Single Use Codes - repeated email request notifications

There are always attempts around the world to guess account passwords. There isn't much you can do about these constant attempts. The more unique and complex your password, the less likely they will ever be successful. Remember to keep a copy of your password somewhere safe so you can never be locked out of your own account. Set a recovery email address that can't be guessed and single-use code emails will entirely stop.

For anyone having this issue in 2025, here is a guide on how to get rid of the single-use code emails:

https://www.yourwindowsguide.com/2025/04/microsoft-single-use-code-email.html (Guide with screenshots)

Hiding or disabling the sign-in capability for your email would get rid of the single-use code emails. Hiding it would mean that it is not possible to log in using the same, but you can use it for emailing. For that, do the steps below:

• Make a new Alias for login purposes at this link.
• Next, fix this alias as the primary alias at https://account.live.com/names/manage page.
• Now, the next step is to disable the sign-in capability for the the original email, which is possibly hacked in a data breach. Concurrently, You can manage that on this page. Uncheck the Email and click Save.
• Furthermore, as expected, you can still send and receive email from the old Alias – you have just disabled the capability of it to sign in. Remember to keep the new alias secret or use elsewhere. The dropdown on Outlook apps, like Android and Outlook New on Windowswould show you all your addresses to send an email from.
• Now, when someone would try to use the breached address, they will hit an error. The error message would say that the Email does not exist.

MICROSOFT - CHANGE YOUR VERIFICATION METHOD. I should need to sign into my account in order to receive a single-use code. As it is now, anyone who has knows my email address can get a single-use code., which is a huge security risk. This is not acceptable and everyone else knows it.

A single-use code is only generated when people know your email recovery address (that is, the 2nd address associated with your primary account). Since the first few characters are provided as a prompt, it can be easily guessed by potential hackers (let's face it - people forget their recovery email address if they have several accounts, so the prompt is helpful). For me, it was a business address that could be guessed by looking at my LinkedIn profile. Once I changed my recovery address to a completely private one, the single-use codes stopped coming. I am not keen on Microsoft's suggestion to set up an alias because I lack the confidence to configure it properly, but it seems like a good option for eliminating worldwide login attempts.

Yes. I agree.