Authenticator requests

Question

I have had almost 40 Authenticator requests in the last two days and this was not me. Please could you incorporate and IP logger in the requests to I can choose to block the suspected hacker also allow me N option to unblock the IP should I block my own by mistake. You should also have the ability to send a message to that computer user to notify that IP has been blocked and hopefully this will stop them trying. It is concerning because I use one drive for my family albums and I would hate this to be Accessed and even deleted

Answer 1

Hello @Micheal Morris

I understand that receiving a lot of unauthorized access attempts to your account is very concerning. I will do my best to assist you based on information I have gathered from similar cases. To better assist you, may I confirm:

Are you using a personal email account (e.g., @outlook.com, @hotmail.com) or a business account (e.g., @companyname.com) that belongs to an organization?

This activity typically occurs when your email address or username becomes visible to automated scripts on the internet. When an unauthorized sign-in attempt is made using your email, the system automatically sends a notification to your Microsoft Authenticator app as part of its security design.

You need to do the right thing by consistently denying these requests. This helps protect your account and prevent unauthorized access.

I understand that you would like to trace the source of these attempts. However, as an independent advisor, I can only recommend steps to strengthen your account security and reduce repeated notifications based on your account type.

(From what I know, the system only logs completed sign-in attempts (successful or failed due to incorrect passwords or timeouts. As a result, these denied attempts may not appear on the Recent Activity page for tracing purposes: What is the recent activity page?)

1/ If you are using personal account:

You can set up an additional sign-in alias. These options help reduce unwanted sign-in attempts and provide an extra layer of protection.

-Sign in to your Microsoft account

Go to: https://account.live.com/names/manage

-Choose “Add email”

Start adding a new alias (do not remove anything yet).

-Create a new email alias

Use a strong, hard-to-guess address (e.g., random string).

Set it as your primary login email

-Make the new alias your main sign-in address.

-Disable login for your old email

This is critical, it blocks attackers from using the old address.

-Remove the old email alias if you no longer need it (Optional, last step)

For your reference: Change the email address for your Microsoft account | Microsoft Support

I have attached screenshots to help you with the process:

2/ If you are using business account:

You can reach out to your IT Admin, who has global administrative rights in your organization’s tenant, to help strengthen your account security and prevent repeated notifications by referencing this thread.

Getting too many authentication attempts on my account - Microsoft Q&A

If you still need my assistance, please come back with screenshots or any additional details so I can review it again and see if there’s anything more I can help you with.  

Wishing you all the best!

---

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in "our documentation" to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Microsoft Authenticator and Microsoft account security do not provide a user feature to add an IP logger to approval prompts, manually block or unblock individual attacker IPs from those prompts, or send a message to the remote device.

What is supported:

1. Review the sign-in activity immediately.
   • For a personal Microsoft account, open the Recent activity page and review each unusual sign-in.
   • Expand each event to see details such as the IP address, location, device or operating system, and browser or app used.
   • If an event is not recognized, select This wasn't me. That starts Microsoft’s account protection flow and prompts for a password change and security info updates.
2. Change the account password now.
   • Repeated unexpected Authenticator prompts can indicate that the account credentials are known to someone else.
   • Use a strong, unique password that has not been used before.
3. Keep multifactor authentication enabled.
   • MFA makes account compromise much harder because a sign-in requires more than just the password.
   • An authenticator app is described as faster and more secure than text-message codes.
4. If the account becomes blocked, use the account recovery path.
   • For Outlook.com or Microsoft account blocking caused by unusual sign-in activity, use Sign-in Helper.
   • If unblocking by security code or password change does not work, use the Microsoft account sign-in recovery flow referenced there.
5. If the prompts continue, reduce exposure of the sign-in identifier.
   • Microsoft Q&A guidance in similar cases recommends adding a new account alias, making it the primary sign-in alias, and changing sign-in preferences so the old public address is no longer used for sign-in.
   • Keep the old address for email if needed, but do not use the new sign-in alias publicly.
6. Check storage concerns separately.
   • If Outlook.com mailbox or OneDrive storage is full, email sending and receiving can be affected, but that is separate from the suspicious sign-in issue.

For the concern about OneDrive family albums, the most important immediate actions are: review Recent activity, mark unknown events as This wasn't me, change the password, and verify security info is current.

---

• What is the Recent activity page?
• What happens if there's an unusual sign-in to your account
• Unblock my Outlook.com account
• The keys to the kingdom - securing your devices and accounts
• Hi, I get in the last 24 hours numerous requests to sign in to my account by approving a certain number in my Authenticator app, this requests was not made by me, how can protect myself? - Microsoft Q&A