Unusual Activity Notification

Question

Unusual Activity Notification

Judie 0

I received an email that there was unusual sign-in activity on my account from another country but I don't see that when I reviewed the "Recent Activity" page. Is there something that I need to do to make my account more secure?

0 comments

2 answers

Your answer

Answer 1

Open the Microsoft account Security page directly—not through the email—and enable two-step verification while reviewing your security and recovery methods.

Secure and verify the account

Type https://account.microsoft.com/security into your browser and sign in to the Microsoft account that received the alert.
Open Advanced security options or Additional security options.
Under Two-step verification, select Turn on, then follow the prompts.
Review the listed phone numbers, alternate email addresses, and Microsoft Authenticator entries:
- Remove anything you do not recognize.
- Ensure you have more than one current recovery method.
- Consider adding Microsoft Authenticator or enabling passwordless sign-in. Microsoft documents these as stronger sign-in options and recommends keeping recovery methods current.^1^

The security-method management page can also be opened directly at https://account.live.com/proofs/Manage.

Why the alert may not appear

Since you already reviewed Recent Activity, there is no need to repeat that check. Microsoft states that this page covers the last 30 days but does not display every account event; it generally shows events considered significant to account security.^2^

An alert can also result from a new device, application, or location. Mobile providers may route traffic through another location, so the country shown is not always the device’s physical location.^2^

Check whether the email is genuine

Microsoft documents [Email] as the sender used for unusual sign-in alerts.^3^

However, a matching visible sender address alone is not conclusive because sender information can be spoofed. Do not click links, open attachments, reply, or provide a password or security code. Navigating directly to https://account.microsoft.com/security remains the safest way to verify whether Microsoft requires action.

If the message fails verification, use Outlook’s Report → Report phishing option, then delete it.

Change the password only if compromise is possible

If you did not initiate the reported sign-in and believe someone may have accessed the account:

Go directly to https://account.microsoft.com/security.
Select Change password.
Create a strong, unique password not used on any other site.
Review security information and remove any unknown verification methods.

If an unfamiliar event later appears under Unusual activity, expand it and select This wasn't me. If suspicious activity appears under Recent activity, select Secure your account.^3^

References

Answer 2

Hello,

I am going to share with you a comprehensive list of things to do to further review and secure your account just in case. Please feel free to skip any steps you have already completed, except the first step, which is very important.

Please complete these steps on a computer, not on a smartphone or tablet.

Step 1: Sign out everywhere FIRST

Go to https://account.microsoft.com/security and sign in.

Go to Manage how I sign in, scroll down, and click Sign out everywhere.

This is intended to disconnect any active sessions that may still have access to your Microsoft account.

IMPORTANT: This process can take up to 24 hours to fully take effect. This means someone who is already signed into your account may not be disconnected immediately.

Continue the following after the 24-hour wait is over.

====================

Step 2: Review your Outlook settings

Go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed that you did not create, delete them. If you do not use rules at all, you can delete all of them.

Conditional formatting

If anything is set up there that you did not create, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP if you do not use them.

Junk

Review your Safe senders and Blocked senders lists. Remove any unfamiliar entries from the Safe senders list.

After that, exit Settings and return to Outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Step 3: Review your Microsoft account

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on your account. If you see any alias you do not recognize, remove it. Be careful not to delete any legitimate email address you still use.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Step 4: Secure your account

Go to the Security section of your Microsoft account.

Change your password to a new, strong password that you have never used before.

Enable two-step verification.

Go to Manage how I sign in and make sure all security contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords you do not need.

====================

Step 5: Review app permissions

Go to https://account.microsoft.com/privacy/app-access.

Review the apps that have permission to access your Microsoft account.

Click Don't allow for anything you do not recognize or no longer use.