Start with the sign-in route
Use a link obtained from your organization or the verified provider, and check the domain before entering credentials. A convincing logo or a familiar display name does not establish that a website or message is legitimate.
Protect the account
Where allowed, use a unique password kept in a password manager and enable multifactor authentication. Prefer phishing-resistant options when your organization offers them. Never approve a sign-in prompt you did not initiate; report unexpected prompts through a known IT channel.
Plan for recovery
Keep recovery methods current and follow company policy for storing recovery codes. If you suspect a password or session has been compromised, contact your administrator promptly and use the provider’s verified recovery process. The response may include revoking sessions and rotating credentials.
A response to an unexpected prompt
If an approval prompt appears while you are not signing in, do not approve it to make the notification disappear. Report it to your organization using a contact you already trust. If you entered credentials on a suspicious page, tell the incident team what happened and follow its instructions for credential reset and session revocation. Preserve useful details such as the time and domain, but do not forward passwords or authentication codes in the report.
Choose the next step
| Situation | What to check |
|---|---|
| Unexpected approval request | Deny it and report it through a known channel. |
| Password entered on a suspicious page | Contact IT and follow the incident response process. |
| Lost recovery method | Use the provider’s verified recovery procedure and company policy. |
A practical checklist
- Bookmark the verified sign-in address.
- Use a unique password or the approved single sign-on flow.
- Turn on supported multifactor authentication.
- Report unexpected prompts without approving them.