If the Microsoft account still uses that old email address as an alias, the sign-in can continue to work even after the mailbox itself is disabled, because aliases are part of the Microsoft account. To update the communication/sign-in email address:
- Sign in to Your info and open Edit account info at https://account.live.com/names/manage.
- Select Add email to add the new address, or select Remove next to an existing address.
- If needed, make the new address the primary alias.
Important implications called out in Microsoft guidance:
- Aliases on a Microsoft account share the same contacts, online storage, subscriptions, and account settings.
- Any alias can be used to sign in to Microsoft services and devices.
- All aliases share a single password.
- Verification codes sent by email can only be sent to the primary alias or to another email added as a sign-in verification method.
Because the email account was hacked, complete these security steps first:
- Run a full malware scan on the PC before making further account changes:
- Open Windows Security.
- Go to Virus and threat protection.
- Select Scan options > Full scan > Scan now.
- After the scan, change or reset the Microsoft account password.
- Review account settings that attackers commonly change:
- connected accounts
- forwarding
- automatic replies
If sign-in no longer works with the old address, use the Microsoft Sign-in helper. If the account was compromised, the recovery flow may also offer the chance to talk to an agent. Support can route the case, but support agents cannot send password reset links or directly change account details.
If the account uses two-step verification and there is no access to any alternate verification method, Microsoft states that support cannot help recover access.