How to Investigate an Unauthorized Microsoft 365 Charge

To investigate an unauthorized Microsoft 365 charge, use the correct account, product, permissions, and destination. This guide explains the supported workflow and the checks that confirm the result.

Identify the Correct Billing Account and Purchase Channel

Confirm the owning account, required permissions, affected files or services, and the exact outcome you need. Keep a backup when the task changes local content or removes access.

Quick Billing Investigation

First, check why the charge occurred. Next, go to the Manage your payments page of the Microsoft account dashboard and select Investigate for the GHS 1,745.68 charge, and verify the final state before changing any backup or secondary account.

How to Investigate an Unauthorized Microsoft 365 Charge

1. Check why the charge occurred
2. Go to the Manage your payments page of the Microsoft account dashboard and select Investigate for the GHS 1,745.68 charge
3. Verify the correct Microsoft account
4. Sign in to each Microsoft account that may be associated with the card (for example, both Outlook and Gmail-based accounts) and check Services & subscriptions / Subscriptions to see which one has an active Microsoft 365 subscription
5. Check the subscription end date in the Subscriptions page
6. Use the self-help tool for Microsoft 365 refunds (linked in the refund article) to submit the refund request

After the final step, reopen the affected app, portal, file, or account page and confirm the exact status or behavior described in the title.

WPS Office: A Free, AI-Powered Microsoft Office Alternative

WPS Office cannot directly change Microsoft-side account, billing, subscription, activation, tenant, OneDrive service, or SharePoint permission state. Those changes must be completed in the appropriate Microsoft portal.

WPS Office offers a free, familiar workspace for common Word, Excel, PowerPoint, and PDF formats through Writer, Spreadsheets, Presentation, and PDF. Integrated WPS AI adds practical help for drafting and summarizing documents, building formulas and understanding data, creating editable slide decks, and extracting information from PDFs. Some AI features or higher usage limits may depend on the plan, platform, region, and app version.

Test advanced macros, add-ins, external connections, sensitivity controls, and Microsoft-only cloud integrations on a copy before moving a critical workflow.

Use Word, Excel, and PPT for FREE

Free Download

Practical Checks That Prevent a Repeat

• Record which account and payment method owns the workflow
• Keep a verified backup before removing access, changing ownership, or replacing a local file
• Apply high-impact changes to one test item or user before expanding the scope
• Save confirmation numbers, dates, and screenshots of the final settings when they affect billing, security, or permissions

Frequently Asked Questions

What should I verify before I check why the charge occurred?

Check why the charge occurred. Personal purchases normally appear in Microsoft account Order history; business purchases appear in the Microsoft 365 admin center under Billing and invoices.

Why is it important to go to the Manage your payments page of the Microsoft account dashboard?

The purchase may use another email address, an Apple or Google store, a reseller, or a work tenant. Match the receipt, payment descriptor, amount, and date before disputing it. Confirm the account type, product version, ownership, and permissions before assuming the control is unavailable.

Can I safely test the step to verify the correct Microsoft account on a limited scope?

Keep the order or invoice number, charge date, amount, last four card digits, purchasing account, and any existing case ID. Never post the full card number publicly. Keep the relevant backup or confirmation until you have checked the result.

What final check proves I was able to investigate an unauthorized Microsoft 365 charge?

Use the self-help tool for Microsoft 365 refunds (linked in the refund article) to submit the refund request. Reopen the affected app or portal and confirm that the expected status persists.