Getting too many authentication attempts on my account

Daniel Mariani 0 Reputation points
2026-05-31T14:46:07.93+00:00

I’m getting a few attempts to approve the Authenticator and I’m not doing anything. I’ve changed my password a few times and signed off on all devices but still getting these authentication notifications on Authenticator app. What else ai can do to get this issue resolved?

Microsoft 365 and Office | Subscription, account, billing | For business | Other

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Alina Le 5,805 Reputation points Independent Advisor
    2026-05-31T15:43:44.15+00:00

    Hello @Daniel Mariani

    In this situation, your account is likely being targeted rather than fully breached. Someone appears to have obtained your email address or username and is repeatedly attempting to sign in, which triggers Microsoft Authenticator notifications, even though they do not have your password or full access. This is why simply changing your password may not stop the prompts. Such activity often happens when email addresses are exposed and picked up by automated scripts online. Each unauthorized sign-in attempt triggers a verification request as part of Microsoft’s security system. By consistently denying these requests, you are taking the correct action to protect your account and prevent unauthorized access.

    In this case, as you mentioned your IT Admin, I will guide you as a business account user. I recommend taking the following steps to further strengthen your account security and prevent repeated notifications:

    These steps need to be carried out by your IT Admin, who has global administrative rights in your organization’s tenant.

    1/ Review sign-in logs

    • Microsoft Entra admin center -> Users -> select user -> Sign-in logs
    • Identify unknown locations, repeated attempts, suspicious IPs

    User's image

    2/ Request to block unauthorized sign-ins from foreign countries

    *Step 1: Create trusted location

    • Please go to: Microsoft Entra Admin Center
    • Navigate to: Entra ID -> Conditional Access -> Named locations -> New location
    • Configuration: Type: Countries/Regions
    • Select: Your country (E.g: Afghanistan)
    • Save

    This step defines Vietnam as a trusted location that will be allowed for sign-in.

    User's image

    *Step 2: Create policy to block all other locations

    • Navigate to: Entra ID -> Conditional Access -> Policies -> New policy
    • Configure the policy as follows:
    • "Assignments"
      • Users: All users
      • Exclude: Emergency/admin account (to avoid lockout)
    • "Target resources": Select: All cloud apps
    • "Conditions" -> Location
      • "Configure": Yes
      • Include: Any location
      • Exclude: Vietnam (trusted location created in Step 1)
    • Access control
      • Grant: Block access
    • Enable the policy after configuration.

    User's image

    User's image

    User's image

    Conditional Access - Block access by location - Microsoft Entra ID | Microsoft Learn

    Expected result

    • Only sign-ins from Afghanistan (For example) will be allowed
    • All login attempts from other countries will be blocked
    • Unauthorized access attempts will be stopped before reaching MFA
    • Authenticator spam notifications should be eliminated

    By following these steps, you can keep your account secure while minimizing further notifications. Please let us know if you need any assistance with these settings.

    If you still need my assistance, please come back with screenshots or any additional details so I can review it again and see if there’s anything more I can help you with.  

    Have a nice day!  

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment"

    Note: Please follow the steps in "our documentation" to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

    1 person found this answer helpful.

  2. AI answer

    2026-05-31T14:46:24.07+00:00

    Unsolicited Microsoft Authenticator prompts usually mean someone has the correct username and is repeatedly trying to sign in and hoping the prompts will be approved (“MFA fatigue”). Changing only the password is not always enough if the account or MFA methods are still being targeted.

    Actions to take:

    1. Do not approve any unexpected prompts
      • Always select Deny on any sign-in notification that is not initiated intentionally.
    2. Check for unusual sign-in activity
      • For work/school accounts, ask an IT administrator to review Microsoft Entra sign-in logs to see where the attempts are coming from and whether there is malicious activity.
      • If there are repeated attempts, the admin can investigate and take additional security actions (conditional access, blocking locations, etc.).
    3. Use another verification method temporarily
      • If the prompts are constant, switch to another MFA method (for example, SMS or a different app) if available on the account, and then remove and re-add Authenticator.
      • For work/school accounts, an IT admin can reset MFA so that new methods can be registered. In Microsoft Entra admin center: Users → All users → [your user] → Authentication methods → Require re‑register multifactor authentication. This forces a fresh MFA setup and can break any stuck or misconfigured MFA profile.
    4. Reset MFA if sign-in is blocked after many attempts
      • Microsoft Entra multifactor authentication can temporarily block sign-ins after multiple attempts or unusual activity. In that case, wait for the block to clear and use a different MFA method if possible.
      • If malicious activity is suspected, contact the organization’s help desk or IT admin immediately so they can secure the account and environment.
    5. Keep Authenticator and device secure
      • Ensure the Microsoft Authenticator app is updated to the latest version.
      • Confirm the device’s date/time and network connectivity are correct so legitimate prompts work reliably.

    If this is a work/school account and the prompts continue after these steps, the organization’s IT administrator should be engaged to investigate sign-in logs and adjust security policies.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.