Attempted 2-step Authenticator request from unknown locations

Question

I am getting multiple 2-step Authenticator requests a day from multiple locations that is not me. Worried my information is at risk. Please advise!

Answer 1

Never approve an Authenticator request you did not initiate; select Deny (and Report suspicious activity if offered), then review the account’s sign-in history immediately.

1. Check whether access succeeded

The steps differ by account type:

Personal Microsoft account (Outlook.com, Hotmail, Xbox, etc.):

1. Open the Microsoft account Recent activity page directly rather than following a link in an email.
2. Expand each unfamiliar event and inspect its time, device, browser/app, and location.
3. For entries in Unusual activity, select This wasn’t me. Microsoft will guide you through changing the password and updating security information. The page covers the last 30 days of significant activity.^1^

Work or school account:

1. Sign in to My Account.
2. Select Recent Activity.
3. Expand the relevant entries and review the result, application, device, and browser—not only the location. IP-based locations, especially on mobile networks, can be inaccurate.^2^
4. If Authenticator offers Report suspicious activity, use it. In an organization where this feature is enabled, the report appears in the Entra sign-in, audit, and risk-detection logs for administrator action.^3^

2. Respond according to the result

If any unfamiliar event says Successful sign-in

Treat the account as potentially compromised:

1. Change its password immediately to a strong, unique password not used anywhere else.
2. Review the registered phone numbers, recovery email addresses, Authenticator registrations, and other security methods; remove anything you do not recognize.
3. Secure the recovery email account with its own unique password and two-step verification.
4. For a personal account, open Advanced security options, scroll to Sign out everywhere, and select Sign out. Sign-out can take up to 24 hours and does not sign out an Xbox console.^4^
5. For a work or school account, contact the organization’s IT/security team immediately. Ask them to review the Entra sign-in logs, revoke active sessions, inspect account changes, and remediate any user-risk detection.

If all unfamiliar attempts are Unsuccessful

The log does not show that those attempts accessed the account. Keep MFA enabled and continue denying unexpected prompts. However, if a work/school log says “Additional verification failed, invalid code,” the primary credentials succeeded and MFA stopped the sign-in; change the password because the password might already be known.^2^

3. Stop repeated prompts on a personal account

If the prompts continue after the account is secured, create a new sign-in alias and prevent the old address from being used for sign-in:

1. Sign in to the Microsoft account alias-management page.
2. Add a new alias and make it the primary alias.
3. Open Change sign-in preferences.
4. Enable sign-in for the new alias and disable sign-in for the old alias.
5. Do not delete the old alias if you still want to receive email sent to it.

This leaves the old address available for email while preventing it from being used to initiate account sign-ins and Authenticator requests.^5^

For a work or school account, do not change the username yourself unless directed by the organization; the administrator should investigate the sign-ins and determine whether a username change or Conditional Access response is appropriate.

---

References

1. What is the Recent activity page? | Microsoft Support
2. View your work or school account sign-in activity from My Sign-ins | Microsoft Support
3. Configure Microsoft Entra multifactor authentication settings
4. How to sign out of your Microsoft account everywhere | Microsoft Support
5. hotmail account comprimised - Microsoft Q&A