MFA from Outlook

Question

MFA from Outlook

Handian Sudianto 7,471

From two week ago i often get this prompt when open outlook in my android devices.

This prompt isn't will executed after someone enter the right password? If yes then i fell strange because from i got this prompt first time then i already reset the password until 3 times. This mean that person know my new password?

User's image

Hornblower409 16,050 Reputation points

2026-05-31T06:14:45.9633333+00:00
@Handian Sudianto said

This mean that person know my new password?

I will disagree with Sumit D - IA on this point. The Bad Guys do not have to know your password to trigger a MFA verification.

Try this on your account:

Log out of your account.

Go to https://login.live.com/

Enter your email address and [Next].

If prompted for a Password [Cancel] or enter a bogus password.

Do you see "Sign in another way" or "Other ways to sign in"? If so, click it.

Pick anything except "Use your password".

This will trigger a MFA verification.

What you will see:
Hornblower409 16,050 Reputation points

2026-05-31T06:24:22.9833333+00:00

@SD - IA said

The dropdown on Outlook apps, like Android and Outlook New on Windows would show you all your addresses to send an email from

This is true, but it means you have to remember to change the "From" address each and every time you compose a new email since Outlook will default to using your Primary Alias as the "From". And once you send an email with your "secret" Login Only Alias as the "From", it's in the wild and will get harvested sooner or later. At which point you have to create another Primary Alias.

There is the ability to set a Default Send From alias (which you would set to your old email alias), but Microsoft has broken this function. See:
https://learn.microsoft.com/en-us/answers/questions/5870538/outlook-com-personal-account-unable-to-set-default

For details on the setup see the Answer by "Hornblower409 on Feb 27, 2026" in
https://learn.microsoft.com/en-us/answers/questions/5789093/i-get-a-few-2fa-notifications-from-canada-daily-us

Answer accepted by question author

SD - IA 180.3K Independent Advisor

Hi,

This means that person knows my new password?

Probably yes, but this is odd.

Does your password show up as breached here?

https://haveibeenpwned.com/Passwords

This solution should work, which applies to a related issue.

https://www.yourwindowsguide.com/2025/04/microsoft-single-use-code-email.html

Hiding or disabling the sign-in capability for your email would get rid of the single-use code emails. Hiding it would mean that it is not possible to log in using the same, but you can use it for emailing. For that, do the steps below:

Make a new Alias for login purposes at this link.
Next, fix this alias as the primary alias at https://account.live.com/names/manage page.
Now, the next step is to disable the sign-in capability for the the original email, which is possibly hacked in a data breach. Concurrently, You can manage that on this page. Uncheck the Email and click Save.
Furthermore, as expected, you can still send and receive email from the old Alias – you have just disabled the capability of it to sign in. Remember to keep the new alias secret or use elsewhere. The dropdown on Outlook apps, like Android and Outlook New on Windowswould show you all your addresses to send an email from.
Now, when someone would try to use the breached address, they will hit an error. The error message would say that the Email does not exist.

I’m eager to hear back and work together to find a solution.

Standard 3rd party link disclaimer:

There may be links to non-Microsoft websites that provide accurate and safe information. Watch out for ads on websites frequently classified as PUP (Potentially Unwanted Products). There is no need to buy paid products to fix your computers, as they sometimes do more harm than good.

0 comments

1 additional answer

Your answer

Hornblower409 16,050 Reputation points

2026-05-31T06:14:45.9633333+00:00

@Handian Sudianto said

This mean that person know my new password?

I will disagree with Sumit D - IA on this point. The Bad Guys do not have to know your password to trigger a MFA verification.

Try this on your account:

Log out of your account.

Go to https://login.live.com/

Enter your email address and [Next].

If prompted for a Password [Cancel] or enter a bogus password.

Do you see "Sign in another way" or "Other ways to sign in"? If so, click it.

Pick anything except "Use your password".

This will trigger a MFA verification.

What you will see:
Hornblower409 16,050 Reputation points

2026-05-31T06:24:22.9833333+00:00

@SD - IA said

The dropdown on Outlook apps, like Android and Outlook New on Windows would show you all your addresses to send an email from

This is true, but it means you have to remember to change the "From" address each and every time you compose a new email since Outlook will default to using your Primary Alias as the "From". And once you send an email with your "secret" Login Only Alias as the "From", it's in the wild and will get harvested sooner or later. At which point you have to create another Primary Alias.

There is the ability to set a Default Send From alias (which you would set to your old email alias), but Microsoft has broken this function. See:
https://learn.microsoft.com/en-us/answers/questions/5870538/outlook-com-personal-account-unable-to-set-default

For details on the setup see the Answer by "Hornblower409 on Feb 27, 2026" in
https://learn.microsoft.com/en-us/answers/questions/5789093/i-get-a-few-2fa-notifications-from-canada-daily-us

Answer 1

The prompt shown is an Outlook mobile sign‑in approval request. It appears whenever someone (or some app) tries to sign in to the account and uses Outlook mobile notifications as the second factor.

This prompt does not prove that the person already knows the correct password. It can appear in these situations:

Someone is trying to access the account (they may or may not have the right password).
Someone accidentally typed the email address while trying to sign in to their own account.
A sign‑in prompt that was legitimately triggered earlier is being delivered with delay.

Action to take:

Always select Deny for any request that was not initiated personally.
Do not tap the matching number or Approve unless currently signing in on the device/location shown.
Since this has been happening repeatedly, change the password again from a trusted device and review security info and sign‑in methods at https://aka.ms/mysecurityinfo to ensure only trusted methods and devices are registered.

If the prompts continue even after a password change and security review, treat it as repeated unauthorized attempts but the account remains protected as long as all unexpected prompts are denied.

References:

Using Outlook mobile to sign in