Getting false sign-in request notifications

Question

Hi! In the past days i recieved a notification to authenticate a sign-in with my account. As it was not me i declined it and created a new never used password. Since then i got 3 other, they never show up at my activity log and im sure no one knows my new password, whats happening?

Answer 1

Those notifications are most likely real sign-in attempts where someone is trying to access the account, but they are being blocked by multi-factor authentication (MFA) before they complete, which is why they do not always appear as normal successful sign-ins in the activity log.

Key points and what to do:

1. Treat every unexpected sign-in prompt as a possible attack
   • Do not approve any sign-in notification that was not initiated personally.
   • This matches the guidance to never respond to sign-in prompts that were not requested and to review recent activity if anything looks suspicious.
2. Check recent sign-in and security activity
   • For a personal Microsoft account, go to the Recent activity page or the Security basics page and select Review activity. Look for:
     • Unusual activity detected
     • Incorrect password entered
     • Any Successful sign-in or Permission given to an application that is not recognized.
   • If any event is clearly not from you, use This wasn’t me or Secure your account where available, and follow the guided steps.
3. Understand why they may not show as normal sign-ins
   • If someone has the username but not the second factor, they can:
     • Trigger MFA prompts that are declined.
     • Generate unsuccessful sign-in or additional verification failed events rather than full “Successful sign-in” entries.
   • The documentation notes that unsuccessful sign-ins or failed additional verification can indicate an attacker guessing the password or failing MFA.
4. Strengthen the account further
   • Since the password has already been changed, also:
     • Ensure two-step verification/MFA is enabled and working on trusted devices only.
     • Review and update security info (phone numbers, alternate emails, authenticator methods) from the Security basics or Security info pages and remove anything unfamiliar.
     • Consider removing all trusted devices and re-adding only personal devices from the Security settings page.
5. Continue monitoring
   • Regularly review Recent activity / My sign-ins to confirm that:
     • Locations, devices, and apps match expected usage.
     • No new unusual activity appears.
   • If repeated prompts continue and suspicious activity is seen, follow the Secure your account flow and keep MFA enabled.

These steps align with Microsoft’s guidance: unexpected sign-in attempts plus MFA prompts usually indicate someone is trying to access the account, but MFA is successfully blocking them. The correct response is to deny all unknown prompts, review recent activity, and keep security info and MFA methods up to date.

---

References:

• View your work or school account sign-in activity from My Sign-ins
• What happens if there's an unusual sign-in to your account
• Check the recent sign-in activity for your Microsoft account
• What is the Recent activity page?
• Using Outlook mobile to sign in