Microsoft Security | Microsoft Authenticator
A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Microsoft Authenticator- Successful login from unknown account
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 11%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EE%3C/text%3E%3C/svg%3E)
Em
20
Reputation points
Yesterday I got a lot of Microsoft authenticator requests that I denied. I then went into the authenticator to verify recent activity and I saw that two days ago there was a successful login from an IP in Des Moines, Iowa (unknown device/operating system). I got no notification about this login and any suspicious activity! I marked the activity as suspicious, changed my password, and followed the other suggestions. I just don’t understand why I was not notified. Also, when I googled the IP, it looks like it’s coming from a Microsoft data center? 2a01:111:f402:f139::f148. Does anybody have any insight into what could’ve happened and or what I should do at this point to protect my account?
Microsoft Security | Microsoft Authenticator
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 17%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHY%3C/text%3E%3C/svg%3E)
HDA@YWG 10 Reputation points2025-07-27T20:51:16.5533333+00:00 Hello. I woke up today to find a notification on the Authenticator app. It was expired, but when I checked the activity, it said that it was successful. I don't know how they were able to setup the Authenticator app without me receiving any kind of notification, text, email, etc. It was also from the US, obviously fake, and it also had an IPv6 IP address that pointed to a Microsoft server. I changed the password as soon as I saw that. I didn't see anything missing, but who knows what really happened.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 3%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETS%3C/text%3E%3C/svg%3E)
Todd Staple 20 Reputation points2025-08-06T04:45:49.8266667+00:00 I also had activity that said successful login from somewhere in Canada. I have a passwordless account and I did not approve anything that I did not initiate. How is this possible?
-
Todd Staple 20 Reputation points
2025-08-06T04:50:47.0433333+00:00 One of the IP addresses was 2a01:111:f402:f155::f170 which is apparently a Microsoft data center or at least that is what Copilot is advising. Maybe this is a personal vault access on One Drive?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 31%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Thomas 50 Reputation points2025-08-09T12:04:23.76+00:00 Same here, I have this happening 5 times now, all from those ips from Microsoft Data Center. I thought it was something related to the mobile apps, but I had one successful sign-in from Canada again, at 2 am, when I wasn't using anything.
I think it is something related to microsoft acting in a really weird way, but it is really scary. People has been complaining about it here on the forums and on reddit and there is no official answer from Microsoft so far.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 67%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYI%3C/text%3E%3C/svg%3E)
Yassine IBN EL HASSAN 0 Reputation points2026-04-18T11:35:14.7133333+00:00 Any answer to this matter? I'm in the same situation. Can you tell me where I can see the location of this request
Sign in to comment
Sign in to answer