How to Secure Your Microsoft Email Account After Unknown Sign-Ins
Question details
The user needs to secure their Microsoft email account after noticing repeated sign-in attempts from an unfamiliar IP address.

- Product
- Microsoft Email Account
- Device & OS
- not provided
- Scenario
- An unknown IP address is repeatedly showing up in the account's recent activity log, despite having two-factor authentication (2FA) enabled.
- Observed behavior
- Unauthorized access attempts or suspicious sign-in activities are continually logged in the account's security history.
Ensure you can still log into your Microsoft account. Never share personal information, such as IP addresses, passwords, or recovery emails, on public forums.
Review Account Activity and Force Sign-Out
Review your recent account activity to identify unauthorized access and force a sign-out on all devices to immediately halt the intrusion.
By marking unfamiliar sign-ins as unauthorized and forcing a global sign-out, you instantly cut off the attacker's active sessions.
Navigate to https://account.microsoft.com/security and sign in. Check the activity log for any unfamiliar IP addresses or locations, and mark those unrecognized sign-ins as 'It wasn't me'.
From the same security dashboard, select 'Advanced security options' and click on the option to sign out of all devices. This will terminate any active sessions the attacker might have.
Immediately update your account password to a strong, unique combination of letters, numbers, and symbols to prevent the unauthorized user from logging back in.

Update Recovery Information and Connected Apps
Verify your recovery methods and revoke access to unknown third-party apps to prevent backdoor entries into your account.
Try WPS Office for a Secure and Lightweight Document Experience
While resolving your Microsoft account security issues, consider using WPS Office as a free, lightweight, and highly compatible alternative to Microsoft Office. It offers a familiar interface and robust document management without relying on costly subscriptions.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the software: Run the downloaded installer and follow the on-screen instructions to set up WPS Office on your computer.
- 3. Open existing documents: Launch WPS Office and directly open your existing Microsoft Office files (.docx, .xlsx, .pptx) with full formatting retention.

Frequently Asked Questions
Why are there still unauthorized sign-in attempts if I have 2FA enabled?
Two-factor authentication (2FA) prevents an attacker from successfully logging into your account, but it cannot stop them from trying if they know your email address. These unsuccessful attempts will continue to appear in your activity log as blocked or failed.
How long does it take to sign out of all devices in a Microsoft account?
When you use the 'Sign out everywhere' feature, it can take up to 24 hours for Microsoft to completely terminate your active sessions across all web browsers, applications, and connected services.
What should I do if an attacker changed my recovery email?
If you still have access to your account, go to the Advanced Security Options page immediately and replace the unrecognized recovery email with your own. If you have lost access, you will need to fill out the Microsoft Account Recovery form to verify your identity and reclaim the account.




