Authentication requests although changed password

Password changes and removing a passkey do not stop attackers from trying to sign in. They only prevent those attempts from succeeding.

What is happening:

• Someone still knows or is guessing the username for the account and continues to submit sign-in attempts.
• Each time the primary sign-in step succeeds (or gets far enough), Microsoft sends a second-factor request to Authenticator.
• As long as the attacker keeps trying, Authenticator will keep showing “approve/deny” prompts, even if the attempts ultimately fail.

What to do to stop or reduce these prompts and secure the account:

1. Never approve any unexpected request
   Treat every unrequested prompt as a possible attack. Deny it and do not share any codes.
2. Review recent sign-in activity
   • Go to the My Sign-ins or Recent activity page for the account.
   • Look for successful or suspicious sign-ins (unfamiliar locations, devices, or apps).
   • If any activity is not recognized, immediately change the password again and then update security info.
3. Turn on and harden multifactor authentication
   • Ensure multifactor (two-step verification) is enabled on the account.
   • Use strong methods such as Microsoft Authenticator, Windows Hello, or a FIDO2/security key.
   • This ensures that even if the password is guessed, the attacker cannot complete sign-in.
4. Go passwordless if possible
   • For work/school accounts, consider going passwordless (for example, using Authenticator, Windows Hello, or a security key instead of a password).
   • Passwordless sign-in significantly reduces the value of password-guessing attacks and helps stop repeated code prompts.
5. Check for compromise indicators
   • If any successful sign-in from an unfamiliar location or device is found, treat the account as compromised:
     • Change the password.
     • Review and update all security info (phone, email, methods).
     • Sign out of all sessions and re-register MFA if needed.
6. Ignore unrequested verification codes
   • If verification codes are received by SMS or email that were not requested, do not use them.
   • These often indicate someone is trying to access the account or mistyped an address. Without the code, they cannot complete sign-in.

The prompts themselves mean attackers are attempting to sign in, not that they are succeeding. By keeping multifactor authentication enabled, monitoring sign-in activity, and optionally going passwordless, the account remains protected and the impact of these attempts is minimized.

References:

• View your work or school account sign-in activity from My Sign-ins
• Common problems with two-step verification for a work or school account
• The keys to the kingdom - securing your devices and accounts
• What happens if there's an unusual sign-in to your account