Microsoft Authenticator unrecognised login attempts

Question

I have been getting frequent login attempt request notifications popping up on my Authenticator app. I obviously deny these requests as soon as they come through. I have force logged out of all my accounts and have changed my password. When I review recent account activity no activity is showing there of these attempts. How can I stop these attempts and secure my account if these are indeed people trying to gain access into my Microsoft account.

Answer 1

Unexpected Authenticator prompts should always be denied. A denied prompt means the sign-in was not approved, so the account remains safe unless a prompt is accidentally approved.

To secure the account and reduce these prompts:

1. Review account activity again from the security pages.
   • For a personal Microsoft account, go to the Security basics page and select Review activity.
   • On the Recent activity page, if an event appears under Unusual activity, expand it and select This wasn't me. If it appears under Recent activity, select Secure your account.
2. Change the password if there is any chance someone knows it.
   • This was already done, which is the correct step.
   • For work or school accounts, unsuccessful sign-ins can mean someone is guessing the password. Microsoft recommends multi-factor authentication, and if the sign-in shows Additional verification failed, invalid code, the password should still be changed because the primary credentials may already be known.
3. Verify security settings.
   • Make sure two-step verification remains enabled.
   • Review security info and update it if needed.
4. Check Authenticator notification delivery issues.
   • Delayed prompts can happen. An unrequested prompt can mean someone is trying to access the account, someone entered the wrong phone or email, or a previously requested prompt was delayed.
   • If prompts are arriving incorrectly or behaving unexpectedly, ensure the device clock is set to automatic and restart the device. Also make sure push notifications are enabled and the phone is not in Do Not Disturb or Quiet mode.
5. If the account is personal and the prompts continue, change the sign-in alias.
   • Accepted Microsoft Q&A guidance in the provided material recommends creating a new alias, setting it as the primary sign-in alias, and disabling sign-in for the old exposed alias. This can stop repeated attempts that target the old sign-in name while keeping the mailbox active.
6. If the account is work or school, review sign-in activity in My Sign-ins.
   • Search for unsuccessful activity and confirm unusual activity there.
   • If repeated prompts continue, the IT admin should review sign-in logs and security settings.

About the missing entries in recent activity:

• The Recent activity page does not show all account activity. It usually shows significant events that could affect account security, so denied prompts or every failed attempt may not appear there.

If a prompt was not initiated, select Deny every time and do not approve it.

---

References:

• Using Outlook mobile to sign in
• What happens if there's an unusual sign-in to your account
• View your work or school account sign-in activity from My Sign-ins
• Troubleshoot problems with Microsoft Authenticator
• What is the Recent activity page?
• Microsoft Authenticator keeps sending log in requests when I'm not trying to log in. - Microsoft Q&A
• Hi, I get in the last 24 hours numerous requests to sign in to my account by approving a certain number in my Authenticator app, this requests was not made by me, how can protect myself? - Microsoft Q&A