Account Security Problems

How to Check if Microsoft 365 Files Were Accessed After a Blocked Sign-In

Maira Mehtab Sep 28, 2026 869 views

Question details

The user noticed recent access activity on their Microsoft 365 documents correlating with a blocked sign-in attempt on their account and wants to know if their files were compromised.

Product: Microsoft 365
Device & OS: not provided
Scenario: Checking document security after noticing suspicious account login activity.
Observed behavior: Files show a recent 'accessed' timestamp around the same time the account security log recorded a blocked sign-in attempt.

Before you start

Before reviewing your account logs, ensure you are using a secure, trusted device and have immediate access to your secondary email or recovery phone number.

Solution 1Recommended

Review Account Activity and Understand Blocked Sign-Ins

A blocked sign-in typically means the attempt was unsuccessful, preventing unauthorized file access. However, further verification of account activity is recommended.

A blocked sign-in usually indicates that an unauthorized user failed to enter the correct password or was stopped by your two-step verification (2FA). Therefore, a blocked sign-in alone does not result in successful file access. The file-access timestamp you see could be a delayed sync from one of your own trusted devices, an automated background process, or third-party app integration.

Since a file timestamp alone cannot definitively identify who accessed the document, you must check your account's detailed sign-in logs to confirm no unauthorized successful logins occurred around the same time.

Check Recent Activity

Go to the Microsoft Account Security page, sign in, and navigate to the 'Sign-in activity' section to review all recent successful and blocked login attempts.

Review Connected Devices

Navigate to the 'Devices' section of your Microsoft account dashboard to ensure no unfamiliar devices are currently linked to your account.

Request Audit Logs via Support

If you still suspect a breach, contact Microsoft Support to request a backend audit log investigation, which can track the exact IP address and session that triggered the 'accessed' timestamp.

Audit Logs Limitation: Community support and standard user dashboards cannot directly inspect specific file-access records or IP addresses. Only official Microsoft Support can run an account-specific audit log.

Solution 2

Secure Your Account and Revoke Unfamiliar Access

Take immediate steps to change credentials and sign out of unauthorized devices to prevent any future unauthorized file access.

Free Microsoft Office alternative

Switch to WPS Office for a Secure, Local Document Experience

If you are concerned about cloud account security breaches and prefer managing your documents locally without sacrificing features, WPS Office provides a lightweight, highly compatible, and free suite for your daily document needs.

1. Download and Install: Visit the official WPS Office website and download the free installation package for your operating system.
2. Open Your Documents Locally: Launch WPS Office and open your existing Microsoft Office files directly from your local hard drive.
3. Encrypt Sensitive Files: Go to 'Menu' > 'Document Encryption' > 'Encryption' to set a local password, ensuring your files cannot be accessed without authorization.

Fully compatible with Microsoft Office formats (Word, Excel, PowerPoint).Store and manage documents locally on your hard drive to minimize cloud-based security risks.Free to download with a familiar user interface for seamless migration.Built-in document encryption and password protection features for sensitive files.

microsoft office alternative - wps office

Frequently Asked Questions

Does a blocked sign-in mean someone accessed my Microsoft 365 files?

No. A blocked sign-in generally means the security system successfully prevented unauthorized access. The 'accessed' timestamp on your files may be caused by a background sync from your own connected devices rather than a malicious actor.

How can I find out who triggered the accessed timestamp on my documents?

A standard file timestamp only shows when the file was opened or synced, not who opened it. To trace the exact IP address or user session, you will need to contact Microsoft Support to request a detailed audit log investigation for your account.

Is two-step verification enough to protect my documents?

While two-step verification (2FA) is highly effective at stopping blocked sign-in attempts from becoming successful, you should also regularly review your connected devices and use strong, unique passwords to ensure comprehensive security.

Can delayed cloud syncing change the 'accessed' date on my files?

Yes. If you edited a file offline or a background service synced your OneDrive/SharePoint files, the 'last accessed' date might update later. This can make it look like recent activity occurred even if you were currently signed out.

Microsoft Office Security Issues