unusual log in

Treat this as a possible account compromise and secure the account immediately.

1. Go to the Security basics page and select Review activity.
   • Check the Unusual activity and Recent activity sections.
   • If the Brazil sign-in was not recognized, expand it and select This wasn't me or Secure your account.
2. On the same Security basics page, select Change password.
   • Create a strong new password.
   • If the current password no longer works, use Forgot my password and choose I think someone else is using my Microsoft account.
3. Review the account’s recent sign-ins on the Recent activity page.
   • This shows sign-ins from the last 30 days and device or app details.
4. Because Outlook.com is now showing a foreign language, check for mailbox changes that attackers commonly make.
   • In Outlook.com, open Settings.
   • Under Mail, review Rules, Conditional formatting, Forwarding and IMAP, and Junk.
   • Remove anything that was not created intentionally.
5. Review account changes outside the mailbox.
   • Check account aliases and remove any that are not recognized.
   • Check devices linked to the account and remove any that are not recognized.
   • Review app access and remove anything not recognized.
   • Check security contact information and app passwords, and remove anything unfamiliar.
   • Use Sign out everywhere if available. This can take up to 24 hours to fully take effect.
6. If sign-in is blocked because Microsoft detected unusual activity, follow the sign-in screen prompts to receive a security code and unlock the account.
   • If traveling or away from the usual phone or email, signing in from a trusted device or usual location can help.
7. If access cannot be restored, use the sign-in helper or contact Microsoft Support. Support agents cannot send password reset links or change account details.

Also verify the alert itself. A legitimate unusual sign-in email is from the Microsoft account team at ******@accountprotection.microsoft.com.

References:

• What happens if there's an unusual sign-in to your account
• What is the Recent activity page?
• Check the recent sign-in activity for your Microsoft account
• Help protect your Outlook.com email account
• Foreign language on my outlook account - Microsoft Q&A
• Wording in Outlook is in Arabic - Microsoft Q&A