Microsoft Authenticator is spamming requests from other countries

Question

This is more a feature request rather than a question

I have the Microsoft Authenticator app on my phone, and it works well for securing my account however I'm constantly getting requests from two specific countries trying to log into my account. I feel like I should be able to set a list of "Allowed countries" that actually will actually send a notification to my phone and all other countries think they have sent the request (It looks the same so they can't trial and error to spoof their location) but in reality, the attempt gets logged and investigated.

I feel like this should be a basic feature for all Microsoft accounts from both a quality of life and security position. Scammers don't even try my password anymore they just spam the authenticator even thought I always deny.

Probably not even the best place to raise this concern but I'm sure someone will point me in the right direction or make enough noise to have MS take notice. I assume this is quite a prolific issue given the number of scammers out there.

Answer 1

Same issue - I ended up turning off notifications for my Authenticator as I was getting out of country authentication prompts every few hours.

Answer 2

Hello @William C,

Thank you very much for sharing your thoughts and for taking the time to describe your experience in such detail. We truly appreciate the feedback.

To clarify, for Work or School accounts managed by an organization, it is possible to control or restrict sign‑ins by location using Conditional Access policies. This allows administrators to block or allow access based on countries or regions as part of the organization’s security configuration.

For your reference: Conditional Access - Block access by location - Microsoft Entra ID | Microsoft Learn

However, for personal Microsoft accounts, this type of location‑based access control is not currently available. We completely understand your concern and agree that this would be a valuable quality‑of‑life and security enhancement for personal account users.

Your suggestion is very valid, and we truly appreciate you taking the time to raise it. To ensure your feedback reaches the right audience, we recommend submitting this idea directly through the Microsoft Feedback Portal

The Product Team actively monitors this feedback site, and many features have been developed or improved based on user comments and suggestions. After submitting your request, you’re welcome to return here and share the feedback link in this thread so other users can view and upvote it, helping bring more visibility to your idea.

Thank you again for your valuable input and for helping improve the Microsoft experience.

Kind regards,

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Country-allow lists for Microsoft Authenticator notifications are not available as an end-user feature. Microsoft Authenticator itself already uses location signals to help protect sign-ins and can deny authentications when GPS-reported locations are inconsistent, but it does not expose a setting to only allow prompts from specific countries.

For consumer Microsoft accounts, unusual sign-in attempts from new locations or devices are handled by Microsoft’s account protection system, which sends alerts (email/SMS) and may require additional verification when suspicious activity is detected. These protections are automatic and cannot be customized per country by the end user.

To provide feedback or request features such as country-based allow lists for Authenticator prompts, use the official feedback channels in Microsoft products (for example, the Feedback option in the Microsoft Authenticator app or on the Microsoft account/security pages). This ensures the request is visible to the product team for consideration.

If repeated prompts are coming from attackers who already know the password, changing the account password and reviewing recent activity for compromise is recommended, as Microsoft’s unusual sign-in detection and alerts are designed to help identify and respond to such activity.

---

References:

• Troubleshoot problems with Microsoft Authenticator
• What happens if there's an unusual sign-in to your account