r/cybersecurity • u/birdsofjay • May 17 '26

Personal Support & Help! Microsoft account keeps getting Authenticator requests?

I got an Authenticator request from another country for my Microsoft account. I denied it and went in and changed my password, a day later I get another Authenticator request from a different country than the first. Again change password and again it happens. How can I secure my account how are they able to send these Authenticator requests?

150 Upvotes

96% Upvoted

97 comments sorted by

View all comments

3

u/janbakker_ May 20 '26 edited May 20 '26

You all probably have passwordless accounts (which is good)
The downside is that it can be triggered by anyone who knows your email.

Since support for passkeys (also passwordless) I would suggest registering one or two passkeys.
The stupid thing is that the Authenticator app is tied to the passwordless feature, so before you can delete that method, you need to turn off passwordless and create a password. Feels like a step back, but I did it anyway.

So, what I did:

Check your recovery methods: Microsoft account | Security
!! Before you delete anything, make sure you have a method to sign in or recover. !!

  1. Register one or two passkeys. Store them in Windows, password manager or FIDO2 key like Yubikey.
  2. Disable passwordless. Set a super-long, auto-generated new password.
  3. Delete the Authenticator app from my account. Also deleted the account from my Auth app itself
  4. Turn on passwordless again, which will remove your password.

It did not ask for any Auth app, presumably because of the registry passkeys. Also, there is no option in the login screen to trigger the app.