Account blocked due to malicious activity

That pattern aligns with spoofed phishing or extortion email, not proof that the account was actually accessed. Microsoft notes that unusual activity can trigger extra verification or a temporary suspension, and the Recent activity page can show events such as Unusual activity detected, Sign-in blocked (Account compromised), or Sign-in blocked (Account temporarily suspended).

If the account is already restored and there is no evidence of access, the practical next checks are:

1. Review Recent activity on the Microsoft account and look for unknown successful sign-ins, locations, or security changes.
2. Check for signs of compromise such as:
   • missing or deleted mail
   • suspicious Inbox rules
   • suspicious messages in Sent Items or Deleted Items
   • unexpected password changes or lockouts
3. If the account is blocked again, use the Microsoft account recovery or unlock flow:
   • sign in at https://account.microsoft.com
   • if available, complete Let's prove you're human
   • if that option does not appear, use the reinstatement link shown in the lock window and submit the form once
4. If OneDrive shows Your account is currently unavailable, use the Microsoft services account reset page and follow the on-screen steps. If the account was recently verified by text message or many files were shared, the block can clear within 24 hours.

For the report itself, the available support path in the provided guidance is Microsoft Support for personal accounts, or the Microsoft Community. For work or school accounts, the path is the organization IT helpdesk or admin.

• What is the Recent activity page? | Microsoft Support
• Respond to a compromised cloud email account
• Microsoft account has been locked | Microsoft Support
• Reactivate an account that has been blocked