Suspicious Login Issues

How to Fix Microsoft Account Unusual Activity Alerts from Microsoft IP Addresses

Jason Miller Oct 22, 2026 868 views

Question details

Users are receiving repeated unusual-activity notifications showing IMAP synchronization originating from Microsoft-owned IP addresses, causing concern over account security.

How to Fix Microsoft Account Unusual Activity Alerts from Microsoft IP Addresses

Product: Microsoft Account
Device & OS: not provided
Scenario: Reviewing account security after receiving suspicious login alerts indicating activity from Microsoft IP addresses.
Observed behavior: The Microsoft account receives unusual activity alerts triggered by Microsoft's own IP addresses, which is often a false alarm caused by a configuration issue on Microsoft's end.

Before you start

Before proceeding, manually navigate to the official Microsoft website in your browser rather than clicking links in the alert email to protect yourself from potential phishing attempts.

Solution 1Recommended

Review Recent Activity and Secure Your Account

Check your account's recent activity log to verify the login attempt, dismiss false alarms, and secure your account if the activity was genuinely unauthorized.

Even though Microsoft has acknowledged that internal configuration issues can cause these false unusual-activity notifications, it is always best practice to manually verify your account security status. Taking a few minutes to review your sign-in logs ensures your data remains protected.

Sign in to Microsoft Security

Navigate to the official Microsoft account Security page and log in using your email and current password.

Review account activity

Click on 'Review activity' to open the Recent activity page. This page displays all successful and attempted sign-ins along with their origin IP addresses.

Flag unauthorized access

Locate the suspicious IMAP sync activity. If the activity was not initiated by you, click the 'This wasn't me' or 'Secure your account' option.

Change your password

If you suspect your account has been compromised, proceed to change your password immediately. Choose a strong, unique password that you do not use on any other service.

Review Recent Activity and Secure Your Account

Known Microsoft Glitch: Microsoft support has previously confirmed a configuration issue causing customers to receive unusual-activity notifications in error when IMAP syncs run from Microsoft-owned IP addresses. If the IP belongs to Microsoft, it is likely part of this known issue.

Free Microsoft Office alternative

Switch to WPS Office for a Hassle-Free Experience

Tired of dealing with complex Microsoft account configurations, mandatory cloud logins, and false security alerts? WPS Office provides a free, lightweight, and highly compatible alternative that lets you work locally or securely in the cloud on your own terms.

1. Download the installer: Visit the official WPS website and download the free WPS Office installation package.
2. Install WPS Office: Run the downloaded file and follow the simple on-screen instructions to complete the setup.
3. Open existing files: Launch WPS Office and seamlessly open your Microsoft Office files without losing any formatting.

Fully compatible with Microsoft Office formats including Word, Excel, and PowerPoint files.Lightweight design ensures fast installation and smooth performance on any device.Edit documents locally without requiring a mandatory account login, avoiding constant security prompts.Rich built-in PDF editing and document management tools available for free.

microsoft office alternative - wps office

Frequently Asked Questions

Why is an unusual activity alert coming from a Microsoft IP address?

This can happen due to internal system configurations or background syncs (like Outlook IMAP synchronization) mistakenly triggering the security alert system. Microsoft has acknowledged this as an occasional false alarm.

How do I know if an email alert from Microsoft is genuine?

Legitimate Microsoft security emails always come from 'account-security-noreply@accountprotection.microsoft.com'. Always verify the sender's email address and avoid clicking links directly in suspicious emails; instead, navigate to your account manually.

What should I do if my Microsoft account is actually compromised?

Immediately log in to your Microsoft account, change your password, enable two-step verification (2FA), and review your account recovery settings (like backup email and phone number) to ensure the unauthorized user cannot regain access.

Microsoft Office Security Issues