Open your Microsoft account by typing account.microsoft.com into your browser, then go to Security and Recent activity. Expand the alert and compare its date, approximate location, IP address, device, operating system, browser and app with what you were doing. Microsoft’s Recent activity page shows the last 30 days. If every detail fits your action, choose This was me. If you do not recognize it or remain unsure, choose This wasn’t me, use Secure your account when it appears, and change your password and security information.
A new phone, computer, travel connection or newly installed app can produce an alert without an attacker being present. Conversely, an unfamiliar sign-in can indicate that someone has your password. The event details—not the location alone—should determine your response.
As an Amazon Associate I earn from qualifying purchases.
What a Microsoft unusual sign-in alert means
Microsoft flags activity when a sign-in appears to come from a new location or device, or when an app presents an unfamiliar sign-in pattern. Legitimate causes include signing in while traveling, setting up a replacement phone, using a new browser, reinstalling an application or connecting through a mobile carrier whose network exits in a distant city.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The warning is therefore a request to verify an event, not automatic proof that your account was hacked. Treat an event as suspicious when the time, device, operating system, browser, application and network context do not match anything you did. A distant map pin by itself is weak evidence because approximate geolocation can describe the carrier’s gateway rather than your physical position.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use the account site instead of an email link
- Open a new browser tab and manually enter
account.microsoft.com. Do not use a button or URL in the warning email until you have verified that the message is genuine. - Sign in and select Security.
- Open Recent activity or select Review activity in the unusual-activity section.
- Expand the event that caused the warning. Record the displayed date and time, approximate location, IP address, device or operating system, browser and app before deciding what to do.
Microsoft specifically recommends signing in directly when an unusual-activity email could itself be suspicious. A genuine Microsoft page will let you examine the event from your account rather than asking you to disclose your password by email.
How to judge whether the event was yours
Check the time and your activity
Convert the event time to your local time zone and recall whether you were signing in, changing a password, adding an account to an app or waking a device then. A delayed notification can make a legitimate action look unfamiliar, so match the event to the action rather than to the moment you read the message.
Check the device, operating system and browser
A Windows laptop, Android phone, iPhone, Xbox or a browser you never use deserves closer attention. The combination matters: a known device with the expected operating system and browser is more reassuring than a familiar city paired with an unknown device.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use the IP address and location as supporting evidence
Compare the IP address with the network you used, if you can. Mobile and corporate networks may route traffic through another region. An unfamiliar location is a warning signal, not a verdict; an unfamiliar device and application are stronger reasons to treat the event as unauthorized.
Look at the application name
Mail clients, cloud-storage software and newly installed Microsoft applications can create sign-ins you do not remember as a separate browser session. If the listed app does not belong to anything you installed or authorized, do not mark the event as yours merely because the date looks plausible.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the correct response
When every detail matches your action
Select This was me only when the full context fits. You may have to repeat verification on a new device or network in the future; approving a genuine event helps Microsoft distinguish your normal activity from an attack.
When the event is not yours or you are uncertain
Select This wasn’t me. Microsoft’s flow is designed to protect the account and direct you to the next security steps. In the Recent activity list, select Secure your account for suspicious activity, then change the password from Security settings. Use a new password that is not reused on another service.
Do not choose This was me simply to dismiss a notification. If you cannot establish that the event was yours, the safer choice is to report it and secure the account.
Secure an account after an unrecognized sign-in
- Change the password. Use Security settings, create a unique password and avoid a variation of the old one. Sign out of other sessions if Microsoft presents that option.
- Inspect account identities. Review aliases and alternate email addresses. Remove an address you did not add and correct an address that you no longer control.
- Check recovery channels. Review phone numbers, alternate email addresses, authenticator registrations and recovery codes. Replace or revoke anything you did not authorize.
- Review app access. Examine app passwords, connected-app permissions and other access entries shown in the activity or security pages. Remove an entry you do not recognize.
- Check verification changes. Look for additions or removals involving two-step verification and security information. An attacker who changed these can try to regain access after you reset the password.
- Secure other accounts that used the same password. Change those passwords directly on their official sites. Microsoft cannot protect a different service whose password was reused.
Microsoft Support says, “If you see anything suspicious in the Recent activity section … select Secure your account.” Follow that action before investigating less urgent settings.
If your password no longer works
A changed or rejected password can mean that someone changed it, that you are using the wrong Microsoft account identity, or that a saved password is stale. Start with Microsoft’s password-reset and account-recovery process. Select the option indicating that someone else may be using the account when it is offered, and provide the requested recovery information.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you regain access, immediately review aliases, recovery contacts, authenticator registrations, app passwords, permissions, recovery codes and two-step-verification changes. If a recovery phone number or email address was replaced, update the security contact information as soon as access is restored. Do not delay because an attacker may use an unchanged recovery method to take the account back.
Handle an unexpected Microsoft Authenticator prompt
If Authenticator asks you to approve a sign-in that you did not start, choose Deny. Do not approve it to make the notification disappear. Microsoft identifies several possible causes: an attacker testing a stolen password, somebody accidentally entering your address, or a delayed prompt arriving after an earlier legitimate attempt.
After denying the request, open Recent activity directly and compare the corresponding event. If it is not yours, use This wasn’t me, choose Secure your account where available, change the password and audit security information. Repeated prompts are a reason to investigate even when no prompt was ultimately approved.
Personal Microsoft accounts versus work or school accounts
The screen you need depends on the account type. A personal account uses the Microsoft account Security and Recent activity pages. An account issued by an employer or school uses the organization’s My Sign-ins portal, where an administrator may control available verification methods.
| Account type | Where to review activity | What to do when an item is unauthorized | Who controls available methods |
|---|---|---|---|
| Personal Microsoft account | Microsoft account Security and Recent activity | Review the item, change the password and update security information | You manage the account’s available methods |
| Work or school account | My Sign-ins portal | Review each item, change the password and update Security info; contact the administrator if required | Your organization’s administrator and policy |
Work or school policies can make a method available for password reset but not for two-factor sign-in. If a method is missing, an administrator may have disabled it rather than Microsoft having lost the setting.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Strengthen sign-in and recovery after the incident
Microsoft lists alternate email, Microsoft Authenticator and passkeys among personal-account sign-in or verification choices. For work or school accounts, available methods can include Authenticator, phone calls, security keys, email and security questions. Their capabilities differ:
| Method | Typical role | Offline or network dependence | Important limitation |
|---|---|---|---|
| Passkey | Sign-in or verification without a traditional password | Uses the enrolled device or security hardware | Microsoft describes passkeys as phishing-resistant; plan a recovery method for a lost device |
| FIDO2 security key | Hardware passkey for supported sign-in flows | The key is physically present; no phone signal is needed during use | Support depends on account type, browser, operating system and organization policy |
| Microsoft Authenticator | Sign-in approval or verification | Microsoft says it can work when the verification device is offline | Loss of the phone requires a previously configured recovery method or administrator help |
| Alternate email | Verification and account recovery | Requires access to the email service and its network | Work or school administrators may restrict it to password-reset authentication |
| Phone call or text | Verification or recovery where enabled | Requires a reachable telephone service | A lost, replaced or unreachable number can block recovery |
| Security questions | Usually account recovery | Requires access to the recovery flow | In work or school setups, Microsoft notes that some methods are limited to password-reset authentication rather than two-factor sign-in |
Configure at least two independent recovery paths before you need them. For example, an Authenticator enrollment plus an alternate email is less fragile than relying on one phone. Store recovery codes where you can reach them without leaving them beside the device they protect.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When a FIDO2 security key makes sense
A FIDO2 security key is a physical passkey. It is useful when you want a phishing-resistant sign-in that does not depend on a phone battery, mobile signal or email inbox. Keep a primary key and, if the account or organization permits it, a separately stored backup key.
Compatibility must be checked before purchase. Confirm all four items:
- Whether the account is personal or managed by a work or school administrator.
- Whether the account policy permits security-key or passkey sign-in.
- Whether your browser and operating system support the required WebAuthn/FIDO2 flow.
- Whether you have another recovery method for loss, theft or damage.
A key does not repair an already compromised account by itself. First change the password, remove unauthorized methods and confirm that the account is clean; then enroll the key from the account’s security settings.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Prevent false alerts without ignoring real attacks
- Expect a verification challenge after travel, a new device, a browser reset or an app reinstall.
- Keep your operating system, browser and Microsoft applications updated so their sign-in components are supported.
- Use one unique password for the Microsoft account and never paste it into an email reply or an unsolicited support form.
- Maintain current recovery email and phone details, and test that you can reach them before a crisis.
- Keep a record of the devices and apps you intentionally authorize. This makes an unfamiliar entry easier to identify.
- Review Recent activity periodically rather than waiting for an alert. The page covers 30 days, so investigate important events while they remain visible.
Troubleshooting common situations
The location is wrong but the device is familiar
Check the IP, browser and operating system. If those match your phone or computer and the time fits, a mobile-carrier or corporate-network route may explain the location. Mark the event as yours only when the whole context agrees.
The device is unfamiliar but the city is familiar
Treat this as suspicious. A nearby attacker can use a stolen password, and a familiar city does not authenticate the device. Use This wasn’t me, secure the account and audit security information.
You clicked the email and entered credentials on a page that now seems suspicious
Close that page, open a new tab and type account.microsoft.com yourself. Change the password from the genuine Security page, review Recent activity and remove unauthorized recovery or app entries. If the password has already been changed, begin account recovery.
Free tools Windows power users keep installed
One-click scans. No signup required.
You cannot access the work or school My Sign-ins portal
Use your organization’s approved support channel. Administrators control policy, enrollment and some recovery actions; a personal-account reset page cannot override those controls.
You keep receiving alerts after changing the password
Review every new event, not just the original notification. Check for an old mail client, phone, app password or connected application that still holds a session. Remove unrecognized permissions and app passwords, then re-enroll only the devices and methods you trust. Persistent unauthorized events should be escalated to your organization’s administrator for a work or school account.
When to seek additional help
Use Microsoft’s account-recovery process when you cannot sign in, when recovery contacts were changed, or when the password-reset flow does not recognize your information. For a managed account, contact the administrator after documenting the event time, device, application and IP details. Microsoft states that reporting activity you are sure was not yours lets its support process help secure the account.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
