I got hammered with ms auth requests for weeks before I finally just changed it to a dedicated email address. Really frustrating.
this post was submitted on 07 Sep 2026
108 points (98.2% liked)
Technology
87878 readers
3305 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
Microsoft can’t properly gate a push notification behind a password check?
Careful now. If you put the MFA prompt after the password, it works as confirmation that you have the correct password even if you're not able to log in. You don't want to give that confirmation to the attacker. That's why MFA happens before the password is validated.
Just set a timer after entering the password in every single case (only stopped early by successful MFA). "authentication did not succeed, one or more factors may be incorrect or may have failed verification"
Use something like Aegis?
And sure, you could also create a new alias and migrate your sign-in preference to dodge the spam, but why should I have to restructure my whole frigging identity just because Microsoft can’t properly gate a push notification behind a password check?
Why indeed.
Happened to me as well and I reacted in exact same way (pulling hair, changing password).
Automated time-capsule emails: Once you finally sort out standard TOTP, Microsoft sends you an automated setup email enthusiastically asking if you need help configuring your Zune, BlackBerry, or Office 2010.
🥹
Everything about authentication and Microsoft is nightmare fuel. I am sure that noone over there has any idea what is going on, and that is the reason why every new thing from microsoft builds their own - soon to be legacy code anyway - authentication portal and ties it to the existing kowloon walled city of authentication with chewing gum and zip ties.
Try supporting Onedrive for business when Onedrive often fails SSO and people use their work email address to create a personal account because by default Microsoft encourages that unless you aggressively lock that down, and then people will have sensitive work data on an account you can't control, and if they switch computers it gets worse because if they don't know that password and if the old computer is broken there's nothing the business can do to get the data.
Oh, and Adobe does the same thing. Neither tell you upfront that you should disable creation of personal accounts using the work email address/domain. The user won't notice because it doesn't occur to them to select "organization account" and they just click the first option.
Which is also both a security nightmare and GDPR nightmare.
I recently had to install MS authenticator on my work phone, to do so I needed to use the code from MS authenticator. To bypass that I needed to log on to MS to change access option, which wanted the code from MS authenticator to log in.
Kowloon Walled City (Chinese: 九龍城寨)[a] was an ungoverned and densely populated de jure Chinese enclave within the boundaries of British Hong Kong.
spoiler
Originally a Chinese military fort, it became an enclave after the New Territories were leased to Britain in 1898. The Walled City's population increased dramatically following World War II, and by 1987 it had an estimated 33,000 residents within its 2.6-hectare (6+1⁄2-acre) borders, making it one of the most densely populated places on Earth at approximately 1.2 million inhabitants per square kilometre (3 million per square mile). The city was demolished between 1993 and 1994; the Kowloon Walled City Park was built in its place and opened in December 1995.
* Microslop
My MS account is doing a thing lately where I have to enter the TOTP twice to login successfuly. It has to be two different TOTPs, too, can't enter the same one; I have to literally wait until the first one expires and get another one.
Didn't experience any of the other shenanigans described in the article though, so there's that.
I have a few networks where I get the notice but must disconnect from the wifi to approve over my mobile connection instead
TOTP is time based, I'd check the time on the device just in case. Having to enter multiple codes must be so annoying!
I have the machine synced with NTP and I'm not seeing any time issues.
It's such a super specific quirk, too, that I can't believe it's not on their side.
Maybe they've decided that TOTP is less secure than passkeys and if I refuse to use passkeys with their app I should be "helped" 😃 by using twice the amount of TOTP?