Windows Security · Accounts & Sign-In Security · Lesson 1 of 5

Securing Your Microsoft Account

Check who signed in, lock out intruders and set up strong backup sign-ins.

Reading your sign-in activity

Your Microsoft account is the email and password you use for Windows, Outlook, OneDrive and Xbox. If someone gets in, they may reach your email and files. They may even find your BitLocker recovery key. So it is worth checking now and then.

Go to account.microsoft.com and sign in. Open Security, then look for your sign-in activity. This is a list of recent times your account was used.

Each entry shows a time, a rough location, the device and the browser. It also says whether the sign-in worked.

• Successful means someone got in. If it wasn't you, act now.
• Unsuccessful means someone tried and failed. A few of these are common, because attackers try stolen passwords on many accounts.

The location is only a guess based on the network. A VPN is a service that hides where you really are. It can make your own sign-in look like it came from far away. Some phone networks do this too. So first ask yourself: was I traveling, or using a VPN that day?

If a successful sign-in really isn't yours, work through these steps in order:

1. Change your password to a new, long one you have never used anywhere.
2. Choose Sign out everywhere, in Advanced security options. It signs your account out of browsers and apps, except Xbox consoles. It can take up to 24 hours.
3. Turn on two-step verification, so a password alone is never enough.
4. Check your recovery info, in case the intruder added their own email or phone.

The order matters. Signing out everywhere won't help much if the intruder still knows the password. They would simply sign back in.

On the practice computer, find the sign-in from another country. Then change the password, sign out of all devices, turn on two-step verification and add a passkey.

Two-step, Authenticator and recovery info

In Passwords & Sign-ins you met two-step verification, a second proof after your password. Here is how to set it up well on a Microsoft account.

Go to account.microsoft.com, open Security, and choose Manage how I sign in. Under Additional security, turn on two-step verification and follow the steps.

For the second proof, the best choice is an authenticator app. This is a phone app that approves sign-ins or shows short codes. Microsoft Authenticator is Microsoft's free one. You link it by scanning a QR code, a square barcode shown on the screen.

When you sign in, the app asks you to approve. It may show a number to match the one on your screen. Only approve a sign-in you started yourself, just now. A surprise request means someone typed your password somewhere. Deny it, then change your password.

Text message codes still work for now. But Microsoft says it is phasing them out for personal accounts. An app on your phone is harder to steal than a phone number.

Recovery info is your backup email and phone number. Microsoft uses it to prove it's you if you get locked out. Microsoft recommends having three pieces of it. Check yours now and then:

• Remove any email or phone you don't recognize. An intruder may add their own, so they can get back in later.
• Replace an old number you no longer have.

If Microsoft gives you a recovery code, write it on paper. Keep it somewhere safe at home, not in your email.