Repeated login attempts to my microsoft account

Question

Repeated login attempts to my microsoft account

DH 0

I have been receiving many login approval requests through my authenticator app the past two weeks from unrecognized sources. I continually deny them. I had not changed any of my passwords and had not received these in the past. Because of this, I changed my microsoft password a few days ago and am still getting the authenticator notifications. I've checked my login history and these login attempts do not show up? Should I be concerned and what other security measures can I take? Thank you for any help.

Carolyne 1,151 Reputation points Microsoft Employee

2026-06-23T09:01:48.4066667+00:00

Password change didn't work — revoke active sessions: Since prompts continue after your password change, the attacker may have a cached token. Go to https://account.live.com/consent/manage and revoke all app permissions and sessions. Also check https://account.live.com/proofs/manage to ensure no unfamiliar recovery methods (emails/phone numbers) were added.

Stop the prompts permanently: Enable passwordless sign-in at https://account.microsoft.com/security to remove your password as an attack vector entirely. Failed sign-in attempts often don't appear in activity history because the attacker is being blocked at the MFA stage — keep denying prompts and once passwordless is enabled, they'll have no way to trigger notifications.

Your answer

Carolyne 1,151 Reputation points Microsoft Employee

2026-06-23T09:01:48.4066667+00:00

Password change didn't work — revoke active sessions: Since prompts continue after your password change, the attacker may have a cached token. Go to https://account.live.com/consent/manage and revoke all app permissions and sessions. Also check https://account.live.com/proofs/manage to ensure no unfamiliar recovery methods (emails/phone numbers) were added.

Stop the prompts permanently: Enable passwordless sign-in at https://account.microsoft.com/security to remove your password as an attack vector entirely. Failed sign-in attempts often don't appear in activity history because the attacker is being blocked at the MFA stage — keep denying prompts and once passwordless is enabled, they'll have no way to trigger notifications.