Why does Microsoft Authenticator make me type a number on my phone?

This is 'Number Matching'. It stops hackers from spamming you with approval requests until you accidentally hit 'Approve'. You can only complete the login if you can see the number on the computer screen.

What does 'Conditional Access' mean?

Conditional Access is an invisible IT policy. For example, IT can set a condition that says: 'If a login attempt comes from outside the United States, block it instantly, even if the password is correct.'

Understanding Microsoft 365 Account Security — What Protects You and Why

Applies to: Microsoft 365 (All Users)
Article Type: Informational
Last Updated: 2026-05-18

Summary

Your Microsoft 365 account is protected by multiple layers of security — not only a password. This article explains what each layer does, how they work together, what your organization manages versus what you control, and what to do when something seems wrong. Think of it as a security cheat sheet for your work account.

Prerequisites

A Microsoft 365 work account.
A basic understanding of signing in and using your account (no technical background required).

Instructions

1. The Layers of Security Protecting Your Account

Your account is not protected by a single lock — it is protected by a series of layers, each designed to catch what the layer before it missed.

Layer	What It Does	Who Manages It	Example
1. Password	Verifies you know the account's secret	You (with policy set by IT)	Your Microsoft 365 password
2. Multi-Factor Authentication (MFA)	Requires a second proof of identity beyond your password	IT enables it; you register your methods	Authenticator app push notification, phone call, or SMS code
3. Conditional Access	Evaluates sign-in context (device, location, risk level) and decides whether to allow, block, or require extra verification	IT (fully managed — invisible to you)	Blocking sign-ins from untrusted countries, requiring MFA on new devices
4. Threat Protection	Scans emails, links, and attachments for malware, phishing, and suspicious content before they reach you	IT (fully managed — invisible to you)	Safe Links scanning URLs in email, Safe Attachments detonating files in a sandbox

Key takeaway: You are directly responsible for layers 1 and 2 (password and MFA). Layers 3 and 4 run in the background — you benefit from them without needing to do anything, but understanding they exist helps you trust the system.

2. What You Control vs. What IT Manages

Security Area	You Control	IT Manages
Password	Choosing a strong password, changing it when needed	Password complexity requirements, expiration policy
MFA	Registering your methods (Authenticator app, phone, security key), approving or denying prompts	Requiring MFA, choosing which methods are allowed, setting trusted locations
Devices	Keeping your device updated, locking your screen when you walk away	Device compliance policies, remote wipe capability, managed app requirements
Apps	Reviewing and revoking app permissions in the MyApps portal	Blocking risky apps, managing consent policies, monitoring OAuth grants
Phishing	Recognizing and reporting suspicious emails	Email filtering rules, Safe Links, Safe Attachments, quarantine policies
Sign-in monitoring	Reviewing your own sign-in history at My Sign-Ins	Monitoring all users' sign-in logs, investigating risky sign-ins, triggering alerts

3. "What Happens If..." — Common Security Scenarios

Scenario	What Happens	What You Should Do
Someone gets your password (phishing, data breach)	They can attempt to sign in — but MFA will block them if enabled	Change your password immediately. Review your sign-in activity. Report to IT.
You click a link in a phishing email	If Safe Links is active, it may block the page. If not, you may land on a fake login page.	Do not enter credentials. Close the tab. Report the email. If you entered your password, change it immediately and tell IT you submitted it on a phishing page, so they can sign out your active sessions.
You get an MFA prompt you did not request	Someone has your password and is trying to sign in. The MFA prompt is your last line of defense.	Tap Deny. Change your password immediately. Report to IT. Never approve an MFA prompt you did not initiate.
You lose your phone (your MFA device)	You cannot complete MFA sign-in until you use a backup method or IT resets your MFA	Use a backup MFA method (backup phone, security key). If no backup exists, contact IT to reset your MFA registration.
You sign in from a new device or country	Conditional Access may block the sign-in or require additional MFA verification	Complete the additional verification if prompted. If blocked, contact IT to confirm the sign-in is legitimate.
Your account gets locked	Too many failed sign-in attempts triggered a lockout (protection against brute-force attacks)	Wait 15–30 minutes for automatic unlock, use self-service password reset, or ask IT to unlock the account if you cannot wait.
You receive a "Your sign-in was blocked" email	Conditional Access or risk-based policy blocked a sign-in attempt from an unusual location or device	If it was you, try again from a trusted device or network, or ask IT which policy blocked the sign-in and whether your location can be allowed. If it was not you, change your password immediately.

4. Your Security Checklist — 5 Things Every User Should Verify

These are the five most impactful things you can do to protect your account. To work through all five in one sitting — plus mailbox rules, recovery details, and device encryption — follow How to Run a Personal Security Checkup in 15 Minutes.

#	Action	How to Check / Do It	Why It Matters
1	Use a strong, unique password	Change it at myaccount.microsoft.com > Password	A weak or reused password is the #1 way accounts get compromised
2	Register at least 2 MFA methods	Check at mysignins.microsoft.com/security-info	If you lose your phone and have only one method, you are locked out
3	Review your sign-in activity	Check at mysignins.microsoft.com	Spot unauthorized access before it causes damage
4	Review apps with access to your account	Check at myapps.microsoft.com	Revoke access for apps you no longer use or did not authorize
5	Know how to spot phishing	Read How to Identify a Phishing Email	Phishing is the most common attack vector — your awareness is the first line of defense

5. Understanding MFA Methods — Quick Comparison

MFA Method	How It Works	Security Level	Convenience	Recommended?
Microsoft Authenticator (push)	Approve a notification on your phone	✅ High — number matching prevents accidental approval	⭐⭐⭐ Fast	✅ Yes — the recommended default
Microsoft Authenticator (TOTP code)	Enter a 6-digit time-based code from the app	✅ High	⭐⭐ Moderate	✅ Yes — good as a backup
SMS text message	Enter a code sent via text	🔶 Moderate — SMS can be intercepted (SIM-swapping)	⭐⭐⭐ Fast	⚠️ Use as backup only, not primary
Phone call	Answer a call and press # to verify	🔶 Moderate	⭐ Slow	⚠️ Use as backup only
FIDO2 Security Key	Plug in or tap a physical USB/NFC key	✅ Highest — phishing-resistant, no credential transmitted	⭐⭐⭐ Fast	✅ Yes — best for high-security roles
Windows Hello (biometric/PIN)	Use your face, fingerprint, or device PIN	✅ High — device-bound, TPM-backed	⭐⭐⭐ Seamless	✅ Yes — for Windows devices

6. "Something Seems Wrong" — Decision Guide

Use this table to decide what to do when you notice something suspicious.

What You Noticed	Priority	Action
Got an MFA prompt I did not request	🔴 High — someone has your password	Deny the prompt → Change your password → Report to IT
Emails I did not send appear in my Sent folder	🔴 High — account compromised	Change your password → Check for forwarding rules in Outlook Settings → Report to IT
Unfamiliar sign-in in My Sign-Ins	🟠 Medium — possible compromise	If you do not recognize the sign-in, change your password and report to IT. Check if it matches a VPN or travel location.
Unexpected password reset email	🟠 Medium — someone may be trying to reset your password	Do not click links in the email. Go directly to myaccount.microsoft.com. If you did not request a reset, contact IT.
An unfamiliar app has access to your account	🟡 Low-Medium — possible consent phishing	Review and revoke the app at myapps.microsoft.com. Report to IT if you did not authorize it.
Locked out after too many failed attempts	🟡 Low — normal protection	Wait 15–30 minutes, or use self-service password reset at passwordreset.microsoftonline.com.

Troubleshooting

DANGER

If you receive an MFA prompt you did not initiate, do not approve it. This means someone has your password. Tap Deny, change your password immediately, and tell IT that you received an MFA prompt you did not trigger and roughly when it arrived. That is what prompts them to sign your account out of every session and check where the sign-in came from. Time is critical.

Symptom / Error	Potential Cause	Solution
Account locked — "Your account has been temporarily locked"	Too many failed sign-in attempts	Wait 15–30 minutes for automatic unlock. If it is urgent, use self-service password reset or ask IT to clear the lockout now.
MFA prompt received but you did not sign in	Someone has your password	Tap Deny. Change your password at myaccount.microsoft.com. Report to IT immediately.
"Your sign-in was blocked" email received	Conditional Access blocked a sign-in from an unusual location or device	If the sign-in was yours (e.g., traveling or using VPN), contact IT to verify. If it was not yours, change your password.
Cannot sign in — no MFA method available	Lost phone or only one MFA method registered	Use a backup method. If none exists, contact IT to reset your MFA registration. In the future, register at least 2 methods.
Unfamiliar app in MyApps portal	Consent phishing or accidental authorization	Remove the app. Report to IT so they can investigate. See How to Manage App Permissions and Connected Apps.
Receiving suspicious emails that pass the spam filter	Sophisticated phishing or spear-phishing attempt	Do not click links. Report using the Report button in Outlook. See How to Identify a Phishing Email.

Understanding Microsoft 365 Account Security — What Protects You and Why ​

Summary ​

Prerequisites ​

Instructions ​

1. The Layers of Security Protecting Your Account ​

2. What You Control vs. What IT Manages ​

3. "What Happens If..." — Common Security Scenarios ​

4. Your Security Checklist — 5 Things Every User Should Verify ​

5. Understanding MFA Methods — Quick Comparison ​

6. "Something Seems Wrong" — Decision Guide ​

Troubleshooting ​

Related Articles ​

Did this solve your problem?