What to Do When You Receive an MFA Approval You Didn’t Request

You’re working at your computer when your phone suddenly buzzes.

“Approve sign-in?”

But there’s a problem: You aren’t trying to sign in to anything.

What should you do?

The most important answer is simple: Do Not Approve It

If you did not initiate the login, never approve an unexpected Multi-Factor Authentication (MFA) request.

Select Deny or Report Suspicious Activity if that option is available.

An unexpected MFA request can be a sign that someone is attempting to access your account. Microsoft allows organizations to configure Authenticator so users can report suspicious verification requests directly from the app.

MFA is doing exactly what it was designed to do: creating another barrier between an attacker and your account.

The mistake is letting them through.

Why Am I Getting an MFA Request?

One possibility is that someone has obtained or guessed your password and has reached the MFA portion of the login process.

Attackers may also repeatedly send authentication requests hoping that you will eventually approve one simply because you're tired of seeing them.

This technique is often called MFA fatigue, MFA bombing, or MFA push spam. The attacker is essentially hoping you'll think: "Maybe Outlook needs me to approve this." …and tap Approve without thinking about it.

Microsoft has specifically identified unexpected MFA prompts as activity that should be investigated.

Never Approve a Request Just to Make It Go Away

Repeated notifications can be annoying. That's intentional. If you receive five, ten, or twenty approval requests, do not approve one just to stop the notifications.

Also be cautious if someone contacts you immediately afterward claiming to be from your company's IT department.

An attacker may call or message you and say something like:

"We're working on your account. You should receive an MFA request. Please approve it."

If you did not initiate the login, don't approve the request.

Instead, contact your IT department using the phone number, help desk system, or contact information you normally use.

What Should You Do?

If you receive an MFA request you didn't initiate:

1. Deny the request

Do not approve it.

2. Contact your IT department

For a company account, let your IT provider know what happened.

Tell them approximately when the MFA request appeared and whether you received one request or several.

Your IT team may be able to review sign-in activity and determine where the login attempt originated. Microsoft Entra sign-in logs, for example, provide administrators with information about authentication and MFA events.

3. Follow your IT team's instructions regarding your password

Because an unexpected MFA request may indicate that your credentials are being targeted, your IT team may have you change your password or take additional security steps.

Use a strong, unique password that isn't being used for another account.

4. Pay attention to anything else unusual

Let IT know if you also notice:

• Unexpected password-reset emails

• Unfamiliar sign-in alerts

• Emails appearing as read when you didn't open them

• Messages being sent from your account

• Changes to your MFA methods

• Repeated authentication requests

• Unexpected calls claiming to be from Microsoft or your IT department

Those details can help determine what is happening.

What If You Accidentally Approved It?

Contact your IT department immediately.

Don't be embarrassed and don't wait to see whether anything happens.The faster your IT team knows about a potentially unauthorized login, the faster they can investigate the account, review sign-in activity, reset credentials if necessary, revoke active sessions, and take steps to protect company information.

Minutes can matter during a security incident.

MFA Is There to Protect You — But You Are Part of the Security

Multi-factor authentication is one of the most important protections businesses can put in place, but employees still play an important role.

Remember one simple rule:

If you didn't initiate the login, don't approve the MFA request. When you're unsure, deny first and contact Kappa.

It's much easier for your IT team to investigate a legitimate login that was denied than to recover an account after an unauthorized login was approved.

---

Have questions about MFA or cybersecurity for your business?

Kappa Computer Systems helps Central Florida businesses protect their employees, accounts, computers, and data with proactive IT management and cybersecurity solutions.

Kappa Computer Systems | IT Support. Cybersecurity. Managed Technology Solutions.