Numerous Unwanted Authenticator Prompts despite changing passwords

1. Why unrequested Authenticator prompts appear According to Microsoft’s guidance, unrequested sign-in prompts or verification codes typically mean one of the following:

• Someone is trying to access the account using the correct username and is being challenged with MFA.
• Someone accidentally typed the email/phone when trying to sign in to their own account.
• A prompt or code that was legitimately requested earlier is being delivered late.

For Outlook mobile sign-in prompts, Microsoft states that if an “Are you trying to sign in?” prompt appears without being requested, it can be due to:

1. Someone trying to access the account.
2. Someone entering the wrong phone/email.
3. Delayed delivery of a previously requested prompt.

For verification codes, Microsoft gives the same three reasons and emphasizes that without the correct response/code, the account remains safe.

2. How to see if someone is trying to access the account Use the Microsoft account security pages to review activity:
3. Go to the Security basics page for the Microsoft account.
4. Select Review activity to open the Recent activity page.
5. Look at:
   • Unusual activity section: expand any entries and, if they are not recognized, select This wasn’t me.
   • Recent activity section: expand entries and, if something is not recognized, select Secure your account.

This flow is what Microsoft provides for checking and responding to suspicious sign-in attempts.

3. How to stop the prompts and lock down the account Microsoft’s guidance for unrequested prompts/codes is:

• For unrequested Authenticator/Outlook prompts: always select Deny for any request not initiated. Without the correct approval, the account is safe.
• For unrequested verification codes: do not respond to or use any codes that were not requested.

To further lock down the account and reduce unwanted codes/prompts:

1. Review and secure sign-in activity
   • Use Review activity as above and mark any suspicious activity as not yours, then follow the Secure your account flow.
2. Strengthen sign-in and recovery
   • Ensure a strong password is set (already done).
   • Keep Microsoft Authenticator enabled but only approve prompts that correspond to sign-ins personally initiated.
   • Review and update backup security info. If old phone/email methods are no longer controlled, during sign-in choose I don't have any of these and follow the prompts to update security info.
3. Consider going passwordless or adjusting methods
   • Microsoft notes that going passwordless (Windows Hello, Authenticator, SMS/Email codes, security keys) can improve security and reduce reliance on passwords that can be guessed or phished. This does not stop attackers from trying, but it ensures only the correct second factor can complete sign-in.
4. If the account appears compromised or access is lost
   • If sign-in is no longer possible or the password may have been changed by someone else, use the documented recovery paths:
     • Follow the steps in “When you can't sign in to your Microsoft account” to reset the password.
     • If that fails, on the sign-in page select Forgot my password and then I think someone else is using my Microsoft account, and follow the recovery instructions.
5. Escalation options For consumer Microsoft accounts, Microsoft directs users primarily to:

• The automated recovery and security flows described above.
• The Sign-in Helper tool and related self-service support for sign-in issues.

If there are persistent technical errors (for example, repeated “Error 400” or recovery failures), Microsoft’s documentation points to using the official support channels and tools (such as the Sign-in Helper) rather than a separate manual security escalation path for consumer accounts.

In the meantime, the key protective actions are:

• Deny all unrequested prompts.
• Do not use unrequested verification codes.
• Regularly review Recent activity and use Secure your account on anything suspicious.
• Keep security info current and avoid losing access to all security methods at once, as changing all security info simultaneously can trigger a 30‑day restriction.

References:

• What happens if there's an unusual sign-in to your account
• Using Outlook mobile to sign in
• Troubleshoot Microsoft verification code issues
• I can't sign in to my Microsoft account