Hi allenthomsen,
Thank you for explaining the scope of the issue. Since this is a public community forum, contributors here cannot access Microsoft sign-in logs, connected-device records, passkeys, or Windows diagnostic data, and I cannot open or document a formal security investigation on your behalf.
Before removing unfamiliar profiles, passkeys, or devices, preserve what is currently visible by taking screenshots and noting the date, time, device name, location, IP address, and any reference numbers shown. Do not post those details publicly. If preserving evidence is important, avoid resetting or reinstalling Windows until you have discussed the situation with an appropriate support professional.
Microsoft can only review information relating to Microsoft accounts and services. The Gmail and Apple/iCloud activity would need to be handled separately by Google and Apple. For the Microsoft portion, use the official compromised-account support process or contacting support, clearly state that you need help reviewing account security activity, registered authentication methods, connected devices, and unfamiliar passkeys, and that you want to preserve evidence before making major changes. Please be aware that standard consumer support may help secure the account and explain available records but may not be able to perform a full forensic investigation or identify who accessed a device.
If you believe a device is still being accessed, disconnect it from the network and use a separate trusted device to secure the affected accounts. For evidence intended for legal or law-enforcement purposes, consider consulting a qualified digital-forensics professional before altering the device. Thank you so much for your understanding.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.