Suspicious Login Issues

Fix Office 365 Account Risk and Sign-In Errors

Steven Parker Oct 16, 2026 869 views

Question details

An Office 365 user is unable to sign in or use self-service password recovery due to the account being flagged as a risk.

How to Fix Office 365 Account Risk and Sign-In Errors

Product: Microsoft Office 365 / Azure AD
Device & OS: not provided
Scenario: A user attempts to log into their Office 365 account or reset their password after a suspicious login attempt from another country.
Observed behavior: Azure AD Identity Protection flags the account as risky, completely blocking the sign-in process and preventing self-service password recovery.

Before you start

Ensure you have Microsoft Entra ID (formerly Azure AD) Global Administrator or Security Administrator privileges, as standard users cannot clear their own risk flags once self-service recovery is blocked.

Solution 1Recommended

Review and Remediate User Risk in Azure AD

Use the Microsoft Entra admin center to manually review the risky sign-in, dismiss false positives, or reset the compromised user's password.

When Azure AD Identity Protection detects unfamiliar properties—such as anomalous travel or a login from an anonymous IP address—it automatically flags the account as risky to prevent unauthorized access.

To restore access, an administrator must evaluate the context of the sign-in and take explicit action to either dismiss the risk or secure the account.

Log in to the Admin Center

Navigate to the Microsoft Entra admin center and sign in using an account with Security Administrator or Global Administrator credentials.

Access Identity Protection

On the left-hand navigation menu, go to Protection and select Identity Protection.

Locate the Risky User

Click on 'Risky users' to view the list of flagged accounts. Search for the specific user experiencing the sign-in error.

Evaluate the Risk

Click on the user's name to view their risk history and recent sign-ins. Determine if the login from another country was legitimate (e.g., the user is traveling) or malicious.

Remediate or Dismiss

If the sign-in was legitimate, click 'Dismiss user risk' to unblock the account. If the account was actually compromised, click 'Confirm user compromised' and then perform a manual password reset.

Review and Remediate User Risk in Azure AD

Synchronization Delay: After dismissing a user risk or resetting the password, it may take a few minutes for the changes to propagate through Azure AD before the user can successfully sign in again.

Free Microsoft Office alternative

Switch to WPS Office for a Hassle-Free Offline Experience

Tired of getting locked out by complex Azure AD cloud security policies? WPS Office is a lightweight, highly compatible alternative to Microsoft Office that allows you to easily manage your documents locally without unexpected sign-in errors.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded file and follow the simple on-screen instructions to install the suite on your computer.
3. Open Your Files: Launch WPS Office and instantly open your existing Word, Excel, or PowerPoint files without needing complex cloud account sign-ins.

Fully compatible with Microsoft Office formats like .docx, .xlsx, and .pptx.Edit documents locally without depending on strict cloud authentication or internet access.Lightweight software that runs smoothly on older devices with a familiar user interface.Free to download and use for your everyday document processing needs.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Office 365 flag a sign-in as risky?

Office 365 uses Azure AD Identity Protection, which flags sign-ins as risky when it detects unfamiliar locations, anonymous IP addresses, malware-linked IP addresses, or atypical travel times between login locations.

Can an Office 365 user fix a risky sign-in error without an admin?

If self-service password reset (SSPR) is enabled and not blocked by the risk policy, a user might be able to recover their account via multi-factor authentication. However, if SSPR is blocked, only an administrator can clear the risk flag.

How long does it take to unblock an Office 365 user after dismissing the risk?

Once an administrator selects 'Dismiss user risk' in Azure AD, the block is typically lifted within a few minutes, allowing the user to sign in normally.

Microsoft Office Security Issues