Why Am I Getting Spam in Microsoft Authenticator?

What is Microsoft Authenticator spam?

Microsoft Authenticator spam is a wave of unwanted push notifications telling you to approve a sign-in request you did not initiate. It shows up on your phone, in the Authenticator app, or on your lock screen, and it arrives in bursts -- sometimes dozens of requests in a few minutes.

It is not an email. It does not land in your inbox. Blocking the sender in your email client does nothing. The notification comes from Microsoft's authentication infrastructure, triggered when someone or something attempts to sign into an account associated with your phone number or email address.

Why are you suddenly getting Authenticator push spam?

Most of the time, these notification waves are triggered by credential stuffing. Someone has a list of email addresses and passwords -- sourced from a data breach, a phishing database, or a credential harvesting operation -- and they are running those credentials against Microsoft sign-in pages automatically.

When the credentials match a Microsoft Entra ID account, the system sends a push notification to the account owner's Authenticator app, asking them to approve the sign-in. The attacker is not guessing your MFA code. They are hoping you will panic and tap Approve -- or tap Approve out of muscle memory, thinking it is a routine prompt.

The attack works because many users have Authenticator configured to send notifications to their lock screen. That means the approval request appears without unlocking the phone. An attacker can fire off hundreds of these requests per hour against a list of email addresses, betting that a percentage of people will approve them out of confusion.

These campaigns tend to arrive in bursts during business hours, when victims are most likely to be checking their phones and most likely to react quickly to an unexpected prompt.

How attackers use Authenticator notifications in credential stuffing attacks

The mechanism is straightforward. An attacker runs a list of email addresses through an automated sign-in tool. When an address corresponds to an Entra ID account with MFA enabled, Microsoft sends a push notification to the Authenticator app registered to that account. The attacker monitors the result:

• If the victim approves: the attacker gets an authentication token and account access.
• If the victim denies or ignores: the attempt fails, and the attacker moves to the next credential in the list.

What makes this technique effective is the noise level. A sudden burst of dozens of notifications is disorienting. Some users approve the request to make the notifications stop, not understanding that doing so grants access. Others approve because the notification looks like a genuine Microsoft prompt -- because it is a genuine Microsoft prompt, just initiated by an attacker.

This is distinct from traditional phishing. There is no fraudulent login page. There is no spoofed email. The authentication request is real, sent through Microsoft's actual infrastructure. The attack surface is the Authenticator notification itself.

How to stop unwanted Microsoft Authenticator notifications

For individual users, there are two layers of defense: stopping the notifications and preventing unauthorized approval.

Disable lock screen notifications for Authenticator. On iOS, go to Settings > Notifications > Microsoft Authenticator and turn off Show on Lock Screen. On Android, go to Settings > Apps > Microsoft Authenticator > Notifications and disable Pop up on screen. This prevents attackers from triggering prompts you can act on without unlocking your phone.

Require the app to be open before approving. In the Authenticator app, go to Settings and enable "Require app to be open for approval." This means a push notification alone cannot be approved -- you must open Authenticator and actively confirm. This breaks the attacker's workflow entirely.

If your email address has been in a known breach, change your password. Even if your account was not compromised, credential stuffing only works because passwords are reused. A strong, unique password removes the entry point.

Report the prompts as fraud within the Authenticator app. Microsoft tracks these reports and uses them to flag suspicious campaigns.

How organizations can detect Authenticator-based attacks in Entra ID logs

If you are an IT or security administrator, you can detect these campaigns in the Microsoft Entra ID sign-in logs. Look for:

• A single IP address or small set of IPs attempting sign-in for many different user accounts in a short window.
• Sign-in attempts with a high ratio of "user did not approve MFA" results.
• Bursts of failed approvals followed by no successful session -- suggesting the attacker moved on after failing to trick the user.

The sign-in log fields useful for this search are: User sign-ins failed (MFA denied), User sign-ins succeeded (MFA approved), the IP address, and the application columns. Filter for the target user and examine the sequence of events.

If your organization uses Conditional Access policies, you can configure alerts for unusual MFA denial rates from a single IP, which can catch automated stuffing campaigns early.

Here is where DMARCFlow adds a complementary signal. If the Authenticator spam campaign is accompanied by password-reset or sign-in emails sent from a spoofed domain -- attackers often run the email and notification legs of the attack in parallel -- DMARCFlow aggregate reports capture the sending infrastructure for those forged emails. A surge in DMARC failures for a domain you control, involving IPs you do not recognize, can indicate that your users are targets of the same credential stuffing list that triggered their Authenticator notifications. DMARCFlow is not a replacement for Entra ID log analysis, but it gives security teams a way to cross-reference the email-side footprint of an Authenticator campaign with the sign-in log data they already have.

How to report Microsoft Authenticator phishing attempts

Microsoft has an official channel for reporting Authenticator-based phishing. Use the "Report as fraudulent" option directly in the Authenticator app when you receive an unexpected prompt. Microsoft aggregates these reports to identify and disrupt credential stuffing campaigns.

For broader phishing infrastructure, submit to the Microsoft Security Intelligence portal at microsoft.com/wdsi/filesubmission. If the campaign involves email spoofing -- receiving password-reset or sign-in emails that accompany the Authenticator prompts -- forward the original email to that portal as well.

FAQ

Is Microsoft Authenticator spam a sign my account is compromised?

Not necessarily. Most Authenticator spam means your email address appeared in a credential leak, not that your account has been accessed. Unless you approved a sign-in request, your account is likely still secure. Change your password anyway, and enable the app-open requirement described above.

Can I block these notifications without turning off MFA?

Yes. The most effective step is enabling "Require app to be open for approval" in Authenticator settings. This means no notification alone can grant access -- you must open the app and actively confirm. You keep MFA protection; you only remove the lock-screen shortcut that attackers exploit.

Does email authentication like DMARC stop Authenticator spam?

DMARC cannot block Authenticator push notifications, because those notifications are not email. But if the Authenticator spam is part of a phishing campaign that also includes spoofed password-reset emails, DMARC aggregate reports can show you which domains the attacker is forging in the email leg of the attack. That visibility helps your security team respond faster.

I approved an Authenticator prompt I was not sure about. What do I do now?

Go to your Microsoft account security settings immediately and review recent sign-in activity. If there is an unfamiliar location or device, revoke its sessions and change your password. Enable the app-open requirement so this cannot happen again without physical access to your phone.