Suspicious Login Issues

How to Handle Unexpected Entra ID Account Additions in Microsoft Authenticator

Amos Gikunda Sep 27, 2026 870 views

Question details

The user is receiving unexpected attempts or notifications regarding an organizational Entra ID account being added to their Microsoft Authenticator app.

How to Handle Unexpected Entra ID Account Additions in Microsoft Authenticator

Product: Microsoft Authenticator
Device & OS: not provided
Scenario: The user observes unauthorized or unexpected setup prompts for an organizational account in their authenticator app and needs to secure their account.
Observed behavior: Unexpected attempts are being made to add an organizational Entra ID account to Microsoft Authenticator without the user initiating the process.

Before you start

Do not approve any unexpected multi-factor authentication (MFA) prompts. Ensure you have access to your primary email and password for the affected organizational account to perform security checks.

Solution 1Recommended

Review Account Security and Sign-in Activity

Investigate unauthorized access attempts and secure your Microsoft Entra ID account immediately to prevent unauthorized additions to Microsoft Authenticator.

If someone is trying to add your account to their authenticator app, they may already have your password. It is critical to review your recent account activity and update your security credentials.

Access your account settings

Check recent sign-in activity

Navigate to the 'Security Info' or 'Recent Activity' section to review where, when, and how your account has been accessed. Look for any unrecognized locations or devices.

Update verification methods

Review your current two-step verification methods. Remove any unrecognized devices from the Microsoft Authenticator list to ensure only your trusted devices are linked.

Change your password

Immediately change your account password to a strong, unique combination to invalidate the credentials the unauthorized user might be using.

Review Account Security and Sign-in Activity

Enable Two-Step Verification: Ensuring two-step verification is properly configured on your actual devices provides a critical layer of defense against compromised passwords.

Solution 2

Escalate the Issue to Your IT Administrator

If you are part of an organization, your IT administrator can help secure your account globally and block malicious attempts.

Free Microsoft Office alternative

Looking for a Secure and Free Office Suite?

While resolving complex Microsoft account and security issues, you may want a simpler, lightweight alternative for your daily document tasks. WPS Office provides a free, highly compatible office suite that allows you to manage your work securely and efficiently without relying on complex organizational account setups.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Free, lightweight, and fast installation with a familiar user interface.Seamless migration for offline document editing and local security protection.Built-in PDF editing tools for comprehensive document management.

microsoft office alternative - wps office

Frequently Asked Questions

Why am I getting unexpected Microsoft Authenticator prompts?

This typically happens if a malicious actor has obtained your password and is trying to set up multi-factor authentication on their own device, or if they are attempting to log in and triggering your MFA. You should change your password immediately.

Can an IT admin add an Entra ID account to my Authenticator remotely?

No, an IT admin cannot force an account onto your personal Authenticator app without your interaction. You must either scan a QR code or manually enter a setup code provided by the organization to add the account.

What should I do if I accidentally approved a suspicious login prompt?

If you approved an unexpected prompt, change your Entra ID password immediately, log out of all active sessions via your Microsoft account portal, and notify your organization's IT administrator to monitor for unauthorized activity.

How do I remove an unknown device from my Microsoft account?

Sign in to myaccount.microsoft.com, navigate to 'Security info', find the unrecognized device or authenticator app in the list of sign-in methods, and click 'Delete' to remove its access.

Microsoft Office Security Issues