Your phone is asking you to approve a sign-in you didn’t start.

What to do with the prompt in front of you

1. Tap Deny, or let the prompt expire. Do not approve it to make it stop.
2. If the prompt asks you to type a number, check that you’re looking at a sign-in screen showing that number. Microsoft’s number matching works by showing a number on the sign-in page that you must type into the app, so no one can approve without seeing that screen. If you aren’t at a sign-in screen, you have nothing to type, and the answer is to deny.
3. If the call is a phone call and you hear “press the # key,” don’t. The default message says, “If you are trying to sign in, press the # key,” and the version for unrecognized attempts says to press 0 and #. Pressing 0 and # reports it to your IT team.
4. Do not read a code to anyone who calls or texts you about it, whoever they say they are.

A prompt that doesn’t ask for a number

Number matching is on for all push prompts from Microsoft’s sign-in app. It doesn’t apply to phone calls or text-message codes, and it doesn’t apply to Apple Watch or Android wearables, where Microsoft says users must use their phone. There is one documented exception: when you sign in to a Microsoft app such as Outlook on the same phone that holds the sign-in app, you may tap Approve or Deny without typing a number. If you were just opening Outlook on that phone, that explains it. If you weren’t holding the phone, it doesn’t.

After you deny: the password is the next step

A prompt you didn’t start means someone has the password, so change it from a computer you trust, and don’t reuse it. Then look at where the account has been signed in.

For a work or school account, sign in to My Account, choose Recent Activity, and expand each entry. Microsoft notes that location is estimated from the IP address and can mislead, especially on mobile networks, so look at the operating system, browser, and app too. A sign-in note reading “Additional verification failed, invalid code” means the password worked and the second step didn’t. Microsoft says to change the password in that case, because the person trying may know it.

Then open Security info and remove any phone, app, or number you didn’t add.

Report the prompt, if your administrator turned that on

Microsoft 365 administrators can enable a setting called Report suspicious activity. When it’s on, you can report an unexpected prompt from the sign-in app or by phone. Microsoft then marks that user as high risk, and the sign-in shows up in the administrator’s logs as “MFA denied.” The setting is off unless an administrator turns it on, so if you don’t see a report option, ask whoever administers your Microsoft 365 about it.

Count what happened

• How many prompts, and over what stretch of time.
• Whether any came from a place or device you recognize.
• Whether you or anyone in the office approved one. If someone did, treat the account as in use by someone else from that time on, and have the password changed and the sessions ended.
• Whether the same prompts are reaching other people in your company, which tells you the list of usernames is known.

What denying can and can’t tell you

A denied prompt means the sign-in did not go through at that moment. It doesn’t tell you who tried, how they got the password, or whether an earlier attempt succeeded. The activity page shows a subset, not every attempt, so a clean page covers what it lists.

When we look at this with you, we read the sign-in history, the sign-in methods on the account, the app permissions, and the mailbox rules, and report what is there and what isn’t, with the date we looked.

Each prompt means the first step has already been passed by someone, so the password is the thing to replace.

Related

• MFA Is On: What the Second Step Covers and Misses
• An Unusual Sign-In Alert Landed: Is It Real?
• Password Reset Emails You Did Not Request
• A Forwarding Rule in Your Email You Didn’t Create

Sources

• CISA: Implementing Number Matching in MFA Applications (fact sheet, October 2022)
• Microsoft Learn: How number matching works in MFA push notifications
• Microsoft Learn: Configure multifactor authentication (Report suspicious activity, phone call messages)
• Microsoft Support: View your work or school account sign-in activity from My Sign-ins