Forum Discussion
Microsoft Authenticator receives repeated unexpected sign-in requests from different countries.
I have received multiple unexpected Microsoft Authenticator number-matching requests over the last few weeks. The requests came from different countries (Mexico, France, and Spain), and I denied all of them. I changed my password after the first incident. My password is unique and stored in Bitwarden. I have Microsoft Authenticator enabled, and I do not use passwordless sign-in. The strange part is that these authentication requests do not appear in my Recent Activity page. Is there anything I can do to stop these requests? I came here because a support representative told me to. I appreciate all your help beforehand.
2 Replies
Keep denying every unexpected prompt and never enter its number. Identify which account tile in Authenticator receives it. If nothing appears in Recent activity, the request may target a work account, another personal account, or an old registration on the phone.
For a work account, check My Sign-ins and ask the tenant administrator to review Entra sign-in logs. For a personal account, review Recent activity, sign out unfamiliar sessions, verify recovery details, and report suspicious activity where offered. Remove unrecognized authentication methods or devices. Re-register Authenticator if the account mapping remains unclear.
For an organization-controlled account, also revoke active sessions and require reauthentication. After investigating, consider passwordless Authenticator or a passkey. Number matching prevents accidental approvals, but repeated prompts still indicate an authentication attempt using your identifier. Preserve screenshots and UTC timestamps so an administrator can correlate events; the displayed country alone is not reliable evidence of the requester’s location.
One of the reasons was account was being targeted by password spray or credential stuffing attacks. Since MFA is stopping them, your account remains protected as long as you deny all prompts. To stop the noise and gain visibility, review Entra sign-in logs, enable suspicious activity reporting, and add secondary MFA methods, even conditional access.
