Account security

For a personal Outlook.com account, create a private alias used only for signing in, block the existing public email address from sign-in, and enable Microsoft Authenticator with two-step verification.

1. Check whether any attempt succeeded

1. Open your Microsoft account Security page directly rather than following links in alert emails.
2. Select Review activity.
3. Expand unfamiliar entries and inspect the status, device, browser/app, and time—not only the reported country.
4. For an entry under Unusual activity, select This wasn’t me. For suspicious entries under Recent activity, select Secure your account. Microsoft’s activity page covers the last 30 days.^1^

Then act according to the result:

• Incorrect password entered/unsuccessful: Microsoft did not allow that sign-in. Proceed with the protections below.
• Successful sign-in that was not yours: immediately choose This wasn’t me or Secure your account, change the password to a new unique password, update recovery information, and remove unrecognized trusted devices.^2^

2. Stop attempts against your public Outlook address

Use a new, unshared alias as the account’s sign-in name while retaining the old Outlook address for email:

1. Go to Microsoft account → Your info → Sign-in preferences.
2. Select Add email and create a new Outlook.com alias with a name that is difficult to guess.
3. Set the new alias as primary.
4. Return to Sign-in preferences.
5. Allow sign-in through the new alias and disable sign-in through the old, publicly known Outlook address.
6. Select Save.

Microsoft permits sign-in to be blocked for selected aliases.^3^

Do not remove the old alias. Aliases share the same inbox, contacts, storage, subscriptions, settings, and password, so the old address can remain available for sending and receiving email even when it cannot be used to sign in.^4^

Keep the new alias private—use it only to sign in, not for newsletters, registrations, or correspondence.

3. Turn on two-step verification

1. Open Microsoft account → Security.
2. Select Manage how I sign in.
3. Under Additional security → Two-step verification, select Turn on.
4. Follow the prompts to add Microsoft Authenticator and scan the displayed QR code.^5^
5. Add and maintain more than one recovery method so losing one device does not lock you out.

Two-step verification requires both the password and a verification method, so knowing or guessing the password alone is insufficient. Never approve an Authenticator request that you did not initiate.

For stronger protection, Microsoft also supports making the personal account passwordless through Authenticator: Security → Manage how I sign in → Passwordless account → Turn on.^6^

Repeated failed attempts do not mean the account was accessed. They can continue while the known email address remains accepted as a username; restricting sign-in to a private alias addresses that exposure while preserving the existing mailbox.

References

1. Check the recent sign-in activity for your Microsoft account
2. What happens if there's an unusual sign-in to your account | Microsoft Support
3. Block an email address from signing in | Microsoft Support
4. Change the email address for your Microsoft account | Microsoft Support
5. How to use two-step verification with your Microsoft account | Microsoft Support
6. How to go passwordless with your Microsoft account | Microsoft Support