We are getting Microsoft code

Question

Dear support

On daily basses we are getting a Microsoft code, we don't know what's a root cause, even the students are getting the same things. kindly help us to resolve the issue ASAP.

Answer 1

Do not share or use unsolicited codes; have an Entra administrator correlate each affected student and SMS timestamp with the Microsoft Entra sign-in logs to identify the application, authentication method, originating IP/location, and policy that generated the request.

An unsolicited verification code can indicate either an attempted account sign-in or an incorrectly entered phone number, so the SMS alone does not establish that an account was compromised.^1^

Immediate instructions for students

Tell affected users to:

• Not reply, share, or enter the code unless they initiated the sign-in.
• Not approve any unexpected Authenticator prompt associated with it.
• Not open SMS links. If the message is uncertain, users should open the school portal or Microsoft sign-in page themselves.
• Record the following for IT, without sending the actual code:
  • Date and exact time, including time zone
  • SMS sender name or number
  • Last two digits of the receiving phone number
  • Whether they were signing in, resetting a password, registering MFA, or using a new device
• Report any successful access they do not recognize and change their password through the institution’s normal password-reset process.

Microsoft can send a code during sign-in, identity verification, or sign-in from a device it has not seen before. Messages may display Microsoft or 69525, but an unsolicited message must still be investigated.^1^

Correlate each SMS with Entra sign-in activity

An administrator with at least the required log-reading permissions should:

1. Open the Microsoft Entra admin center.
2. Go to Entra ID → Monitoring & health → Sign-in logs.
3. Filter by:
   • The affected student
   • A narrow time range around the SMS
   • Interactive user sign-ins, where applicable
4. Open each matching event and inspect:
   • Status and failure reason
   • Application/resource
   • IP address and location
   • Device and client details
   • Conditional Access
   • Authentication Details

A Reports Reader is the least-privileged role documented for accessing Entra activity logs.^2^

In Authentication Details, determine whether SMS was attempted, whether MFA succeeded or failed, and which policy caused the challenge. The event can show Conditional Access, per-user MFA, or Security Defaults, as well as failures such as an unused code, duplicate attempt, incorrect code, or blocked user.^3^

Interpret the results as follows:

• Matching expected sign-in: identify the application or workflow repeatedly requesting MFA and review the policy/session behavior.
• Failed sign-ins from unfamiliar sources: treat them as suspicious attempts. Reset the affected account’s password, revoke unfamiliar sessions through your established administration process, and investigate the source pattern.
• Successful unfamiliar sign-in: handle it as a potential account compromise and start your institution’s incident-response process immediately.
• No matching Entra event: check whether the phone number is attached to another Microsoft personal, work, or school account. The SMS may also result from somebody entering that number by mistake. The message alone cannot identify the account involved.

Check whether this is tenant-wide

If your tenant has Microsoft Entra ID P1 or P2:

1. Go to Entra ID → Authentication methods → Activity.
2. Review Usage for SMS sign-in activity and failures.
3. Review Registration and recent registration/reset events.
4. Compare the timestamps and affected-user pattern.

This dashboard reports authentication-method registration and usage, including SMS, but its data is not real-time and can have up to 36 hours of latency.^4^

If many students receive messages at approximately the same time, preserve representative timestamps and sign-in records, then open a Microsoft support case through your organization’s Microsoft 365/Entra support channel. Include tenant details privately, affected-user count, UTC timestamps, sign-in correlation/request IDs, applications, and authentication results—never include SMS codes in the case description.

---

References

1. Why is Microsoft texting me? | Microsoft Support
2. How to access activity logs in Microsoft Entra ID
3. Use the sign-in logs to review Microsoft Entra multifactor authentication events
4. Authentication Methods Activity