Account Security Problems

How to Recover a Compromised Microsoft Account and Remove Unknown MFA Devices

WPS Content Manager Sep 25, 2026 869 views

Question details

The user needs to regain control of a compromised Microsoft account, remove unrecognized MFA devices, and stop unauthorized spam emails.

How to Recover a Compromised Microsoft Account and Remove Unknown MFA Devices

Product: Microsoft Account
Device & OS: not provided
Scenario: The account is sending unauthorized messages, and an unfamiliar device is listed in the MFA settings.
Observed behavior: Unauthorized spam messages are being sent to multiple recipients, and an unknown iPhone is registered as an MFA device.

Before you start

Ensure you have access to a secure, malware-free device before attempting to change your passwords or security settings to prevent attackers from intercepting your new credentials.

Solution 1Recommended

Change Password and Revoke Unknown MFA Devices

The immediate first step to secure a compromised account is resetting the password and kicking out unauthorized devices.

If an attacker has gained access to your account, they may have added their own device for Multi-Factor Authentication (MFA) to maintain access. Resetting the password and clearing out these devices will immediately sever their connection.

Change your password

Log in to your Microsoft account security page and navigate to the 'Password security' section to create a strong, unique password.

Remove unknown devices

Go to the 'Advanced security options' or 'Devices' tab. Locate the unfamiliar iPhone or any other unrecognized devices and select 'Remove' or 'Sign out'.

Review sign-in activity

Check the 'Recent activity' page to identify any unfamiliar locations or IP addresses that accessed your account, confirming the scope of the breach.

Change Password and Revoke Unknown MFA Devices

Work or School Accounts: If this is a work or school account, you must contact your IT administrator immediately. They have the administrative tools to centrally revoke all active sessions and reset your MFA settings.

Solution 2

Scan Devices for Malware and Notify Contacts

After securing the account online, ensure your local devices are clean and warn recipients about the unauthorized spam.

Free Microsoft Office alternative

Experience a Secure and Lightweight Alternative with WPS Office

While resolving your Microsoft account security issues, consider using WPS Office as a secure, free, and lightweight alternative for your document workflows. It offers seamless compatibility with all major Microsoft Office file formats without forcing you to rely on a single cloud ecosystem.

1. Download and install: Visit the official WPS Office website to download the free suite for your Windows, Mac, or mobile device.
2. Open existing files: Launch WPS Office and directly open your existing Microsoft Office documents without any formatting loss.
3. Secure your documents: Edit your documents and utilize the built-in encryption features under the 'Protect' tab to lock your files securely.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Provides built-in document encryption and local password protection to keep your sensitive files secure from unauthorized access.Lightweight installation with a familiar, easy-to-use tabbed interface for seamless migration.Free to use for everyday document creation and editing.

microsoft office alternative - wps office

Frequently Asked Questions

How do I know if my Microsoft account has been compromised?

Signs of compromise include unrecognized emails sent from your outbox, unfamiliar devices (like an unknown iPhone) registered in your MFA settings, unexpected password reset emails, or logins from unusual locations on your recent activity page.

What should I do if I cannot log in to my compromised account?

If the attacker changed your password, use the 'Forgot password' link on the Microsoft login page. Follow the prompts to verify your identity using your backup email or phone number to regain access.

Can a stolen session bypass MFA?

Yes, if your computer is infected with malware, attackers can steal active session tokens. This allows them to access your account without needing your password or triggering a new MFA prompt, making local antivirus scans a crucial recovery step.

How do I contact my IT administrator for a school or work account issue?

Reach out to your organization's IT helpdesk or system administrator via phone or an alternative secure communication channel. They can use the admin center to instantly revoke all active sign-in sessions and reset your authentication methods safely.

Microsoft Office Security Issues