Microsoft Authenticator - False positive?

Question

I had a suspicious activity email a while ago on my outlook account, I changed the password and added extra layers of security to prevent this from happening again. Today I've had multiple notifications that someone is trying to sign in from the Microsoft authenticator app. I've gone into the activity and noticed that it was a sign in from an area I am not in, so I've changed my password again since then and again I've got a notification twice from the Authenticator app that someone is trying to sign in however nothing is shown in activity.

I am extremely concerned someone is trying to get into my account and worried about losing the account. Could I be getting false positives from the app and it's just a little late to me signing into stuff? As I have signed in quite a bit today but not got the notifications till later however I did deny someone from signing in that was in a location I am not about 20 minutes ago.

Can anyone help fix/improve this or stop them from attempting to sign in?

Answer 1

Hi. I'm Brian and I'll try to help.

Have you enabled two-factor authentication or passkeys for yourself? You should. Have you checked to make sure your verification data is correct on the page https://account.live.com/proofs/manage? After changing your password, did you use the "Sign out everywhere" link on that same page to make sure the person attempting login isn't using cached credentials?

Answer 2

@Alex said

Can anyone help ... stop them from attempting to sign in?

Yes. You can create a Login Only Alias and disable Sign-In for your current email address see:

Answer by "Hornblower409 on Feb 27, 2026" in
https://learn.microsoft.com/en-us/answers/questions/5789093/i-get-a-few-2fa-notifications-from-canada-daily-us

however nothing is shown in activity

Because Microsoft nerfed the Recent Activity page. It's now totally useless for routine monitoring. See: https://learn.microsoft.com/en-us/answers/questions/5515503/have-microsoft-changed-the-behaviour-of-the-see-yo

About all you can do is check your Recent Activity page for a "Successful Login", that wasn't you. And by then it's too late.

Answer 3

If you could let me know if my suggestion helped, I'd appreciate it.

Answer 4

Hi Brian, thank you for your assistance. I have two-factor and Passkeys. I did not use the sign out everywhere, will do that now. I changed the password about 2 hours ago again, so far no attempt to log-in again but it's a bit nerve racking.