How to stop people trying to get into my account

For a personal Microsoft account, create a private alias for signing in and block your public email address from sign-in; your existing email and account data remain unchanged, but attempts using the known address can no longer reach the 2FA prompt.

Personal Microsoft account

1. Sign in to your Microsoft account and open Your info.
2. Select Manage how you sign in to Microsoft.
3. Under Account aliases, choose Add email and create a new address that you do not publish or use for email.
4. Open Your info → Sign-in preferences.
5. Allow sign-in with the new private alias.
6. Clear the checkbox for the public email address receiving the unwanted attempts, then select Save. Microsoft permits sign-in to be blocked for selected aliases while those aliases continue to share the same account, contacts, storage, subscriptions, and settings.^1^

Important: Record the private alias securely before blocking the old address. You will need the private alias—not the public email address—to sign in. Do not remove your existing email alias unless you intentionally want to detach it from the account.

Do not approve any unexpected Authenticator request or provide its code. An unsolicited request can mean that somebody is attempting access or entered an address by mistake.^2^

Check whether anyone succeeded

Open the Microsoft account Security page and select Review activity. Examine the last 30 days for:

• Incorrect password entered: the attempt was rejected.
• Additional verification requested: a security-code or Authenticator challenge occurred.
• Successful sign-in or Unusual activity detected: expand the event and select This wasn’t me or Secure your account when appropriate.^3^

If there is an unrecognized successful sign-in:

1. Change the password to a new, unique password.
2. Update the account’s security information.
3. From Advanced security options, select Sign out everywhere. This signs the account out of browsers and apps within 24 hours, except Xbox consoles.^4^

Keep two-step verification enabled. Turning off Authenticator notifications or MFA would remove the warning rather than stop the sign-in attempts.

If this is a work or school account

Personal-account alias controls do not apply. Contact the organization’s IT administrator and ask them to inspect Microsoft Entra sign-in logs; Microsoft specifically recommends this for repeated, unsolicited MFA attempts.^5^

The administrator can also enable:

Microsoft Entra admin center → Entra ID → Authentication methods → Settings → Report suspicious activity → Enabled → choose users/groups → Save.

This lets users report an unexpected Authenticator prompt. The report appears in sign-in and audit logs and flags the user as high risk for investigation and remediation.^6^

References

1. Block an email address from signing in | Microsoft Support
2. Why is Microsoft texting me? | Microsoft Support
3. What is the Recent activity page? | Microsoft Support
4. How to sign out of your Microsoft account everywhere | Microsoft Support
5. Common problems with two-step verification for a work or school account
6. Configure Microsoft Entra multifactor authentication settings