How can I stop frequent sign-in attempts on my Microsoft Passwordless account?

What you're facing is known as an MFA fatigue attack, and it's quite common. Hackers hope you'll accidentally approve their sign-in request. One effective way to tackle this is to create an alias for your account and set it as your primary username. By doing this, the attackers won’t be able to trigger the second factor since they’ll be using the old email address to sign in, which will become invalid. Just remember not to delete the old email address; if you do, all emails sent there will bounce.

Unfortunately, there isn't much you can do to stop the sign-in attempts themselves, but the best course of action is to ignore the notifications and not tap 'allow'. Hopefully, over time, the attackers might give up and stop trying.

I dealt with this issue for a few weeks on both my Microsoft accounts, and I found a solution that worked for me. I changed my sign-in email address to an alias. To do this, go to your account settings and create an alias using something like '[email protected]' instead of '[email protected]'. Make the new alias your primary sign-in, and then you can remove the old email address. From then on, you can still receive emails at the old address, but only use the new alias to log in. Since I made this change six months ago, I haven't experienced any unauthorized sign-in attempts!