely and switching to TOTP codes or, even better, a FIDO2 hardware key. Also go to https://mysignins.microsoft.com/security-info and use the option to sign out everywhere and revoke sessions. Then review https://mysignins.microsoft.com and look specifically for failed sign-in attempts from unfamiliar countries; repeated failures confirm someone is targeting the account even if they never succeeded.

Also secure the associated email account and devices. Run full malware scans and remove unknown browser extensions.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.