Uninitiated Autheticator verification requests

Unexpected Authenticator prompts can mean one of three things:

1. Someone is trying to access the account.
2. Someone entered the wrong phone number or email by mistake.
3. A previously requested prompt was delayed.

A stronger sign of an actual attack is a pattern such as:

• many repeated sign-in attempts
• failed authentications
• sign-ins from multiple IP addresses
• unusual or unfamiliar locations, browsers, operating systems, or apps
• repeated interrupted sign-ins, especially where the password is correct but strong authentication is required

To check whether this is suspicious:

1. Do not approve any prompt that was not initiated. Select Deny for requests that were not requested.
2. Review recent sign-in activity:
   • For a work or school account, go to My Account > Recent Activity and review each sign-in.
   • Look beyond location alone. Mobile networks and VPNs can make locations appear wrong. Also check the operating system, browser, and app.
3. If any successful sign-in is not recognized, change the password immediately and then review/update Security info.
4. If prompts continue, consider moving to a passwordless sign-in method if available for the account, since Microsoft documents this as a way to further secure the account.

What would indicate a likely attack in this case:

• six prompts in 18 hours is not normal if none were initiated
• if the recent activity page shows repeated failed attempts, multiple IPs, or unfamiliar successful sign-ins, that is a strong indicator of someone trying to get in
• if there are only failed or denied attempts and no recognized successful sign-in, the account is still protected as long as no unexpected prompt or code is approved

For work or school accounts, if a phone was lost or stolen or sign-in methods need to be reset, the organization Help desk can clear the settings.

References:

• Using Outlook mobile to sign in
• View your work or school account sign-in activity from My Sign-ins
• Common problems with two-step verification for a work or school account
• Microsoft Entra security operations for user accounts
• Check the recent sign-in activity for your Microsoft account