Hello george nygard,
Those requests do not necessarily mean someone has accessed your account, but do not approve any request you did not initiate.
Open your Microsoft account Security page, select Review activity, and check for unfamiliar activity. If you find any, select This wasn’t me or Secure your account, then change your password to a new, unique one. Also review your security information and remove any email address, phone number, or Authenticator device you do not recognize.
Keep two-step verification enabled. Microsoft also recommends passwordless sign-in for stronger protection.
If no unfamiliar successful sign-ins appear and you continue denying the prompts, there is no indication from the available information that anyone has entered your account.