Microsoft "unusual sign-in activity" email: how to tell if it's real

The subject line is "Microsoft account unusual sign-in activity", the country is somewhere you've never been, and there's a button to secure your account. Microsoft really does send this email, which is why it's one of the most copied lures in phishing. This guide shows how to check any sign-in alert in under a minute, what a fake looks like, what to do if you clicked, and what Microsoft 365 admins should do next.

Is the Microsoft "unusual sign-in activity" email real?

The Microsoft "unusual sign-in activity" email can be real or fake, and you check it the same way either way: don't use the email, open your account yourself. Microsoft says that when it notices a sign-in from a new location or device, you "might get an email or text message" about it (Microsoft Support). A fake copies that email to send you to a page that captures your password.

Microsoft also tells you where real ones come from. Its support page says the email is "from the Microsoft account team at account-security-noreply@accountprotection.microsoft.com." Its Recent activity help page adds that if you're not sure an email is really from Microsoft, you can sign in to your account directly without clicking any links in the email.

Two things are worth knowing first:

• This is a personal-account alert. Microsoft's help page on it applies to personal Microsoft accounts, such as Outlook.com, Hotmail and Xbox. Work and school accounts in Microsoft 365 are run by your organization (see the admin section below).
• The sender address helps, but it isn't the final test. Display names are easy to fake (display name spoofing) and lookalike domains fool a quick glance. The Recent activity page is the test.

Example of a fake unusual sign-in activity email

This is an example written for this guide. It is not a real Microsoft email.

From: Microsoft account team <no-reply@account-protection-ms.com>
Subject: Microsoft account unusual sign-in activity

We detected something unusual about a recent sign-in to the
Microsoft account j*****@outlook.com.

Sign-in details
Country/region: Russia/Moscow
IP address: 103.225.77.255
Date: 11/02/2026 4:17 AM (GMT)
Platform: Windows
Browser: Firefox

If this wasn't you, please report the user.

[ Report the user ]

If you don't verify within 24 hours, your account will be
suspended.

The giveaways here are a sender domain that isn't accountprotection.microsoft.com, a deadline with a threat, and a button. Switzerland's National Cyber Security Centre described a version whose "Report The User" link opened a reply email to addresses the attackers had set up, rather than a web page, so the scam continued by email (NCSC, May 2022).

How do I check if a Microsoft sign-in alert is real?

To check a Microsoft sign-in alert, open your account yourself and compare the alert with your Recent activity page. If the sign-in isn't listed, the alert is fake. Microsoft's steps (Microsoft Support):

1. Type the address yourself. Go to account.microsoft.com/security in your browser. Don't use a link from the email.
2. Select Review activity. This opens the Recent activity page (also reachable at account.live.com/Activity). Microsoft says it shows when and where you've used your account in the last 30 days (Microsoft Support).
3. Look for an Unusual activity section. If you only see Recent activity, Microsoft says no action is needed. Only the Unusual activity section offers This was me and This wasn't me.
4. Compare details. A real alert should match an entry with a similar time, location and device. No matching entry means the email is fake.
5. Act inside your account, not the email. If an unusual entry wasn't you, expand it and select This wasn't me. Microsoft then asks you to change your password and update your security info.
6. Report the fake and delete it. See how to report it below.

Real vs fake Microsoft sign-in alerts

Microsoft also says its support agents can't send password reset links (Microsoft Support). An email or caller offering one is a scam.

Check the headers if you want proof

If you want to see where a message really came from, open its headers and paste them into the Email Header Analyzer. Look at the From domain and the Authentication-Results line for SPF, DKIM and DMARC. Our guide to checking whether an email passed SPF, DKIM and DMARC explains what a pass does and doesn't prove.

Why do I get unusual sign-in emails when nothing happened?

You get unusual sign-in emails when nothing happened for one of two reasons: the email is fake, or Microsoft flagged something you did. Microsoft says it may mark activity as unusual when you use your account while traveling, get a new device, or allow an app to sign in as you (Microsoft Support).

Fakes are sent in bulk to any address the sender has, so you may get them for an address you rarely use, or for a work address that isn't a personal Microsoft account at all. Unless you also use your work address to sign in to a personal Microsoft account, a "Microsoft account" alert sent to it is suspicious. Check with IT.

What should I do if I clicked the link or entered my password?

If you entered your password on a page from a fake Microsoft alert, change it now from a trusted device and tell IT if it's a work account. Speed matters, because attackers often use stolen passwords within minutes.

Do this now:

1. Change your Microsoft password at account.microsoft.com/security, typed by hand. Use a new password you don't use anywhere else.
2. Change the same password on any other site where you reused it.
3. Check your security info. Make sure the recovery email and phone number on the account are yours, and remove anything you don't recognize.
4. Review Recent activity and select This wasn't me on any sign-in you didn't make.
5. Turn on two-step verification or a passkey. If you travel often, Microsoft recommends signing in with Microsoft Authenticator to avoid unusual-activity alerts (Microsoft Support).
6. For a work account, call IT straight away and say whether you also entered a code or approved a sign-in prompt.

A fake page can collect your one-time code and use it in real time. This is called adversary-in-the-middle phishing; our guide to AiTM phishing and MFA bypass explains why passkeys resist it. For the wider checklist, see what to do after clicking a phishing link and the signs an email account is compromised.

How do I report a fake Microsoft security alert?

To report a fake Microsoft security alert, use the Report button in Outlook, then delete the message. Microsoft lists these options (Microsoft Learn):

• Outlook.com: select the message, select the arrow next to Junk, then Phishing.
• Outlook desktop: in the message, select Report message on the ribbon, then Phishing. In supported versions of Outlook, including the new Outlook for Windows and Outlook on the web, the built-in Report button offers Report phishing (Microsoft Learn).
• Microsoft 365 admins: submit samples on the Submissions page in the Microsoft Defender portal.

You can also forward phishing to the Anti-Phishing Working Group at reportphishing@apwg.org, which the FTC recommends (FTC). Our guide to reporting phishing emails covers Gmail and other apps.

What should a Microsoft 365 admin do about fake sign-in alerts?

A Microsoft 365 admin should treat a fake sign-in alert as a phishing campaign: block the sender, find and remove every copy, and secure any account whose user clicked. Microsoft 365 work accounts don't use the personal Recent activity page. They're governed by Microsoft Entra ID, which logs every sign-in and, with ID Protection, emails risk alerts to admin roles.

1. Check whether the "unusual" sign-in really happened

In the Microsoft Entra admin center, sign in as at least a Reports Reader and go to Entra ID > Monitoring & health > Sign-in logs (Microsoft Learn). Filter by the user and look for sign-ins from the location in the email. Microsoft notes sign-in log entries are system generated and can't be changed or deleted.

If you have Entra ID P2, ID Protection sends a Users at risk detected email to users in the Global Administrator, Security Administrator and Security Reader roles. The trigger defaults to High user risk, and you change it under ID Protection > Dashboard > Users at risk detected alerts (Microsoft Learn). A real alert to admins is the signal to act; a "Microsoft account" email to a user is not.

2. Block the sender

In the Microsoft Defender portal, open https://security.microsoft.com/tenantAllowBlockList, select the Domains & addresses tab, then Add > Block. Block entries default to 30 days; you can pick 1 day, 7 days, Never expire or a date up to 90 days ahead. Microsoft says email from blocked senders "is marked as high confidence phishing and quarantined" (Microsoft Learn). In Exchange Online PowerShell:

New-TenantAllowBlockListItems -ListType Sender -Block -Entries "account-protection-ms.com" -NoExpiration

A block on example.com doesn't cover its subdomains; add *.example.com as a second entry if you need both. Our guide to blocking a sender or domain in Microsoft 365 compares the options.

3. Find and remove every copy

Search for the subject and sender in Real-time detections (Defender for Office 365 Plan 1) or Threat Explorer (Plan 2), which can also delete or move the messages. Our guide to Threat Explorer and Real-time detections walks through it, and message trace shows who received it on any plan. For every removal method, see how to remove a phishing email from all mailboxes.

4. Secure anyone who entered a password

The full sequence is in our Microsoft 365 compromised account remediation guide. In short:

1. Revoke sessions. In the Entra admin center, go to Entra ID > Users > All users, select the user and choose Revoke sessions; in PowerShell, Revoke-MgUserSignInSession does the same (Microsoft Learn). Microsoft notes access tokens can stay valid for up to an hour.
2. Reset the password and remove any MFA method the user didn't add.
3. Check inbox rules and forwarding, a common next step for attackers. See malicious inbox rules and auto-forwarding.
4. Move admins and high-risk users to phishing-resistant MFA, such as passkeys or security keys. Our guide to fake Microsoft login pages covers the Conditional Access settings.

How can a business stop fake Microsoft alerts reaching inboxes?

The most effective defenses are layered: filtering that catches the lure, users who check alerts in their account rather than the email, and MFA that a fake page can't replay. Turn on the Report button for every user (see user-reported message settings) so reports reach your security team as well as Microsoft.

Some lures still arrive from brand-new lookalike domains. An MX-level filter in front of Microsoft 365 checks inbound mail for spam, phishing and spoofing before it reaches Exchange Online and holds suspect messages in a quarantine each user can review; how iBlockSpam works with Microsoft 365 explains the setup.

Next steps

1. Teach one rule: never act on a Microsoft security email; open account.microsoft.com/security (personal) or ask IT (work) instead.
2. Make sure someone receives and reads Entra ID Protection's Users at risk detected emails, if you're licensed for them.
3. Add a Tenant Allow/Block List entry for any lure domain you see, and remove copies from every mailbox.
4. Paste a suspect message into the free Microsoft 365 Spam Header Decoder to see why it was delivered, and if lures keep getting through, see iBlockSpam for Microsoft 365.

Browse our other phishing and threat guides.