Microsoft Account Sign-In Shows Additional Verification Requested: What It Means
Question details
The user noticed a 'successful sign-in' alongside 'additional verification requested' in their Microsoft account activity log and wants to know if an attacker accessed their account data.
- Product
- Microsoft Account
- Device & OS
- not provided
- Scenario
- Reviewing recent sign-in activity logs after receiving unexpected two-factor authentication prompts.
- Observed behavior
- The activity log displays a 'successful sign-in' status, but also indicates that 'additional verification was requested', causing confusion about whether the login was fully completed and data was accessed.
Before proceeding, ensure you have access to your Microsoft account's trusted device or backup email to authenticate the security changes you are about to make.
Change Password and Review Recent Account Activity
Since an attacker correctly guessed your password but was blocked by 2FA, changing your password immediately is crucial to secure your account.
When the activity log shows 'successful sign-in' alongside 'additional verification requested', it means the attacker correctly entered your username and password, but they were stopped by your two-factor authentication (2FA) prompt. Because your password has been exposed, you must update it right away.
Navigate to the Microsoft account security dashboard (account.microsoft.com/security) and sign in using your current credentials and 2FA.
Select the 'Password security' or 'Change my password' option and enter a new, highly secure password that you haven't used elsewhere.
Click on 'Sign-in activity' to review recent attempts. If you see unfamiliar locations or devices, expand those entries and select 'Secure your account'.
Go to 'Advanced security options' and select the 'Sign me out' link. This will force all active sessions to terminate within 24 hours.
Contact Microsoft Support for Log Verification
If you remain concerned about potential unauthorized data access, Microsoft Support can perform an account-specific review of your authentication logs.
Try WPS Office for Secure and Lightweight Document Management
Concerned about Microsoft account security and cloud dependencies? Switch to WPS Office, a highly secure, free, and lightweight alternative that allows for secure local editing while offering full compatibility with Microsoft file formats.
- 1. Visit the official website: Go to the WPS Office official website on your device.
- 2. Download the installer: Click the Free Download button to get the latest lightweight installation package.
- 3. Install and open files: Follow the on-screen instructions to install WPS Office, and immediately start opening your existing Microsoft Office files.
Frequently Asked Questions
Does 'Successful sign-in' mean the attacker accessed my OneDrive files?
Not necessarily. If the log also states 'Additional verification requested', it means the username and password were correct, but the login was paused because the two-factor authentication (2FA) prompt was not completed. Without completing 2FA, the attacker cannot access your OneDrive or account data.
Why did I get a Microsoft verification code if I didn't try to log in?
This happens when someone else knows your password and attempts to log in. The system stops them and sends a verification code to your device. This means your password has been compromised, and you should change it immediately.
How can I check if the attacker completed the two-factor authentication?
If the attacker had completed the 2FA, the activity log would show a fully completed sign-in without the 'additional verification requested' pause, and you would see active sessions from unfamiliar locations. For complete certainty, you can ask Microsoft Support to review your account's detailed access logs.
How do I sign out of all devices on my Microsoft account?
Go to your Microsoft Account Security settings, navigate to 'Advanced security options', scroll down to the 'Sign out everywhere' section, and select 'Sign me out'. This will force all active sessions to log out within 24 hours.
