Unknown account added to Authenticator app asking for approval

Question

There is an unknown account labelled “MSDA/ MDSC” with a 6 digit code, asking for me to approve sign in requests from various locations in the world.

1. Does this mean an account of mine is compromised?
2. What account is associated with MSDA/ MDSC?
3. how to I stop these prompts?
4. can I safely delete this account from my app? Or would it allow them access by deleting it?

Answer 1

Dear @Huynh, Katelynn,

I understand how concerning it is to suddenly see push notifications and sign-in requests from unknown locations for an account labeled "MSDA/ MDSC".

Here are the direct answers to your questions and the exact steps to stop these notifications:
Question 1: What is "MSDA/ MDSC"?

MSDA / MDSC represents an enterprise, work, or school account hosted in Microsoft Entra ID (formerly Azure AD). This usually happens if:

• You previously logged into a work, school, client, or contractor tenant that used this label.
• Another user accidentally linked their account's multi-factor authentication (MFA) setup to your Authenticator app.

Question 2: Is my account compromised?
No. Because your primary personal/main account logs show no suspicious activity, your own credentials are completely safe. The threat actors are attempting to log into that specific MSDA/ MDSC work account, not your personal account. Because your Authenticator app is registered as the authentication method for that account, the push notifications are coming to your phone.

Question 3: Can I safely delete this account from my app? Will it grant them access?
Yes, you can safely delete it.Deleting the account entry from your Microsoft Authenticator app will NOT give them access. In fact, it removes your device as the authentication target, which permanently stops the push notifications from popping up on your phone.
How to stop these prompts immediately:

1. Deny any pending requests: If a notification pops up, tap Deny (and report it as "I didn't request this" if prompted).
2. Remove the account from Microsoft Authenticator:
   • Open the Microsoft Authenticator app on your phone.
   • Tap on the MSDA/ MDSC account entry.
   • Tap the Settings (Gear icon) in the top-right corner.
   • Tap Remove Account.
3. Check device registration (Optional): Go to your phone's Settings > Accounts (or Work / School accounts) and ensure no unknown work profile is attached to your device.

Once removed from your Authenticator app, you will no longer receive sign-in prompts for that account.

For official details on managing accounts in the app, please refer to Common questions about the Microsoft Authenticator app.

Please let me know if you need any further assistance.

---

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in the forum document to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

• An unexpected approval prompt does not by itself mean an account was successfully compromised. It means a sign-in attempt is being made against an account registered in Microsoft Authenticator or another Microsoft sign-in flow. If the requests were not initiated by the account owner, deny them.
• Repeated prompts can happen because someone is trying to access the account, someone entered the wrong phone or email by mistake, or a previously requested prompt was delayed.
• If sign-in history shows unsuccessful attempts, that can mean someone is guessing the password. If there is a note like "Additional verification failed, invalid code," that means the password step succeeded but two-step verification failed; in that case, the password should be changed and security settings updated.

For the unknown “MSDA / MDSC” account label:

• Microsoft Authenticator can show inactive account tiles created by other applications that use Authenticator for single sign-on support.
• Inactive accounts do not need management and can be safely ignored.
• The provided information does not identify what specific service or organization MSDA / MDSC maps to.

To stop or reduce the prompts:

1. In every unexpected prompt, select Deny.
2. Review recent sign-in activity for the affected account:
   • Personal Microsoft account: check the account’s recent activity and secure the account if any events are not recognized.
   • Work or school account: go to My Account > Recent Activity and review sign-ins. If anything looks unfamiliar, change the password.
3. If the account is a work or school account and there are unsuccessful sign-ins, register for or keep using two-step verification. If there is evidence the password was guessed, change the password and update Security info.
4. If Authenticator notifications are arriving incorrectly or constantly expiring, make sure the phone clock is set to automatic, then restart the device.
5. If notifications are appearing only for a problematic account, remove that account from the app and add it again, allowing notifications.

About deleting the account from the app:

• For inactive Authenticator accounts created by other apps, they can be safely ignored.
• If the unknown tile is the problematic account, removing that account from the app and adding it again is a supported troubleshooting step for notification issues.
• Deleting the tile does not approve access for an attacker. Approval requires the correct response and explicit approval.

If the sign-in item is recognized as a real account and not just an inactive tile, the safest response is:

• deny all unrequested prompts,
• review recent activity,
• change the password if any sign-in looks unfamiliar or if two-step verification failed after a successful password step,
• update security settings.

---

• Using Outlook mobile to sign in
• Troubleshoot problems with Microsoft Authenticator
• View your work or school account sign-in activity from My Sign-ins
• View your work or school account sign-in activity from My Sign-ins
• Using Outlook mobile to sign in