Microsoft Authenticator app unauthorized sign-in request

Select no response in Microsoft Authenticator and let the request time out. Any prompt that was not initiated should simply be ignored.

For unrequested prompts:

1. Do not enter the code or tap Approve.
2. Let the notification expire; this is effectively denying the attempt.
3. Treat it as a possible attack and secure the account.

To secure the account after seeing an unrequested prompt:

1. Sign in to the account only when ready to do so, and only from a trusted device and network.
2. When signing in, the Authenticator prompt or code that appears immediately after entering the username and password is the one tied to that specific sign-in attempt. Use it only if the timing matches the sign-in just performed.
3. After successfully signing in, change the account password and review security info (phone, email, sign-in methods) to remove anything not recognized.
4. Consider enabling or keeping passwordless sign-in (for example, using Microsoft Authenticator, Windows Hello, or security keys) to reduce risk from password guessing or phishing.

If unrequested codes or prompts continue, do not respond to them. Without the correct code or approval, attackers cannot complete sign-in.

References:

• Using Outlook mobile to sign in
• Troubleshoot Microsoft verification code issues
• Common problems with two-step verification for a work or school account
• What happens if there's an unusual sign-in to your account
• View your work or school account sign-in activity from My Sign-ins