An unexpected sign-in approval appears
Microsoft Authenticator for work or school accounts
When to use this: An unexpected sign-in approval appears — use these initial checks when this matches your situation. On a work or school device, follow your organization's policies and stop if a setting is managed.
- If you did not start the sign-in, do not approve it; choose Deny.
- Use the suspicious-activity reporting option if your organization provides it.
- Contact your IT or security team through a known channel.
- Record the time and affected account without sharing codes.
- Tell your security contact immediately if you already approved an unfamiliar request.
Check the result: The unexpected request is denied and the right team has the details.
Stop and get help when needed: Do not approve repeated prompts just to stop them. Availability of reporting and subsequent access restrictions depend on your organization’s settings.
Need hands-on help?: Request DefenderTech support for individualized investigation or changes. We will explain the scope and estimate and ask for authorization before paid work begins. Do not include passwords, recovery keys or verification codes in your request.
Official references: - Microsoft guidance: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings
Updated 2026-09-30