Microsoft Authentication

Question

I keep getting requests for authentication that I didn’t initiate. Hackers. I have updated all my passwords that I am aware of that were needed to be changed.

how can I see where this request is coming from? What app or account is requesting this? I can’t locate this information anywhere.

Answer 1

Unrequested authentication prompts indicate that something is repeatedly trying to sign in as the account. To see what is generating these and from where, use the account’s sign‑in activity views and then secure the account.

1. Identify the source of the prompts

A. Work or school (organization) account

1. Go to the My Account portal: https://myaccount.microsoft.com/ and sign in with the work or school account.
2. Select My sign-ins or Recent Activity.
3. Expand entries around the times the unexpected prompts appear and review:
   • Application being accessed.
   • Location/IP-based region (may be approximate, especially on mobile networks).
   • Browser and operating system.
4. This view shows which app or service is attempting to sign in and from what environment.
5. If any sign-in (successful or unsuccessful) is not recognized, immediately change the password and then open Security info (https://mysignins.microsoft.com/security-info) to review and update authentication methods.

B. Personal Microsoft account (Outlook.com/Hotmail, etc.)

1. Open the Recent activity page: https://account.live.com/Activity.
2. Review sign-ins from the last 30 days, focusing on:
   • Time of the sign-in.
   • Device or app details.
   • Location.
3. Match these times with when the unrequested prompts appear to see which app or device is trying to authenticate.
4. If anything looks unfamiliar, follow the guidance on that page, then change the password and update security settings.
5. How to handle the unrequested prompts

When an “Are you trying to sign in?” prompt appears that was not initiated:

• Always choose Deny.
• Possible reasons include:
  1. Someone is actively trying to access the account.
  2. Another person mistyped the email/phone when signing in.
  3. A previously requested prompt is delayed.
• Denying the request ensures that even if the password is known, the sign-in is blocked.

3. Check for repeated unsuccessful sign-ins

In My sign-ins / Recent activity:

• Unsuccessful sign-ins may indicate password-guessing attempts.
• If you see entries with “Additional verification failed, invalid code”, it means the password was correct but the second factor stopped the sign-in. In that case:
  • Change the password again.
  • Go to the Security info page and review all security methods.

4. Narrow down which app or device is involved

For work or school accounts:

1. On the Review recent activity page, use the Search box to filter by:
   • Status (for example, type Unsuccessful).
   • Other details such as app, location, or device.
2. Confirm any unusual activity directly from the My sign-ins page.

On Android with Microsoft Authenticator:

1. Open Microsoft Authenticator.
2. Select the work or school account.
3. Tap Recent account activity.
4. Review the list and correlate entries with the times you receive prompts to see which sign-in attempts are triggering them.
5. Ongoing protection steps

• Keep multi-factor authentication enabled so that a password alone cannot grant access.
• Regularly review My sign-ins / Recent activity for unfamiliar entries.
• Immediately change the password and update security info if any sign-in is not recognized.

These steps let the account owner see which app or service is requesting authentication, from what device/location, and then block or respond to suspicious attempts.

---

References:

• Using Outlook mobile to sign in
• View your work or school account sign-in activity from My Sign-ins
• Check the recent sign-in activity for your Microsoft account
• What happens if there's an unusual sign-in to your account