How to Fix Microsoft Authenticator Security Risks After an Outlook Compromise
Question details
The user needs to ensure complete account security because an unauthorized user who added the Outlook account to their Microsoft Authenticator app might still retain access despite password resets and signing out of devices.
- Product
- Microsoft Authenticator
- Device & OS
- Android
- Scenario
- Securing a compromised Outlook account where unauthorized access persists via the Microsoft Authenticator app.
- Observed behavior
- Changing the account password and using the sign out everywhere option does not automatically revoke access from unauthorized Microsoft Authenticator apps, allowing the attacker to read emails and modify security settings.
Ensure you have access to a secure, trusted device and can log in to any secondary recovery email accounts before making critical security changes.
Disable Passwordless Sign-in and Revoke Trusted Devices
Use this solution to force all devices, including unauthorized Authenticator apps, to require a new password and remove unverified sign-in methods.
When passwordless sign-in is active, changing your traditional password will not block attackers who have already registered their device. You must manually turn off passwordless authentication and remove their device from your security dashboard.
Sign in to your Microsoft Account on a web browser and navigate to the Additional security options page (account.live.com/proofs/manage/additional).
Under the 'Passwordless account' or 'Password-free account' section, select 'Turn off', click 'Next', and follow the prompts to add a traditional password back to your account.
Review the 'Ways to prove who you are' list. If you see an unfamiliar Microsoft Authenticator app or an unknown recovery email, click 'Remove' next to it.
Scroll down to the 'Sign me out' section and select the 'Sign me out' link. This action will forcibly disconnect all trusted devices, apps, and browsers.
Audit and Secure Your Recovery Email Accounts
Attackers often compromise secondary recovery accounts to regain access to your primary email. Securing them is a crucial secondary step.
Enhance Your Productivity with WPS Office
While resolving your Microsoft account security issues, consider using WPS Office for a lightweight, secure, and independent document editing experience. WPS Office provides a familiar interface without tying your local work to complex cloud security ecosystems.
Frequently Asked Questions
Why does Microsoft Authenticator still work after changing my Outlook password?
If passwordless sign-in is enabled on your Microsoft account, the Authenticator app acts as your primary credential. Changing your traditional password does not invalidate the trusted status of the app until you manually disable passwordless sign-in.
How do I completely sign out of all devices on my Microsoft account?
Go to your Microsoft Account's 'Additional security options' page, scroll to the bottom, and click 'Sign me out'. This process will revoke access from all trusted devices, apps, and browsers within 24 hours.
Can multiple devices use Microsoft Authenticator for the same account?
Yes, Microsoft allows an account to be added to multiple Authenticator apps simultaneously. It is critical to regularly check your Microsoft security dashboard and remove any unfamiliar Authenticator devices.
