Log in requests multiple times per day

Multiple unexpected sign-in requests per day usually mean that someone or something is repeatedly trying to sign in to the account, and multifactor authentication (MFA) is correctly blocking them by asking for approval.

Do the following immediately:

1. Do not approve any sign-in prompts not initiated personally
   Decline or ignore every unexpected notification.
2. Check recent account activity
   Go to the account’s recent activity page and review sign-ins. If any activity is not recognized, use the built-in option to secure the account and follow all recommended steps (such as changing the password and reviewing security info).
3. Change the account password
   Change to a strong, unique password that is not reused on other sites. This helps stop repeated sign-in attempts if the old password was compromised elsewhere.
4. Harden sign-in with MFA
   Ensure a secure MFA method is configured, such as Microsoft Authenticator or Outlook mobile sign-in:
   • For Microsoft Authenticator, follow the steps in the Authenticator documentation to add the account and use it as the primary sign-in method.
   • For Outlook mobile, verify that Sign-in requests is enabled for the account if using it as an MFA/sign-in method.
5. Remove old or unused sign-in methods/devices
   In the account security settings, remove phone numbers, email aliases, or devices that are no longer used. This reduces attack surface.
6. Scan devices for malware
   Run a full, up-to-date antivirus scan on all devices used to access the account to ensure there is no malware capturing credentials.

If sign-in prompts continue after changing the password and securing the account, keep rejecting the prompts and monitor recent activity regularly; this indicates ongoing but unsuccessful attempts that MFA is blocking.

References:

• Using Outlook mobile to sign in
• Sign in using Microsoft Authenticator
• What is: Multifactor Authentication
• About Microsoft Authenticator