[drop_cap]I[/drop_cap]’ve recently migrated all my work machines from Windows to Linux because I finally grew tired of Microsoft’s adware nonsense. And yet, they still managed to throw a wrench into my workflow.

As many of you know, Microsoft has their own little “Authenticator” app that acts as an MFA gateway. When you sign in to your account, you get a notification on your phone where you can Approve/Deny the request and enter a number.

A few weeks ago, I got a notification for one of my old Microsoft accounts: “Someone in Helsinki is trying to sign in to your account. Approve/Deny.”

Obviously, I hit deny. But it made me question what happened.

First check: “Recent sign-in activity.” Only successful ones were listed. Only me.

Did my 32-character password leak somehow? Improbable, but I generated a new one anyway.

Three weeks later: “Someone from Washington is trying to log in to your account. Approve/Deny.”

Interesting. That new password couldn’t have leaked, since it was never saved anywhere! Someone online recommended switching to passwordless sign-ins, so I gave that a try. The theory was sound: only MFA prompt after passkey validation.

Next week: “Someone from Paris is trying to log in to your account. Approve/Deny.”

Wait a second. Was Microsoft just spawning these notifications as soon as anyone entered a random email address into the Microsoft login portal?

Surely that can’t be the case.

They would only send the notification after either the password or passkey was validated, right?

Nope.

After finding a recent forum post where dozens of other people were tearing their hair out over this exact issue, it finally hit me: Microsoft Authenticator is completely broken by design.

As Elias Yazidi wrote:

I did some testing and it is possible to send notifications without a password.

Yes, that’s right. Script-kiddies and bots can happily spam these unthrottled push notification endpoints all day long until MFA fatigue kicks in and an exhausted user accidentally hits “Approve” at 3 AM.

The only way to permanently stop this madness is to completely remove Microsoft Authenticator from your account and use a proper RFC 6238 TOTP like Google Authenticator. Naturally, they don’t tell you that in order to pull this off, you first have to disable “passwordless mode”—a process that silently nukes any standard TOTP methods you previously configured.

And sure, you could also create a new alias and migrate your sign-in preference to dodge the spam, but why should I have to restructure my whole frigging identity just because Microsoft can’t properly gate a push notification behind a password check?

As someone who considers themselves fairly tech-savvy, I can only imagine what the average user goes through here.

Some more fun facts from this dumpster fire:

  • Destructive UI hidden as “View”: Clicking on “Recovery Codes” doesn’t just show your existing emergency keys or warn you of destructive action. It just silently invalidates your previous codes on the backend, rendering your safe-deposit printouts instantly useless.
  • Broken DOM structure: Their login forms use some weird multi-step DOM swaps instead of simple HTML, causing browser password managers to attempt saving your new password with an empty username like it’s 1998.
  • Aggressive frontend cache desync: You can literally log in with a brand-new password you changed two minutes ago, only for Microsoft’s cached dashboard UI to confidently tell you your password was “Last changed 5 days ago.”
  • Cross-domain auth ping-pong: Logging in on a clean browser forces you through a multi-portal redirect loop (.live.com to .microsoftonline.com and back), occasionally dropping session tokens along the way and forcing you to type your password twice.
  • Automated time-capsule emails: Once you finally sort out standard TOTP, Microsoft sends you an automated setup email enthusiastically asking if you need help configuring your Zune, BlackBerry, or Office 2010.

None of these are isolated bugs, they’re symptomatic of tacked on legacy systems and enterprise rot. This is what happens when nobody owns the whole architecture anymore, just the fragment they were assigned.

And it begs the question: if Microsoft can’t even handle a basic HTML form or a rate-limited push API, how are we supposed to trust them with a whole operating system?