Someone signed into my account from another location. What do I do?
First check whether it really wasn't you, because locations are rough guesses and a VPN or phone network can place you far away. If the sign-in was successful and not yours, change your password right away, sign out of all other devices, then turn on two-step verification.
Most accounts list recent activity with a time, rough location and device. A sign-in marked unsuccessful means someone tried and failed, which is common because criminals test stolen passwords on many accounts. A successful one you don't recognize means someone got in. For a Microsoft account, this list is under Security at account.microsoft.com.
Order matters. Signing out everywhere won't help if the intruder still knows the password, because they'd just sign back in. So change the password first, to a new one you've never used anywhere. Then check your recovery email and phone, since intruders often add their own so they can return later. Secure your email first if several accounts are affected.
- Check the sign-in activity page and note anything marked successful
- Change your password to a new, unique one
- Choose sign out of all devices or end each unknown session
- Turn on two-step verification
- Remove any recovery email, phone or connected app you don't recognize
How secure is your computer overall? Take the 2-minute checkup →
Securing Your Microsoft Account
From the Accounts & Sign-In Security course. Check who signed in, lock out intruders and set up strong backup sign-ins.