I’ve seen that and the FB one in recent months.

Same here. At first it was just my account but now family members are getting it too.

Microsoft doesn't show you login attempt IP addresses like Google does?

It does, but only when they use the password login...

Your org's admin can see it in the Azure portal.

It's like the google 2FA where you can accept the login on ANY android device where you are logged in. and you can't disable the feature and the only way to remove the option from a device is to logout your account on the device... I have an tabled and an phone which is used by other people in my family and I definitely don't want the 2FA requests on these devices...

Yeah - and what is crazy is when you think about it - Microsoft generates a 6 digit code.

So it is a "one in a million" to randomly guess what the code is on any given login.

But it is "one in a million" for each Microsoft account you know about - and if they have millions of email addresses, and automate it each day (I also get attempts 1-2 times per day).

Yes - the odds are small - but there is a greater than 0% chance someone can randomly get into your Microsoft account - and there is no way to stop it - even with 2FA etc - this bypasses all of that!!!

Crazy...

I'm a little confused. Does the code get generated on any attempt to log in, or only those that have the password and MFA is activated? Or when someone attempts password recovery?

Because I'm a bit concerned if Microsoft passwords are leaking.

When attempting to login to your Microsoft account, instead of typing your password you can do an optional "one time password" generation thing from Microsoft. So instead of typing your password +2FA - they email you a 6 digit "one time password" that you can use instead.

You cant disable this.

So all Microsoft accounts could have a daily 1 in 1 million chance of been overtaken.

Odds are low - but if you then spam this across thousands of attempts per day - they would statisically "get lucky" from time to time...

That makes much more sense, thanks. I'm guilty of using this from time to time as well.

One would think Microsoft wouldn't be stupid enough to provide endless amounts of one time codes for a single account. I would guess they provide 5-10 codes before escalating the login.

If you have 500 million accounts you know of, you'd be breaking into around 500-1000 a day.

I suppose that's a decent rate, but it feels like most Microsoft accounts will just have something like Office or Minecraft set up.

Have you got an exchange email or Teams set up on a mobile device? These will generate 2FA requests (but not make any kind of notification on the device).

I thought this was the Passwordless account they implemented (EDIT: didn't realize you weren't talking about the Authenticator app), but I had it turned off. I somehow managed to make it stop by re-enabling/re-disabling both Passwordless and 2FA. So now they always ask me for a password and then I get the challenge.

To this day, I can't comprehend how this is supposed to be safe. So someone can just type in my username and wait until i eventually misclick in the Authenticator app? If it was from a browser I have used before at least, but I was getting these challenges from around the globe.