A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Those lock-screen notifications are Microsoft Authenticator MFA prompts. They appear when something (often a website, app, or background process) is trying to sign in with the account protected by Authenticator.
If these prompts appear when not actively signing in, treat them as suspicious and deny them:
- Select Deny on every unexpected notification.
- Do not approve any request unless actively signing in and the request details (account, app, location if shown) match what is being done.
- Open the Authenticator app and review recent sign-in requests to see if there are repeated or anomalous attempts.
- Change the account password immediately and review security info at the account security page to ensure only trusted methods and devices are listed.
- Consider enabling additional protections (such as number matching or location details) if available in the Authenticator configuration, so that unexpected prompts are easier to detect.
If notifications stop after denying and changing the password, they were likely caused by someone or something repeatedly trying to sign in with the account.
References: