possible token theft microsoft account

Question

since any time now I receive attempts on my microsoft authenticator regarding my outlook email address.

I get them daily mostly like once or twice a day.

I figured that when you get a 2fa attempt hackers are passed your password, I did change my password but i still get the attempts, as far as I know i'm only logged in onto my pc and on my phone + my browser is set to delete all cookies after closing.

This leaves me the options that it might be token theft.

authenticate gives you the country where it was originated from but the security dashboard only show active logins not failed attempts anymore to originate an ip-address.

Is there anything I can do or is there to fully revoke tokens?

Answer 1

I think that those daily prompts usually mean an old refresh token is still being replayed somewhere… changing the password doesn’t stop those.

what’s worked for me is going to https://mysignins.microsoft.com/security-info and doing a full “sign out everywhere” and it forces all tokens to be re‑issued and stops the prompts.