Independent guide - not affiliated with or endorsed by Microsoft. We never ask for your password, codes or account details. For official help use Microsoft's account recovery form or support.microsoft.com.

Microsoft Security Info Change Is Still Pending: The 30-Day Wait Explained

Published October 21, 2026. Updated October 21, 2026.

You try to change your password or open a settings page and Microsoft answers with "Your security info change is still pending" or "You can't access this site right now". It feels like being locked out of your own account, but it is a deliberate safety delay with clear rules. This independent guide explains why the message appears, exactly what still works during the wait, how to cancel the change if you made it, and what to do if you did not. Everything here is checked against Microsoft's support pages, linked at the end. We never ask for your password or security codes.

Why Microsoft shows this message

"Security info" is Microsoft's term for the alternate contact methods on your account, such as a second email address, a phone number or an authenticator app, that it uses to send you verification codes. Microsoft explains that the pending message appears because all of the security info previously on the account was removed and replaced with new info, and that you need to wait 30 days for the change to take effect.

The reason is protection. If an attacker gets your password, one of the first things they try is swapping your phone number and email for their own so that every future code goes to them. A 30-day restriction gives the real owner time to notice. Microsoft says it sends notifications during those 30 days to the original security info, so if the change was not yours, those alerts are your warning.

Note that the restriction is triggered by removing everything. Microsoft's guidance on removing verification methods says you do not need to remove old security info unless there is a security risk, such as someone else having access to your old mailbox, and that if you replace it you should add the new information first.

What still works during the 30 days

Microsoft says the account stays open and active during the restriction. Its support page sets out the details:

Services: you can still access most Microsoft services, such as signing in to Xbox, Skype, Outlook.com and OneDrive. You cannot open your OneDrive vault.
Payments: you can view order history, make a purchase from the Microsoft Store, manage a subscription and update your billing or mailing address. You cannot change payment options such as credit card details.
Security-code tasks: you cannot update your password, access parental controls or update your account aliases.

One important exception: Microsoft states that if two-step verification was turned on, you will not have access to anything in that list, and your options are to wait the 30 days or cancel the request. If you are also trying to switch authenticator phones at the same time, our guide to Microsoft Authenticator on a new phone explains how to plan around it.

If you made the change: how to cancel it

Microsoft is clear that it cannot expedite the 30-day process unless you cancel the request. If you removed the security info yourself and want your account back to normal sooner:

Sign in to the Security page of your Microsoft account at account.microsoft.com/security.
On the Your security info change is still pending window, select the link cancel this request.
Follow the prompts. You need access to the old security proofs to complete the cancellation.

Cancelling restores the previous security info. You can then add your new phone or email properly, adding first and removing second, without starting a new 30-day restriction.

If you have lost access to all your old security info but still know your password, Microsoft's verification prompt offers an option to say you do not have any of the listed methods and to replace them. That route is what starts the 30-day wait, so it is normal to see the pending message afterwards. Microsoft adds that if you find your old security info during those 30 days, you can still use it to sign in, which cancels the update.

If you did not make the change

A pending change you did not request means someone else has, or had, your password. Act straight away:

Sign in to the Security page of your Microsoft account.
On the Your security info change is still pending window, select the let us know link near the bottom and follow the prompts.
Then work through our guide to recovering a hacked Microsoft account: scan your PC, change your password and review recent sign-in activity.

If you can no longer sign in at all because the attacker also changed the password, use the account recovery form at account.live.com/acsr. Our step-by-step recovery form guide explains how to give it the best chance.

How to avoid the pending state next time

Microsoft lists a few security habits that keep accounts out of this restricted state:

Use an authenticator app as one of your methods.
Avoid changing all of your security info at once.
Set reminders to review your security info regularly and check it is still valid.
Keep more than one security option on the account.
If a phone number is one of your options, make sure it is still valid and can receive text messages.

When you change phones or email providers, add the new method in Manage how I sign in on the Security page, confirm it with the code Microsoft sends, and only then remove the old one. Microsoft allows up to 10 different ways to verify sign-in, so there is no need to delete an old method before adding a new one. A stored recovery code is a useful extra safety net.

A note on scams

The 30-day wait cannot be shortened by anyone outside the cancel option, including Microsoft's own support agents, who Microsoft says are not allowed to send password reset links or to access and change account details. Ignore anyone who offers to "remove the pending status" for a fee or through remote access.

Frequently asked questions

What does "security info change is still pending" mean?

It means all of the security info on the account, such as alternate emails and phone numbers, was removed and replaced with new info. Microsoft puts the account into a restricted state for 30 days before the change takes effect.

Can Microsoft speed up the 30-day security info change?

No. Microsoft states it cannot expedite the 30-day process unless you cancel the request. Cancelling keeps your old security info, so you need access to it to complete the cancellation.

Can I still use my email and Xbox during the 30 days?

Yes. Microsoft says you can still access most services, such as Outlook.com, Xbox, Skype and OneDrive. What you cannot do is change your password, update payment details, access parental controls, update aliases or open your OneDrive vault.

What if I did not change my security info?

Sign in to the Security page of your Microsoft account and, on the "Your security info change is still pending" window, select the "let us know" link and follow the prompts. Then follow the steps for a compromised account.

How do I avoid the 30-day wait next time?

Do not remove all of your security info at once. Microsoft advises adding the new method first and only then removing the old one, and keeping more than one valid security option on the account.