I'm getting Authenticator verification alerts

Question

Hi, since the Friday I'm receiving lots of Authenticator verification attempts from many countries, I always press deny.

On the same Friday I changed my password because I think it was a hack attempt but the notifications still coming, on Saturday I changed again my password using my phone but the attempts don't stop, I check the account log information or record but my account only shows my own logins but not the all denied attempts.

what is happening?

Answer 1

The alerts mean someone (or something like a script/bot) is repeatedly trying to sign in using the account and triggering Microsoft Authenticator as the second factor. Because Deny is always selected, the attempts are blocked and do not show as successful sign-ins in the activity log.

Key points and actions:

1. Why the prompts keep coming
   • Unrequested prompts can be caused by:
     1. Someone trying to access the account with the correct username/password.
     2. Someone mistyping their own email/phone and accidentally using this account.
     3. Delayed delivery of prompts requested earlier.
   • As long as Deny is selected for prompts not initiated personally, the account remains protected.
2. What to do immediately
   • Continue to deny any prompts not initiated personally.
   • Change the password again from a trusted device and network, using a strong, unique password not reused on other sites.
   • Review account security and recent activity:
     • For a personal Microsoft account, sign in to the Security basics page and use Review activity to check for unusual sign-in attempts on the Recent activity page. If anything suspicious is found, mark it as not yours and follow the Secure your account flow.
3. Strengthen sign-in and MFA
   • Ensure Microsoft Authenticator (or another MFA method) is correctly set up and that only personal devices are registered.
   • Consider going passwordless (for example, using Microsoft Authenticator, Windows Hello, SMS/Email codes, or security keys) to reduce reliance on passwords that can be guessed or reused.
4. When to involve support or admins
   • If this is a work or school account using Microsoft Entra multifactor authentication and unusual activity continues, contact the organization’s IT administrator and ask them to review Microsoft Entra sign-in logs and MFA configuration.
   • If there is any sign that someone has actually accessed the account (not just attempted), immediately change the password and follow the guidance under If someone has accessed your account and Notify us if you don't recognize activity on your account on the Security basics and Recent activity pages.

As long as all unrequested prompts are denied and the password and security info are secured, these attempts are being blocked even if they continue for a while.

---

References:

• Using Outlook mobile to sign in
• Troubleshoot Microsoft verification code issues
• What happens if there's an unusual sign-in to your account
• What is the Recent activity page?
• Common problems with two-step verification for a work or school account