Uninitiated Autheticator verification requests

Tim Purcell 0 Reputation points
2026-10-05T18:01:29.1766667+00:00

I have received at least 6 uninitiated authentication requests in the last 18 hours. How do I tell if I'm being attacked?

Microsoft Security | Microsoft Authenticator
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daniel-Vo 6,610 Reputation points Microsoft External Staff Moderator
    2026-10-06T12:00:50.3566667+00:00

    Dear @Fredrik Mattsson,

    Good day! Welcome to Microsoft Q&A forum!

    Repeated unexpected Microsoft Authenticator prompts usually mean someone is attempting to sign in and has reached the verification step. This does not mean the account is compromised, but the prompts should never be approved.

    This can happen when someone knows your Microsoft account username and is attempting to sign in. Therefore, please follow these steps to help secure your account:

    1 - If you are using a personal Microsoft account

    You can use any of your aliases to sign in, and you can select any of them for sending and receiving email. Verification codes sent by email can only be sent to your primary alias or another email address added as a verification method. Therefore, you can change your primary email address while you still able to use it as alias email. Prevent from unknown sign-in attempts.

    You may follow the steps in the Microsoft KB below to add a new alias: Change the email address for your Microsoft account | Microsoft Support

    To help stop unauthorized sign-in attempts, you can:

    • Create a new email alias (a random string)
    • Set the new alias as your primary sign-in email
    • Disable sign-in access for the old email alias

    As a result: Unknown users will no longer be able to attempt to sign in using your previously exposed email address.

    2 - If you are using Business Account

    If you are an end-user, you can reach out to your Global Administrator or IT-Support team to further improve account security and help prevent repeated authentication notifications. They can support to change your primary email address and keep the current email as alias so you can keep send and receive email from the alias email address. For more information on how to change alias: Add another email alias for a user - Microsoft 365 admin | Microsoft Learn

    To review your account activity, you can go to https://mysignins.microsoft.com/ . Then select Recent activity from the left pane

    User's image

    If you are an administrator, you can check the sign-in logs in https://entra.microsoft.com/

    1. Navigate to Users > All users. User's image
    2. Search for your account and open the Sign-in logs. User's image
    3. The sign-in logs will display all login attempts, including whether they were successful or failed. You can review the status messages in the event details for more information. For example:   Screenshot of the sign-in error code on the basics tab.

    Supported KB:  

    Kindly let me know when there are updates or if you need further assistance. Any updates you’re able to share would be really helpful.

    I'm here and happy to help! Thank you for your kindness and patience! 

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-05T18:01:46.1633333+00:00

    Unexpected Authenticator prompts can mean one of three things:

    1. Someone is trying to access the account.
    2. Someone entered the wrong phone number or email by mistake.
    3. A previously requested prompt was delayed.

    A stronger sign of an actual attack is a pattern such as:

    • many repeated sign-in attempts
    • failed authentications
    • sign-ins from multiple IP addresses
    • unusual or unfamiliar locations, browsers, operating systems, or apps
    • repeated interrupted sign-ins, especially where the password is correct but strong authentication is required

    To check whether this is suspicious:

    1. Do not approve any prompt that was not initiated. Select Deny for requests that were not requested.
    2. Review recent sign-in activity:
      • For a work or school account, go to My Account > Recent Activity and review each sign-in.
      • Look beyond location alone. Mobile networks and VPNs can make locations appear wrong. Also check the operating system, browser, and app.
    3. If any successful sign-in is not recognized, change the password immediately and then review/update Security info.
    4. If prompts continue, consider moving to a passwordless sign-in method if available for the account, since Microsoft documents this as a way to further secure the account.

    What would indicate a likely attack in this case:

    • six prompts in 18 hours is not normal if none were initiated
    • if the recent activity page shows repeated failed attempts, multiple IPs, or unfamiliar successful sign-ins, that is a strong indicator of someone trying to get in
    • if there are only failed or denied attempts and no recognized successful sign-in, the account is still protected as long as no unexpected prompt or code is approved

    For work or school accounts, if a phone was lost or stolen or sign-in methods need to be reset, the organization Help desk can clear the settings.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.