suspicious sign-in attempts

Create a new, private alias for signing in, make it primary, and block the existing Hotmail address from sign-in without removing it; this preserves the mailbox while preventing attempts made with the exposed address.

Stop the unsolicited prompts

1. Open Microsoft account → Your info → Manage how you sign in to Microsoft.
2. Select Add email.
3. Create a new Outlook.com address that is difficult to guess and use it only as your sign-in name. Do not publish or use it for ordinary email.
4. After verifying it, select Make primary beside the new alias. Microsoft aliases share the same account, contacts, storage, subscriptions, settings, and password.^1^
5. Go to Your info → Sign-in preferences.
6. Allow the new alias to sign in, clear the checkbox for the old Hotmail alias, and select Save.^2^
7. Test the new alias in a private browser window before signing out of existing devices.

Do not remove the old Hotmail alias. Blocking it from sign-in is different from removing it: the old address remains attached to the account for sending and receiving email, but it can no longer be used as the username to initiate a sign-in.

Continue selecting Deny or It’s not me for every request you did not initiate. Never approve one merely to stop the notifications.

Check whether any attempt succeeded

Because changing the password did not stop the prompts, do not keep repeating that step. Instead:

1. Open Microsoft account → Security → Review activity.
2. Expand unfamiliar entries.
3. For an entry under Unusual activity, select This wasn’t me. For unfamiliar activity under Recent activity, select Secure your account.^3^
4. Pay particular attention to entries marked Successful sign-in, security-information changes, or permission granted to an application. A successful sign-in means the correct password was used; an unusual-activity entry means the password was correct but Microsoft required another security challenge.^4^
5. Under Security → Advanced security options, review Ways to prove who you are. Keep only phone numbers, email addresses, Authenticator registrations, and devices that belong to you. Ensure that at least one valid recovery method remains.

If an unfamiliar successful sign-in appears

Treat the account as potentially compromised:

1. Run a full antivirus scan on devices used with the account.
2. Inspect Outlook.com forwarding, connected accounts, and automatic replies for changes you did not make.^5^
3. In Advanced security options, scroll to Sign out everywhere and select Sign out. Microsoft states that browsers and apps will be signed out within 24 hours, except Xbox consoles.^6^
4. After the device scan, change the password again to a unique password not used on any other service. This repeat is warranted only if the activity shows access may have succeeded.

If all unfamiliar entries are unsuccessful and there are no unknown security methods, the prompts alone do not establish that the account was accessed. Keep Authenticator enabled; the new sign-in-only alias should prevent attempts made against the old Hotmail address from reaching the approval stage.

References

1. Change the email address for your Microsoft account | Microsoft Support
2. Block an email address from signing in | Microsoft Support
3. What happens if there's an unusual sign-in to your account | Microsoft Support
4. What is the Recent activity page? | Microsoft Support
5. How to recover a hacked or compromised Microsoft account | Microsoft Support
6. How to sign out of your Microsoft account everywhere | Microsoft Support