Independent guide - not affiliated with or endorsed by Microsoft. We never ask for your password, codes or account details. For official help use Microsoft's account recovery form or support.microsoft.com.

Microsoft Unusual Sign-in Activity Email: How to Tell if It Is Real

Published October 21, 2026. Updated October 21, 2026.

An email with the subject "Microsoft account unusual sign-in activity" is designed to get your attention, and that is exactly why scammers copy it. Microsoft really does send these alerts, and so do phishing gangs who want your password. This independent guide shows how to tell the two apart, how to check what happened without clicking anything in the message, and what to do in each case. It is based on Microsoft's support pages, linked at the end. We never ask for your password or security codes.

Why Microsoft sends these emails

Microsoft explains that when it notices a sign-in attempt from a new location or device, it helps protect the account by sending an email message and an SMS alert, and that it may send a message to all of your alternate contact methods. Common innocent triggers include signing in while travelling, using a new phone or PC, or installing a new app that signs in with your account. Microsoft also notes that mobile networks can route activity through different locations, so a sign-in from your own phone may appear to come from another city.

The alert is informational. If the sign-in was blocked, the account itself may be temporarily locked until you confirm a security code; that situation is covered in our guide to a Microsoft account locked for suspicious activity. This page is about the email itself.

Check 1: the sender address

Microsoft names the address it uses: a legitimate unusual activity email comes from the Microsoft account team at account-security-noreply@accountprotection.microsoft.com. Its page on trusting account team email adds that messages from the @accountprotection.microsoft.com domain are safe to open, and that Microsoft uses this domain for account notifications such as two-step verification codes and password change notices.

When you check, look at the full address, not just the display name, which anyone can set to "Microsoft account team". The part after the @ must be exactly accountprotection.microsoft.com. Extra words, hyphens, misspellings or another domain added on the end are not Microsoft. Microsoft also suggests viewing the message headers if you want to be certain the email came from Microsoft.

Check 2: the account and the request

Microsoft's second check is to confirm that the account the email hints at belongs to you. Genuine alerts refer to your Microsoft account, often with part of the address masked. If the email names an account you do not have, or you received a security code you did not ask for, Microsoft says it could mean someone is trying to access your account, or that someone accidentally typed the wrong phone number or email while signing in.

Check 3: what the email asks you to do

Phishing copies give themselves away by what they want from you. Microsoft states that it does not send unsolicited email messages asking for personal or financial information, and that its error and warning messages never include a phone number. Treat any of these as a scam, whatever the sender line says:

A phone number to call, or a request to reply with your password or a code.
A demand to pay, buy gift cards or send cryptocurrency to "secure" the account.
A link to a sign-in page that is not on a microsoft.com or live.com address.
Pressure to act within minutes or lose the account.
An attachment you are told to open to "review the activity".

The safe way to check: go to your account directly

You never need the link in the email. Microsoft's own advice is that if you are not sure whether an unusual activity email is from Microsoft, you can safely sign in to your account any time without clicking links in the email. To do that:

Open a new browser tab and type account.microsoft.com yourself, or use account.microsoft.com/security.
Sign in and open the Security page, then select Review activity to reach the Recent activity page.
Look for an Unusual activity section. Microsoft explains that if you see only a Recent activity section, you do not need to confirm anything.
Expand any listed sign-in to see the date, time, location, device, browser or app, and IP address.

The Recent activity page covers the last 30 days and shows significant events rather than every sign-in. If there is nothing unusual on it, the email you received was most likely a phishing copy, and you can delete it.

If it was you: "This was me"

If you recognise the activity, for example a new laptop or a sign-in while on holiday, expand it and select This was me. Microsoft says this tells it the account does not need to be blocked. To reduce future alerts, Microsoft suggests selecting Keep me signed in when you sign in on your own devices, and recommends Microsoft Authenticator if you travel often. Our guide to Microsoft Authenticator on a new phone covers moving the app between devices.

If it was not you: secure the account

If you do not recognise a sign-in, or are simply unsure, select This wasn't me. Microsoft will ask you to change your password and update your security info. Then:

Check every phone number and email in your security info and remove any you do not recognise, adding your own first if needed.
Turn on two-step verification using our MFA setup guide.
If you can no longer sign in because the password has already been changed, follow our guide to recovering a hacked Microsoft account, which leads to the recovery form at account.live.com/acsr if needed.

Microsoft's support agents are not allowed to send password reset links or to access and change account details, so a person who phones you about the alert and offers to fix it is not from Microsoft.

If you clicked a phishing link

If you already entered your password on a page from a fake alert, go to account.microsoft.com directly and change your password straight away, then work through the hacked-account steps above. If you used the same password anywhere else, change it there too. If you also typed a security code into the fake page, check your security info and recent activity carefully, as that code may have been used to sign in.

Frequently asked questions

Is the Microsoft account unusual sign-in activity email legit?

It can be. Microsoft says it sends an email and a text alert when it notices a sign-in attempt from a new location or device. The genuine email comes from the Microsoft account team at account-security-noreply@accountprotection.microsoft.com. Copies from other addresses are not from Microsoft.

How do I check the alert without clicking the link?

Open a new browser tab, go to account.microsoft.com yourself, sign in and review the Recent activity page. Microsoft notes you can safely sign in to your account any time without clicking links in an email.

Why did I get an unusual sign-in activity email at my Gmail address?

Microsoft sends alerts to the contact methods on a Microsoft account, and any email address can be a username or security contact. Either your Gmail address is linked to a Microsoft account, or someone typed it by mistake, or the message is a phishing copy. Check the sender and review activity directly.

What should I do if the sign-in was not me?

On the Recent activity page, expand the sign-in in the Unusual activity section and select This wasn't me. Microsoft will ask you to change your password and update your security info. Then review your security info for anything you do not recognise.

Does Microsoft include a phone number in security alerts?

No. Microsoft states that its error and warning messages never include a phone number, and that it does not send unsolicited emails asking for personal or financial information. A security email that asks you to call is a scam.