Urgent: Repeated Unauthorized Sign-in Attempts – Request for Account Security Assistance

Question

Urgent: Repeated Unauthorized Sign-in Attempts – Request for Account Security Assistance

Pontep Matoom 0

Dear Microsoft Security Support Team,

I am writing to report repeated unauthorized sign-in attempts on my Microsoft account.

I have noticed multiple login attempts occurring several times a day from locations and devices that I do not recognize.

I am concerned that someone may be attempting to gain unauthorized access to my account.

I would appreciate your assistance with the following:

Investigate the repeated unauthorized sign-in attempts.
Identify whether these attempts are coming from suspicious IP addresses, devices, or locations.
Help block or prevent suspicious login attempts wherever possible.
Advise me on additional security measures to protect my account.
Check whether my account has been compromised or exposed to any security risks.

I confirm that these login attempts were not initiated by me.

Please treat this matter as a security concern and advise me on the necessary steps to secure my account.

Thank you for your assistance.

Kind regards, Account Owner

0 comments

1 answer

Your answer

Answer 1

Hi @Pontep Matoom

I understand your concern about seeing repeated sign-in attempts from unfamiliar locations and devices.

First, please review whether the unfamiliar entries are marked as Successful sign-in or Unsuccessful sign-in:

An unsuccessful sign-in means the attempt did not result in access to your account.
An unfamiliar successful sign-in may indicate unauthorized access and should be addressed immediately.

If this is a personal Microsoft account

Sign in directly to your Microsoft account and open the Recent activity page. Expand each unfamiliar entry to review details such as the approximate location, IP address, device, operating system, browser, and sign-in method.

If an entry was not yours, select This wasn’t me or Secure your account, if either option is available. Microsoft may then guide you through changing your password and reviewing your security information.

For more details, please refer to: What is the Recent activity page?

You should also:

Change your password.
Enable two-step verification.
Review your security email addresses and phone numbers.
Remove unfamiliar devices or security methods.
Check Outlook forwarding rules and other account settings.
Scan your devices for malware.

As an additional measure, you can create a private alias for signing in and disable sign-in access for your existing public email address, while keeping it available for sending and receiving email.

When doing this, do not remove your current email alias if you still need it. Only disable it under Sign-in preferences.

References:

If this is a work or school account

Go to https://mysignins.microsoft.com/, select Recent activity, and review the sign-in status, application, location, and device details.

User's image

If you find an unfamiliar successful sign-in, change your password immediately and contact your organization’s Global Administrator or IT security team. They can review the relevant sign-in logs and apply appropriate security measures.

An administrator with the required permissions can review the activity in the Microsoft Entra admin center:

Go to https://entra.microsoft.com/.
Navigate to Users > All users.
Search for your account and open the Sign-in logs.
Microsoft Entra sign-in logs show successful and failed sign-in attempts and provide details that administrators can use during an investigation.

For more details, please refer to: Learn about the sign-in log activity details - Microsoft Entra ID

Sign-in logs in Microsoft Entra ID - Microsoft Entra ID

The administrator may also reset the password, revoke active sessions, review registered authentication methods, investigate risky activity, and apply appropriate Conditional Access policies.

Please note that I am a fellow user and do not have access to your account, sign-in records, IP information, or Microsoft’s internal security systems. Therefore, I cannot investigate these attempts, identify who is responsible, block specific IP addresses, or confirm whether your account has been compromised. However, I hope the information and suggested steps above help you better understand the situation and determine what to do next.