Authenticator Passwordless Sign-In is a Security Vulnerability

Question

I recently enabled Microsoft Authenticator for my Microsoft Account and almost immediately started receiving unsolicited sign-in approval requests originating from countries around the world.

After investigating, I discovered something alarming: anyone who knows your Microsoft account email address can trigger an Authenticator push notification to your phone — no password required.

This fundamentally breaks the purpose of MFA.

Multi-factor authentication exists to ensure that even if one factor is compromised, an attacker still cannot get in. But when a push notification can be triggered with just an email address, the "second factor" becomes the only factor — and it relies entirely on the user never accidentally tapping Approve. That's not security. That's a gamble.

This is a well-known attack called MFA fatigue — flood the user with enough requests and eventually one gets approved by mistake, out of frustration or distraction.

What made this worse? Microsoft's own support team advised me to stop using Authenticator for my Microsoft Account entirely and fall back to password + email/phone OTP. In other words, their recommended fix for a vulnerability in their security app is to use a less convenient, less modern method.

Microsoft, this needs to be fixed at the product level — not worked around by abandoning the feature.

Answer 1

This is also happening to me. I know my password is not vulnerable, no one has it, I have passwordless turned off, and MFA turned on with different mecanisms.
Lately I've been receiving non stop batches of 2-10 MFA authentication requests to MS authenticator at night, near 2AM. All days for a week now. All from a country I'm not from, and from MacOS, which is an OS I don't use, or ever had.

The sign in activity on the MS account is the worst I've seen so far. It will only show your SUCCESSFUL attempts, and not failed, like, the authenticator ones asking for codes and approve.

APPARENTLY, from what I've been reading so far, on multiple forums and on this post as well... If you ever setup MS Authenticator as a 2nd factor, passwordless is automatically enabled, even if your profile says otherwise.
You can see it on your own authenticator app.
These 2 things, indeed, need a fix.

Answer 2

Microsoft Authenticator passwordless sign-in and MFA notifications are working as designed and do not remove the need for strong authentication; they change how the factors are applied.

Key points from the documented behavior:

1. What triggers Authenticator prompts
   • For Microsoft accounts and Microsoft Entra ID accounts, Authenticator is an approved second factor or passwordless method.
   • When a username (email) is entered on a Microsoft sign-in page, the service attempts to complete sign-in using the configured methods for that account. If Authenticator is configured for MFA or passwordless, this can include sending a push notification or requiring a verification code.
   • This is consistent with how most MFA systems work: the first factor (something you know, like a password) or a recognized device/session is used to initiate the challenge, and the second factor (something you have, like the phone with Authenticator) is used to complete it.
2. Why this is still considered multi-factor authentication
   • Multifactor authentication is defined by combining different factor types: something you know, something you have, something you are.
   • Microsoft Authenticator is explicitly documented as a “something you have” factor and can be used for:
     • Passwordless sign-in (where the passkey/Authenticator + device PIN/biometric satisfy the factors)
     • MFA (where Authenticator is the second factor after username/password)
   • In passwordless mode, the factors are:
     • Something you have: the registered device with Authenticator and the bound passkey/credential.
     • Something you are or know: biometric (fingerprint/face) or device PIN.
   • This is described as phishing-resistant and more secure than traditional passwords, which can be stolen or guessed.
3. Protection mechanisms in Authenticator
   • Microsoft Authenticator supports:
     • Passkey-based sign-in with biometric or device PIN, providing phishing-resistant authentication.
     • Notification-based MFA, where the user must explicitly select Verify or Deny.
     • OATH verification codes that must be manually entered.
   • For Microsoft Entra ID, Microsoft has already tightened behavior for suspicious sign-ins:
     • Anomalous sign-ins and sign-ins from unfamiliar locations do not automatically generate push notifications. Users must open Authenticator (or Authenticator Lite in apps like Outlook), refresh, and then explicitly approve the request.
   • This reduces the risk of blind MFA fatigue attacks by removing automatic prompts for risky sign-ins.
4. Why Authenticator and MFA are still recommended
   • Microsoft guidance explicitly recommends enabling and enforcing multifactor authentication, especially for accounts with admin privileges, because password compromise attacks are responsible for most successful account hacks and MFA can defeat almost all of them.
   • Microsoft Authenticator is recommended as a more secure second factor than SMS because:
     • Authenticator codes are generated locally and cannot be intercepted like text messages.
     • Passwordless and passkey-based flows reduce reliance on passwords entirely.
   • For compromised accounts, Microsoft’s remediation guidance includes:
     • Resetting passwords.
     • Updating app passwords.
     • Enabling and enforcing MFA.
5. Practical mitigations against MFA fatigue While the context does not list every mitigation, it documents several behaviors and recommendations that directly reduce risk:
   • Use passkey/passwordless sign-in with Authenticator and biometric/PIN, which is phishing-resistant and does not rely on passwords.
   • Rely on Authenticator notifications where the user must consciously select Verify or Deny; this is still a strong “something you have” factor.
   • For Entra ID accounts, anomalous sign-ins no longer auto-trigger notifications; users must open the app and refresh to see and approve them.
   • Turn on MFA everywhere possible, not just for Microsoft accounts, to reduce the impact of password compromise.
6. Why falling back to password + email/phone OTP is not preferred
   • The documentation emphasizes that:
     • Passwords can be stolen, hacked, or guessed.
     • SMS/email OTPs can be intercepted or phished.
     • Authenticator and passwordless methods are more secure than traditional passwords plus SMS.
   • Therefore, moving away from Authenticator to password + OTP is a downgrade in security posture compared to properly used Authenticator-based MFA or passwordless sign-in.

In summary, Microsoft Authenticator passwordless and MFA flows are designed to strengthen account security by replacing or augmenting passwords with stronger factors (passkeys, biometrics, device PINs, and locally generated codes). Microsoft’s official guidance continues to recommend Authenticator and MFA as primary defenses against account compromise, and additional controls (such as suppressing notifications for anomalous sign-ins) are in place to reduce the effectiveness of MFA fatigue attacks.

---

References:

• How to help keep your Microsoft account secure
• Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
• The keys to the kingdom - securing your devices and accounts
• Respond to a compromised cloud email account