Microsoft sign-in activity: decide whether an unfamiliar login needs action

An unfamiliar city in your Microsoft sign-in history deserves a closer look. The useful question is whether the event matches something you did—and whether Microsoft says the sign-in succeeded. Those two checks lead to different actions.

This guide covers a personal Microsoft account. A work or school account can have a different sign-in portal and an administrator who needs to investigate.

Start with the account page, not the alert link

Open your Microsoft account through a bookmark or a known address, then go to its security dashboard and recent activity. Keep a suspicious email separate from the investigation: its wording is evidence about the email, not proof of what happened to the account.

Expand the event and compare its time, device/browser details and result with your own activity. Microsoft displays important activity from the last 30 days; the page is not a complete event log. Location is an estimate, and mobile routing can make a legitimate sign-in appear somewhere unexpected. Microsoft explains the available event types in its recent activity guide.

Write down your ordinary explanation before deciding: “I signed into Outlook on my phone after lunch,” for example. Then ask whether the event is consistent with that explanation. A city mismatch alone is weak evidence. An unfamiliar browser, time and successful result together deserve more attention.

Use the result to choose the next step

An incorrect-password event means that attempt did not authenticate. It can be someone trying an address they know. Do not treat it as proof that the password worked. Equally, do not approve another event simply because several nearby attempts failed.

A successful sign-in you cannot explain is a different problem. Check whether another device, mail application or account owner could account for it. If it remains unfamiliar, use Microsoft's account-security flow promptly rather than waiting for the same city to appear again. The “This was me” and “This wasn't me” choices appear for eligible unusual-activity entries, not every row.

Suppose the history shows a failed attempt overnight and a successful entry during your commute. Investigate each separately. A plausible explanation for the commute does not explain the overnight attempt; the failed overnight attempt does not establish that the commute entry was hostile.

If access may be unauthorized

Use the account's security controls to secure it and review its security information. If your password is reused elsewhere, deal with those other accounts too. Keep recovery methods available while making changes; an investigation is a poor time to discover that the only recovery address is obsolete.

Microsoft also offers Sign out everywhere in advanced security options. Its documentation says the process can take up to 24 hours and excludes Xbox consoles, so do not interpret an immediate refresh as proof that every session has ended. Follow its sign-out instructions and exceptions.

Before closing the investigation, record which event concerned you, what you changed and which devices still legitimately need access. Revisit the page after those changes. Repeated unfamiliar successful entries are a reason to continue recovery, not to keep labeling them as yours.

If account cleanup also involves changing phones, plan the second factor separately. Our guide to moving authenticator codes to a new phone helps avoid losing the recovery path while removing unwanted access.