Repeated unauthorized Microsoft Graph Command Line Tools access despite two-step verification being enabled

Question

Hello Microsoft Support Team,

I am experiencing a concerning security issue with my personal Microsoft account and would appreciate your assistance.

Issue Description:

On October 14, 2026, I started receiving repeated security notification emails stating that "Microsoft Graph Command Line Tools" had been granted access to my Microsoft account.

I received notifications at approximately:

• 1:57 AM

10:11 AM

2:05 PM

The main issue is that I have repeatedly removed Microsoft Graph Command Line Tools from my account's authorized applications, but I continue receiving notifications about it, and the application appears again in my account.

I have never knowingly installed, used, or authorized Microsoft Graph Command Line Tools.

Furthermore, two-step verification was already enabled on my Microsoft account before these incidents began.

Security Checks and Actions Taken:

Verified that two-step verification is enabled.

Checked my recent sign-in activity and found no clearly suspicious successful sign-ins.

Verified that the registered Windows device belongs to me.

Repeatedly removed Microsoft Graph Command Line Tools from the authorized applications list.

Despite removing it, I continue receiving security notifications indicating that the application has access again.

My Questions:

Why does Microsoft Graph Command Line Tools keep appearing in my account after I remove its permissions?

Is it possible that someone or an automated process is repeatedly authorizing this application without my knowledge?

How can this happen when two-step verification is already enabled?

Could a compromised session, stolen authentication token, or third-party application be responsible?

How can I identify the source of these authorization requests?

Is there any way to determine whether this application accessed my personal emails, OneDrive files, or other sensitive information?

What steps should I take to permanently prevent this application from accessing my account?

I am particularly concerned because the repeated notifications suggest that the application may be regaining access despite my attempts to revoke its permissions.

I would appreciate guidance on investigating the cause, securing my account, and preventing further unauthorized application access.

Thank you.

Answer 1

I had the same problem. (not a microsoft employee) You need to invalidate the underlying session token. Simply removing the app permission is not enough because the attacker's refresh token automatically renews the access.

Do these three steps immediately to break the loop:

1. Sign out everywhere: Go to https://account.microsoft.com/ -> Advanced security options -> scroll to the bottom and click "Sign me out". This instantly destroys the stolen token the attacker is using.
2. Go Passwordless: In the same security menu, enable "Passwordless account". This removes the password entirely and forces secure FIDO2/Passkey authentication, meaning old scripts or stolen credentials will fail.
3. Check Outlook Rules: Log into Outlook on the web, go to Settings (gear icon) -> Mail -> Rules. Attackers often create a hidden rule here to forward or delete security alerts so you won't notice them. Delete any unknown rules.

Once you force a global sign-out and switch to passwordless, the Microsoft Graph tool will stop reappearing.

---