How do I find out which account is compromied in Authenticator?

Question

I have multiple accounts in my authenticator app. I continue to recieve login attempts that push the numbers to my authenticator app to verify. I deny them, but I need to know which account it is that is compromised. It just has my email address. How do I get more details?

Answer 1

Unrequested approval prompts mean someone is trying to sign in with the email address shown in the prompt. The prompt itself only shows that email, not which specific “tile” in Microsoft Authenticator is being targeted.

Use these steps to narrow down which account is affected and confirm activity:

1. Always deny any prompts not initiated.
   • For any “Are you trying to sign in?” prompt that was not requested, select Deny. This keeps the account safe even if someone has the password.
2. Check recent sign-in activity for that email address.
   • For work or school accounts, open My sign-ins (for example via the Recent account activity or My sign-ins experience) and review:
     • Unsuccessful sign-ins and their details (location, app, time).
     • Any entries with “Additional verification failed, invalid code” under Session activity – this indicates the password was correct but MFA failed, which strongly suggests someone else is trying to use that account.
   • If unfamiliar sign-ins are found, change the password and review/update security info for that account.
3. Use Authenticator’s account view for work/school accounts.
   • In Microsoft Authenticator, select each work or school account and open Recent account activity (if available) to see sign-ins tied to that account. The account that shows repeated failed or unusual attempts is the one being targeted.
4. Distinguish between personal vs work/school accounts.
   • If the prompt shows the same email address that appears both as a Personal account and a Work or school account, the sign-in could be for either. In that case:
     • Review sign-in activity for the work or school account as above.
     • For the personal Microsoft account, review its recent activity and security alerts (unusual sign-in emails or SMS messages) and update password and security info if anything looks unfamiliar.
5. If you see repeated unsuccessful sign-ins.
   • This can mean either mistyped credentials or an attacker guessing the password. Enabling and keeping multi-factor authentication active is recommended so that even if the password is known, the attacker cannot complete sign-in.

If any account shows unfamiliar or repeated failed sign-ins, treat that account as compromised: change its password, confirm security info, and keep denying unrequested prompts.

---

References:

• Using Outlook mobile to sign in
• View your work or school account sign-in activity from My Sign-ins
• What happens if there's an unusual sign-in to your account
• Which account do you want to use?
• Troubleshoot problems with Microsoft Authenticator