unsure if my account has been compromised

Those repeated unknown sign-in prompts mean someone or something is repeatedly trying to sign in with the account credentials, but the extra verification step is blocking access as designed.

What to do now:

1. Review recent sign-in activity
   • For a work or school account, go to the My Account portal → Recent activity and review each sign-in.
   • Confirm that the suspicious attempts are not legitimate false positives (for example, mobile IPs can appear from other regions). Check location, operating system, browser, and app details, not just the country.
   • If you see any successful sign-in you do not recognize, immediately change the password and then go to the Security info page to update security settings.
2. Treat repeated unsuccessful attempts as a security signal
   • Unsuccessful sign-ins can mean either mistyped credentials or that an attacker is trying to guess the password.
   • If you see entries like “Additional verification failed, invalid code,” it means the password was correct but the second factor stopped the sign-in. In that case, change the password right away and review/update security info.
3. Strengthen protection
   • Ensure multi-factor authentication is enabled and kept active. With MFA, even if a password is guessed, it is not enough to access the account.
   • Regularly review and update security info (phone, alternate email, authenticator) from the Security info or Security basics pages, and remove methods that are no longer under control.
4. If sign-in attempts are very frequent
   • Microsoft Entra multifactor authentication can detect unusual activity like repeated sign-in attempts and may temporarily block additional attempts to counter security threats.
   • If there is suspicion that someone is actively trying to access a work or school account, contact the organization’s IT administrator and ask them to review Microsoft Entra sign-in logs.

These steps will not stop attackers from trying, but they ensure that attempts remain unsuccessful and that any real compromise is detected and contained quickly.

References:

• View your work or school account sign-in activity from My Sign-ins
• What happens if there's an unusual sign-in to your account
• Check the recent sign-in activity for your Microsoft account
• Common problems with two-step verification for a work or school account