Verify Popup Is Legitimate

The popup cannot be confirmed as legitimate from its wording alone; close it and independently open your Microsoft account’s Security page to verify your contact information and recent activity rather than returning to the popup.

Check the request safely

1. Open a new Edge tab and type account.microsoft.com yourself.
2. Sign in, then select Security → Review activity.
3. Review recent sign-ins. If an unfamiliar event appears, expand it and select This wasn’t me or Secure your account, as offered. Microsoft documents that genuine unusual-sign-in checks may request a security code sent to an existing contact method.^1^
4. Review the email addresses and phone numbers in your security settings. Do not approve or add information you do not recognize.

A genuine Microsoft sign-in prompt can say “Let’s protect your account” or “Help us secure your account” and ask for an accessible email address or phone number so Microsoft can send a verification code.^2^ However, a webpage can imitate such a prompt, so its appearance in Edge does not by itself prove authenticity.

Since you clicked OK

• If OK merely dismissed or acknowledged the message: close that tab. No password change is normally warranted solely because a button was clicked, but review recent activity as above.
• If you entered a password, verification code, or new contact information: treat the interaction as potentially compromised. Run Windows Security → Virus & threat protection → Scan options → Full scan → Scan now, and then change the Microsoft account password from the independently opened Security page. Microsoft recommends scanning before changing the password when compromise is suspected.^3^
• If anything downloaded or you allowed remote access: disconnect the PC from the network, run the full scan, remove the downloaded program, and change the password from a known-safe device.
• If it displayed a telephone number or demanded payment: it was not a legitimate Microsoft warning. Microsoft warnings do not include a number to call, and Microsoft does not request payment through gift cards or cryptocurrency.^4^

To report a suspicious page in Edge, select Settings and more (…) → Help and feedback → Report unsafe site.^5^

For a work or school account, review My Account → Recent Activity instead and contact your organization’s IT/security team if any sign-in is unfamiliar.^6^

References

1. What happens if there's an unusual sign-in to your account | Microsoft Support
2. Help us secure your account | Microsoft Support
3. How to recover a hacked or compromised Microsoft account | Microsoft Support
4. Protect yourself from tech support scams | Microsoft Support
5. Protect yourself from phishing
6. View your work or school account sign-in activity from My Sign-ins | Microsoft Support