Why do I keep getting authentication requests when I’m not logging in?

Question

I have changed password multiple times but I keep getting authentication requests constantly. Why is this? Is my password getting compromised even after change? Or are these requests coming from a logged in device or backend?

Answer 1

If someone knows your email address, even if they don't know your password, they can go to Microsoft website to use the "forgot password" option to trigger a 2FA ask. Doesn't mean your account is compromised, it is just that they are trying to reset your password, but if you don't approve the 2FA they will not succeed.

I get that this can get annoying if you receive a lot of these alerts., You can do this to prevent it.

Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.

Answer 2

Review Microsoft account → Security → Review activity first; the activity type will show whether these are failed password guesses, successful access, or background synchronization rather than proving that each new password was compromised.^1^

Interpret the activity

1. Open the Microsoft account Security page by typing account.microsoft.com directly into the browser rather than following a link in an unexpected message.
2. Select Review activity.
3. Expand entries matching the times of the authentication requests. The page covers the previous 30 days and shows the access method, device or app information, IP address, and approximate location.^1^
4. Apply the matching branch:

• Incorrect password entered: The attempt was rejected. This normally means somebody—or an old device or app—used the wrong password. It does not establish that the new password is known.
• Additional verification requested: Microsoft sent a code or approval request as an extra authentication step.
• Successful sign-in or Unusual activity detected: The correct credentials were used. If the entry is not yours, expand it and select This wasn’t me or Secure your account.
• Automatic sync: An email app or service connected to Outlook.com automatically. Recurring entries can come from Exchange ActiveSync, POP3, SMTP, or IMAP, so inspect the app and device details to identify an old phone, mail client, or connected service.^1^

Location alone is not conclusive because mobile and ISP traffic can be routed through another area. Compare the device, operating system, browser, app, and time as well.

If any successful access is not yours

Since the password has already been changed multiple times, do not keep resetting it solely because failed attempts continue. Instead:

1. In Security → Review activity, mark the unknown entry This wasn’t me or Secure your account. Microsoft may then request a password and security-information update.^2^
2. Open Advanced security options, review the registered phone numbers, email addresses, and authentication methods, and remove anything unrecognized.
3. Select Sign out everywhere. This signs the account out of browsers, apps, and other sign-in locations within 24 hours, except Xbox consoles.^3^
4. Reconnect only devices and email applications that you recognize.
5. Enable Microsoft Authenticator or make the account passwordless under Additional security options. Microsoft documents Authenticator, Windows Hello, security keys, and codes as passwordless methods.^4^

Never approve an Authenticator request or provide a code that you did not initiate.

If all entries are failed attempts or unsolicited codes

Changing the password does not stop another person from continuing to enter your publicly known Outlook address. An unsolicited code can also result from someone entering the wrong email or phone number, or from delayed delivery. Without the verification code, that attempt cannot complete.^5^

For persistent attempts against the Outlook address, use a private sign-in alias:

1. Go to Microsoft account → Your info → Sign-in preferences.
2. Add a new alias that is not publicly known.
3. Make it the primary alias.
4. Open Change sign-in preferences and disable sign-in for the old Outlook address.
5. Do not delete the old alias; it can remain your email address for sending and receiving messages.

This prevents the publicly known address from being used as the account’s sign-in name while preserving its mailbox.^6^ Keep the new sign-in alias private—do not use it for newsletters, public profiles, or unrelated registrations.

If the activity is Automatic sync and belongs to one of your devices, update or remove the account in that device’s mail app. A stored old password can repeatedly generate authentication prompts until that connection is updated.

---

References

1. What is the Recent activity page? | Microsoft Support
2. What happens if there's an unusual sign-in to your account | Microsoft Support
3. How to sign out of your Microsoft account everywhere | Microsoft Support
4. How to help keep your Microsoft account secure | Microsoft Support
5. Troubleshoot Microsoft verification code issues | Microsoft Support
6. I'm getting numerous 2FA requests for access to my outlook account - Microsoft Q&A