Unauthorized requests

Question

Recently I get numerous authenticate requests from India on my Authenticator app. Obviously shady action. I do not grant them. However I don’t know why this can happen? I’ve already changed passwords and removed all apps from the authentication. Why are there still requests?

Answer 1

Unrequested prompts in Microsoft Authenticator typically mean one of the following:

1. Someone is trying to sign in to the account using the correct username and possibly a known or guessed password, and is being blocked at the second factor.
2. Someone mistyped their email/phone when trying to sign in, and their attempts are hitting this account instead.
3. A previously initiated sign-in or verification request is being delivered late.

For verification codes and sign-in prompts, Microsoft documents the same causes:

• A malicious attempt to access the account.
• Another user accidentally entering this email/phone.
• Delayed delivery of a previously requested code or prompt.

Because the prompts are still appearing after a password change, it is likely that attackers or mis-typed sign-ins are continuing to submit this username and triggering MFA challenges. As long as the prompts are denied and the attacker cannot complete the second factor, the account remains protected.

Recommended actions based on the documented guidance:

1. Deny every request not initiated personally
   • Always select Deny on any sign-in prompt or code that was not explicitly requested.
2. Review recent sign-in activity
   • Go to the Recent activity / My sign-ins view for the account and review sign-ins and MFA attempts.
   • If unfamiliar activity is found, change the password again and ensure multi-factor authentication remains enabled.
3. Strengthen sign-in and MFA
   • Ensure two-step verification (multi-factor authentication) is enabled so that even if a password is guessed, it is not sufficient to access the account.
   • Consider going passwordless (for example, using Microsoft Authenticator or other passwordless methods) to reduce reliance on passwords that can be guessed or phished.
4. Ignore unrequested codes
   • Do not respond to or enter any verification codes that were not requested. Without the correct response, an attacker cannot complete sign-in.

These steps align with Microsoft’s guidance for unrequested verification codes and sign-in prompts and help ensure the account remains secure even when repeated attempts are made from other locations.

---

References:

• Common problems with two-step verification for a work or school account
• Using Outlook mobile to sign in
• View your work or school account sign-in activity from My Sign-ins
• What happens if there's an unusual sign-in to your account
• What is the Recent activity page?