Someone created a passkey for my account and it was not me.

Treat the account as compromised: scan Windows first, change the Microsoft account password, report the unknown activity, and remove the unauthorized passkey from the account’s security dashboard.

1. Scan Windows before changing credentials

Microsoft recommends scanning the computer before changing a compromised account’s password, so malware cannot capture the replacement credentials.^1^

1. Open Windows Security.
2. Select Virus & threat protection → Scan options → Full scan → Scan now.
3. For a deeper check, save open files and select Microsoft Defender Offline scan. The computer will restart and scan outside the normal Windows environment.^2^

2. Secure the Microsoft account

After the scan:

1. Go directly to https://account.microsoft.com/security—do not use links from unexpected email.
2. Select Review activity.
3. Expand every entry you do not recognize:
   • Select This wasn’t me for an entry under unusual activity.
   • Select Secure your account for an unrecognized recent-activity entry.
4. Return to Security basics → Change password and create a new, unique password.^3^

Also inspect the listed recovery email addresses and telephone numbers. Add a recovery method that belongs to you before removing a passkey or other sign-in method, so you do not lock yourself out.

3. Remove the unauthorized passkey

For a personal Microsoft account:

1. Open https://account.live.com/proofs/manage.
2. Sign in and review Advanced Security Options.
3. Find the unknown passkey and expand it.
4. Check where it is stored and when it was last used.
5. Select Remove.

This dashboard lists the account’s sign-in verification methods, including passkeys and their storage location.^4^

Then check whether a copy is stored locally on this PC:

1. Open Settings → Accounts → Passkeys.
2. Locate the unknown passkey.
3. Select … → Delete passkey.

Removing it from Windows deletes the device-bound copy; removing it from Advanced Security Options removes it as a sign-in method for the Microsoft account. A passkey may instead be held by a synchronized credential manager, so remove it from that provider too if the dashboard identifies one.^4^

If access has already been lost

At the Microsoft sign-in page, select:

1. Forgot my password.
2. I think someone else is using my Microsoft account.
3. Complete the recovery instructions.^3^

Microsoft’s compromised-account Sign-in Helper can also direct you to recovery options or offer contact with an agent.^1^ Support agents cannot directly change account details or send password-reset links.^5^

An unauthorized passkey or recovery address establishes that the account needs securing, but it does not by itself establish that somebody remotely exploited Windows 11. The activity history and malware scans are the appropriate checks for distinguishing account compromise from a problem on the PC.

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. Three easy steps to improve your cybersecurity | Microsoft Support
3. What happens if there's an unusual sign-in to your account | Microsoft Support
4. [Personal](https://support.microsoft.com/accounts-billing/security/manage-your-saved-passkeys)
5. How to help keep your Microsoft account secure | Microsoft Support