Random Login Notifications

Question

I keep getting random authentication notifications, like someone is trying to login to my account.

They cannot get in because I have authentication via the app but wanted to know if this can be stopped as it seems like a random algorithm is just cycling through peoples accounts looking to break in?

Answer 1

Random, repeated sign-in prompts usually mean automated or malicious attempts are trying to access the account, and Microsoft’s protections are blocking them.

Key points and what can be done:

1. Microsoft already treats this as unusual activity
   • Microsoft Entra multifactor authentication and Microsoft account security detect unusual or repeated sign-in attempts and can block or challenge them with extra verification to counter security threats.
   • When unusual sign-ins are detected, Microsoft may block sign-in, require extra verification, or send alerts so the account owner can confirm if it was them.
2. Review activity and confirm it isn’t legitimate
   • Sign in to the Microsoft account’s Security basics page and open Review activity to see the Recent activity and Unusual activity entries.
   • For any sign-in that wasn’t initiated by the account owner, mark it as This wasn’t me or Secure your account. This helps Microsoft tune protections and can reduce repeated prompts from the same pattern or source.
3. Ensure MFA and Authenticator are correctly configured
   • Keep Microsoft Authenticator updated to the latest version.
   • Make sure notifications are enabled and the device time is set automatically, so legitimate prompts work reliably and can be distinguished from suspicious ones.
4. When there are many attempts
   • Microsoft Entra multifactor authentication can temporarily prevent additional attempts after multiple sign-in failures to counter security threats. If many prompts appear in a short time, this throttling helps protect the account.
   • If there is concern that someone is actively targeting the account, contact the organization’s IT administrator (for work/school accounts) so they can review Microsoft Entra sign-in logs and consider additional protections (for example, conditional access policies, location-based restrictions).
5. Stopping prompts entirely
   • The prompts themselves are a sign that unauthorized attempts are being blocked by MFA. They cannot be fully “turned off” without weakening security, but their impact can be reduced by:
     • Reviewing and securing the account so suspicious attempts are flagged and blocked.
     • Ensuring no trusted devices, sessions, or app passwords are misconfigured.

As long as strong passwords and multifactor authentication are enabled and recent activity is monitored, these random prompts indicate that attacks are being stopped rather than that the account is at immediate risk.

---

References:

• Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
• What happens if there's an unusual sign-in to your account
• Common problems with two-step verification for a work or school account
• Troubleshoot problems with Microsoft Authenticator