Share via

Authenticator requests

Full service Frank 0 Reputation points
2026-06-17T18:23:04.8566667+00:00

I get Authenticator notifications that there is a sign in request. The sign in request was not made by me. How do I find out who’s trying to get on my account?

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments No comments

2 answers

Sort by: Most helpful
  1. Alina Le 2,615 Reputation points Independent Advisor
    2026-06-18T10:21:28.06+00:00

    Hello @Full service Frank

    I understand that receiving a lot of unauthorized access attempts to your account is very concerning. I will do my best to assist you based on information I have gathered from similar cases. To better assist you, may I confirm:

    • Are you using a personal email account (e.g., @outlook.com, @hotmail.com) or a business account (e.g., @companyname.com) that belongs to an organization?

    This activity typically occurs when your email address or username becomes visible to automated scripts on the internet. When an unauthorized sign-in attempt is made using your email, the system automatically sends a notification to your Microsoft Authenticator app as part of its security design.

    You need to do the right thing by consistently denying these requests. This helps protect your account and prevent unauthorized access.

    I understand that you would like to trace the source of these attempts. However, as an independent advisor, I can only recommend steps to strengthen your account security and reduce repeated notifications based on your account type.

    (From what I know, the system only logs completed sign-in attempts (successful or failed due to incorrect passwords or timeouts. As a result, these denied attempts may not appear on the Recent Activity page for tracing purposes: What is the recent activity page?)

    1/ If you are using personal account:

    You can set up an additional sign-in alias. These options help reduce unwanted sign-in attempts and provide an extra layer of protection.

    -Sign in to your Microsoft account 

    -Choose “Add email” 

    • Start adding a new alias (do not remove anything yet). 

    -Create a new email alias 

    • Use a strong, hard-to-guess address (e.g., random string). 
    • Set it as your primary login email 

    -Make the new alias your main sign-in address. 

    -Disable login for your old email 

    • This is critical, it blocks attackers from using the old address. 

    -Remove the old email alias if you no longer need it (Optional, last step)  

    For your reference: Change the email address for your Microsoft account | Microsoft Support

    I have attached screenshots to help you with the process:

    17817780684279222089923792395218

    2/ If you are using business account:

    You can reach out to your IT Admin, who has global administrative rights in your organization’s tenant, to help strengthen your account security and prevent repeated notifications by referencing this thread.

    Getting too many authentication attempts on my account - Microsoft Q&A

    If you still need my assistance, please come back with screenshots or any additional details so I can review it again and see if there’s anything more I can help you with.  

    Wishing you all the best!


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

    Note: Please follow the steps in "our documentation" to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?


  2. AI answer

    2026-06-17T18:23:13.8266667+00:00

    Unrequested Microsoft Authenticator notifications mean a sign-in attempt is being made with the account, but they do not reveal who is trying to sign in.

    Based on the documented behavior, the most that can be determined is:

    1. Why these prompts appear
      • Someone is trying to access the account.
      • Someone accidentally entered the phone number or email when trying to sign in.
      • A prompt that was legitimately requested earlier is being delivered late.
      In all of these cases, the identity of the person or system making the attempt is not exposed in the Authenticator notification itself.
    2. How to respond to these prompts
      • Select Deny on any sign-in request that was not initiated.
      • This keeps the account safe because sign-in cannot complete without explicit approval.
    3. What to do next to protect the account

    There is no supported way in the provided documentation to see the real-world identity of whoever is attempting the sign-in; only that an attempt is being made and should be denied if not initiated.


    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.