A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
If the prompts are unrequested, select Deny every time. Unrequested prompts usually mean either someone is trying to access the account, someone entered the wrong sign-in info, or a delayed prompt was delivered.
Since the password has already been changed several times and the prompts continue, the most effective next step for a personal Microsoft/Outlook account is to change the sign-in identifier that others can use:
- Add a new alias to the Microsoft account.
- Make that new alias the primary alias.
- Disable sign-in for the old exposed alias.
- Keep the old alias so it can still receive email if needed.
This helps because attackers can keep trying if they know the current sign-in name, even after the password changes.
Also review the account’s recent activity. If there are events that are not recognized, select Secure your account.
If the account becomes blocked because of unusual sign-in activity, use Sign-in Helper. If that does not work, use the Microsoft account sign-in recovery flow described in When you can't sign in to your Microsoft account.
If using Outlook mobile sign-in notifications, they can also be turned off in the app:
- Open Settings.
- Go to Accounts and select the account name.
- Select Account > Sign-in requests.
- Turn off Allow sign-in requests.
For personal accounts, Microsoft states that Microsoft Authenticator is the supported mobile app for sign-in.
References:
- Using Outlook mobile to sign in
- Unblock my Outlook.com account
- Hi, I get in the last 24 hours numerous requests to sign in to my account by approving a certain number in my Authenticator app, this requests was not made by me, how can protect myself? - Microsoft Q&A
- I'm getting numerous 2FA requests for access to my outlook account - Microsoft Q&A