Authenticator push notifications that aren’t me

For a personal Microsoft account, create a new sign-in alias and block the exposed email address from signing in; for a work or school account, report the prompts to your IT administrator so they can investigate and revoke sessions.

If this is a personal Microsoft account

Changing the password again may not stop attempts made against a known email address. Keep denying every request, then:

1. Sign in directly at account.microsoft.com—do not use a link from an unexpected message.
2. Select Your info → Sign-in preferences.
3. Add a new email alias with Add email. An alias belongs to the same account and retains the account’s contacts, storage, subscriptions, and settings.^1^
4. Make the new alias primary.
5. Under Sign-in preferences, allow sign-in with the new alias and clear the checkbox for the old email address, then select Save.^2^
6. Do not delete the old alias. Blocking it from sign-in lets you continue using that address for email while preventing it from being used as the account’s username.

Use a new, private alias that you do not publish or use for ordinary correspondence.

Check whether access actually succeeded

Open Security → Review activity. The Recent activity page covers the last 30 days and shows the access method and location.^3^

• Expand unfamiliar entries.
• For an entry under Unusual activity, select This wasn’t me.
• For suspicious entries under Recent activity, select Secure your account.
• Pay particular attention to Successful sign-in, profile or security-information changes, and applications granted permission. An incorrect-password or denied-MFA entry does not indicate a successful sign-in.

Because you have already changed the password multiple times, do not repeat that unless the activity page specifically directs you to secure the account.

If you find a successful sign-in or other unauthorized change:

1. Open the Microsoft account security dashboard’s Additional security options.
2. Select Sign out everywhere.
3. Expect browsers and apps to be signed out within 24 hours; Xbox consoles are excluded.^4^
4. Review the account’s recovery email, phone numbers, Authenticator registrations, trusted devices, and app permissions; remove anything you do not recognize.

If this is a work or school account

Contact your organization’s help desk or Microsoft 365 administrator. Microsoft advises involving IT when repeated prompts may be malicious, because administrators can inspect the Microsoft Entra sign-in logs.^5^

Ask the administrator to:

• Investigate the affected account’s sign-in and authentication details.
• Revoke sessions to invalidate active refresh tokens.
• If necessary, select Require re-register MFA, which removes the existing Authenticator and other MFA registrations before requiring fresh setup.^6^
• Enable Report suspicious activity so unsolicited Authenticator prompts can be reported and recorded in the tenant’s sign-in, audit, and risk reports.^7^

Never approve or enter a number for a prompt you did not initiate. MFA is preventing access only while the request remains denied.

References

1. Change the email address for your Microsoft account | Microsoft Support
2. Block an email address from signing in | Microsoft Support
3. What is the Recent activity page? | Microsoft Support
4. How to sign out of your Microsoft account everywhere | Microsoft Support
5. Common problems with two-step verification for a work or school account
6. Manage user authentication methods for Microsoft Entra multifactor authentication
7. Configure Microsoft Entra multifactor authentication settings