Windows Autopatch: Some admins may have seen Quality and Feature Update reports incorrectly showing "SYSTEM_SCRUBBED" in Windows Autopatch (incident).
View Microsoft 365 Status
Get Started
Need IT support or a security review?
Talk with OpenTech about managed IT, cybersecurity, Microsoft 365, or urgent support.
Request Service Create Ticket
Knowledge Base / Security Awareness / Unexpected MFA Prompts or Approval Requests
Security Awareness

Unexpected MFA Prompts or Approval Requests

If you receive MFA prompts you did not initiate, treat them as a possible compromise attempt.

Do not approve the prompt
Unexpected MFA requests may mean someone already has your password and is trying to complete sign-in.

What to do immediately

  1. Deny or ignore the prompt.
  2. Change your password from a trusted device.
  3. Sign out of other sessions if possible.
  4. Create a ticket immediately and note the approximate time of the prompts.
  5. Do not approve future requests unless you initiated the sign-in yourself.

Why this matters

Repeated MFA requests can be part of an MFA fatigue attack, where an attacker tries to pressure a user into approving access.

Create Ticket Incident Response