Unknown person attempting to access Microsoft authenticator.

Question

Unknown person attempting to access Microsoft authenticator.

RAYNA RAHMAN 0

On my personal account, I've had someone trying to login in my Microsoft authenticator. It happens everyday and I keep denying access. I don't know If they have access to my password but they definitely have access to my email. It also raises a concern due to the fact that I also cannot access my passkeys anymore. This is worrying and I use this email for basically everything. What can I do?

0 comments

1 answer

Your answer

Answer 1

For a personal Microsoft account, take these steps immediately:

On the Security basics page, select Review activity and check the Recent activity page for unusual sign-in attempts. For anything that was not initiated, expand the entry and select This wasn't me or Secure your account.
On the same Security basics page, select Change password and set a new strong password.
If sign-in is no longer possible, use Forgot my password on the sign-in page, then choose I think someone else is using my Microsoft account and follow the recovery steps.
If unrequested Authenticator prompts continue, select Deny for every prompt that was not initiated.
If the account’s sign-in email is exposed, add a new alias, make it the primary sign-in alias, and disable sign-in for the old exposed alias. Keep the old address for sending and receiving mail, but do not use it for sign-in. This is the accepted mitigation described in Microsoft Q&A for repeated unauthorized Authenticator prompts on personal accounts.
If passkeys are no longer accessible, account recovery is still possible with a verified email and passkey. If sign-in problems continue, use the Sign-in helper or Contact Microsoft Support. Support agents cannot send password reset links or change account details.
If an alert email was received, trust it only if it came from the Microsoft account team domain @accountprotection.microsoft.com.

If the repeated prompts are only being denied and no approval is given, the account remains protected by that approval step. The priority is to review recent activity, change the password, and stop sign-in attempts against the exposed alias.