One personal Microsoft account usually sits behind your Outlook.com or Hotmail email, your Windows PC sign-in, your Xbox profile, your OneDrive photos and any Microsoft 365 subscription, so losing it can mean losing all of them at once. This guide explains, in plain English, how sign-in to a personal Microsoft account works, which settings to switch on, how to keep a reliable way back in, and how to read the activity Microsoft records so you can spot a break-in early. It is written for individuals, families and very small businesses that run on personal accounts, and for the IT-minded friend or relative who helps them. Work and school accounts (Microsoft Entra ID) are managed by an organisation and are not covered here. Menu names below are taken from Microsoft's own help pages, checked on 8 November 2026, and may move slightly over time.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- Turn on two-step verification or go passwordless. With two-step verification on, Microsoft says your password alone is never enough to get in; going passwordless removes the password completely.
- Prefer passkeys and the Authenticator app over text codes. Microsoft has announced it will gradually stop using SMS for sign-in and recovery on personal accounts, so plan for app, passkey or security key methods now.
- Build your way back in before you need it. Microsoft strongly recommends three pieces of security info, and a 25-digit recovery code kept offline, because recovery without them can take up to 30 days or fail.
- Check Recent activity regularly. It shows 30 days of sign-ins with IP address, approximate location, device and browser, and lets you mark unusual events as "This wasn't me".
- Know what a real Microsoft alert looks like. Genuine security emails come from [email protected]; anything else asking you to sign in deserves suspicion.
How sign-in works for a personal Microsoft account
Every Microsoft consumer service checks the same account. Signing in to Outlook.com, OneDrive, Xbox, the Microsoft Store or a Windows PC set up with a Microsoft account all ask the same identity service, and all share the same security settings at account.microsoft.com/security. That has one big advantage: you only have to secure one place. It also has one big risk: one stolen password or one approved fake prompt can open everything.
There are three ways the account can be protected, from weakest to strongest:
| Mode | What you need to sign in | Main risk | Who it suits |
|---|---|---|---|
| Password only | Your password; Microsoft may still ask for a code if a sign-in looks unusual | Reused or phished passwords open the account | Nobody; treat this as the starting point to move away from |
| Two-step verification | Password plus a code or approval from your security info (email, phone or authenticator app) on untrusted devices | Lock-out if you lose your contact methods; text codes can be intercepted | Anyone who still needs a password, for example for older apps and devices |
| Passwordless account | No password at all: Authenticator app approval, Windows Hello, a security key, a passkey or a code | Losing the phone that approves sign-ins without having a second method set up | Most people with a modern phone and current Windows, Xbox One or Xbox Series X|S |
Passkeys
A passkey replaces the password with your device's own unlock: your face, fingerprint or PIN. Microsoft's help page explains that you add one by going to account.live.com/proofs/manage on the device you want to use, choosing Add a new way to sign in or verify and then the Face, Fingerprint, PIN, or Security Key option. You can save the passkey to Windows Hello, to a phone (by scanning a QR code), to a physical security key, or to a synced credential manager such as Microsoft Password Manager, Google Password Manager or iCloud Keychain. Passkeys are tied to Microsoft's real sign-in address, so a fake login page cannot use them. See the Passwordless and Passkeys Guide for how passkeys work underneath.
Going passwordless
Microsoft's steps are: install Microsoft Authenticator (or Outlook for Android) and add your account to it, sign in to the Additional security options page, find Passwordless account and choose Turn on, then approve the request on your phone. If two-step verification is already on, Microsoft says you need access to two recovery methods to do this. You can reverse it at any time from the same place with Turn off and set a new password.
Before you remove the password, check what still needs one. Microsoft lists Xbox 360, Office 2010 or earlier, Office for Mac 2011 or earlier, IMAP and POP email clients, Windows 8.1 and Windows 7 or earlier, and some Windows features such as Remote Desktop and Credential Manager. Xbox One and Xbox Series X|S support passwordless sign-in; Xbox 360 does not.
Who controls the account: family members and devices
A personal account has no administrators in the business sense, but several things carry "admin-like" power over it, and each one should be reviewed:
- Your security info: every email address, phone number and authenticator app listed under Manage how I sign in can receive codes or approve sign-ins and password resets. Anyone who controls one of them holds part of the key. Remove old numbers and addresses you no longer use.
- The phone with Authenticator: on a passwordless account this phone is effectively the password. Microsoft advises that if you lose or replace it, you remove its authentication method from your security settings so it can no longer approve sign-ins.
- Trusted devices: devices you told Microsoft to trust are not asked for a second code. The Recent activity help page notes you can remove trusted devices from the Security settings page, which is worth doing after selling a PC or console.
- Family organisers: in a Microsoft Family group, an organiser can set screen time, content filters and spending limits for child accounts. For a child's Xbox, the Xbox family hub describes an option to require a passkey before purchases. Treat the organiser account as the most sensitive account in the household. See the Securing Online Gaming Accounts Guide for the wider gaming picture.
Connected apps, app passwords and old devices
Some older apps and devices cannot show a two-step prompt. Microsoft's answer is the app password: a long random password generated for one app or device, shown under App passwords on the Additional security options page. That section only appears once two-step verification is on. Microsoft gives Outlook 2010, Xbox 360 and security cameras that send email as examples of things that may need one.
App passwords bypass your second step for that one connection, so treat them like keys you hand out:
- Create one per device: so you know which to revoke if a camera or old laptop is lost.
- Remove ones you no longer need: every unused app password is a door left on the latch.
- Replace the device where you can: current Outlook apps, Windows 10 or 11 and modern consoles sign in with the normal prompt and do not need app passwords.
Also look at the third-party apps you have allowed to use your Microsoft account (for example calendar or email tools that asked for permission to read your mailbox). If you do not recognise one, remove its access. Stolen mailbox access through an app is just as damaging as a stolen password.
Checking activity and alerts
Microsoft keeps two signals you can act on.
Recent activity page
Go to account.live.com/Activity (also reached through "See your recent activity" on the security page). Microsoft says the page shows sign-ins and other account events from the last 30 days. Expand an entry to see the IP address, an approximate map location, the device or operating system and the browser or app. Repeated sign-ins from the same device and place may appear only once.
| What you see | Likely meaning | What to do |
|---|---|---|
| Entry under Unusual activity from a country you have never visited | Someone else may have your password or tried to use it | Expand it and choose This wasn't me; Microsoft then walks you through changing your password and security info |
| A sign-in from a nearby city on your phone network | Mobile carriers route traffic through other locations, which Microsoft says can show a place you were not in | Check the device and browser match yours; choose This was me if they do |
| Many unsuccessful sign-in attempts | Password guessing or reused passwords being tried | Choose Secure your account, change the password if it is reused anywhere, and consider going passwordless |
| Security info or profile changes you did not make | Account likely taken over | Act at once: see "If you think the account is compromised" below |
| Unusual-activity alerts while you travel | New location triggers Microsoft's checks | Microsoft suggests using Microsoft Authenticator to sign in while travelling |
Unusual sign-in alerts
When Microsoft sees a sign-in from a new location or device it emails you and may text your alternate contacts, and it may block the sign-in until someone enters a code. Microsoft's help page says genuine alerts come from [email protected]. Scammers copy these alerts to push you to a fake sign-in page, so do not click links in them: open account.microsoft.com yourself and check Recent activity. The Phishing links guide shows how to check a link before you trust it.
Hardening baseline: settings to switch on
Do these in order. Most take a few minutes each.
- Update your security info. At account.microsoft.com/security choose Manage how I sign in. Make sure at least three methods are current, for example the Authenticator app, a second email address you control and a phone number. Microsoft strongly recommends three because losing contact methods with two-step on can lock you out.
- Install Microsoft Authenticator and add the account. It becomes your main approval method and works when you travel.
- Add a passkey. From account.live.com/proofs/manage add Windows Hello on your PC and a passkey on your phone. Adding two gives you a backup.
- Turn on two-step verification. Under Additional security choose Turn on under Two-step verification and follow the prompts, which include scanning a QR code with the Authenticator app.
- Generate a recovery code. On the Manage how I sign in page (account.live.com/proofs/manage/additional), find Recovery code and choose Generate a new code. It is 25 characters. Microsoft advises storing it offline and not on a device you use to sign in. A new code cancels the old one, and Microsoft cannot show you an existing code again.
- Go passwordless if nothing needs a password. Check the list of older software above first, then turn on Passwordless account.
- Protect your most sensitive files. OneDrive's Personal Vault asks for a second check (fingerprint, face, PIN or a code) before opening, locks after 20 minutes idle on the web and 3 minutes on mobile by default, and is encrypted with BitLocker when used locally on a Windows 10 PC. Without Microsoft 365 Personal or Family it holds only three files.
- Tidy up devices and app passwords. Remove trusted devices you no longer own and app passwords you no longer use.
To test, sign out on one device and sign back in with the new method before you rely on it. To roll back, Passwordless account and Two-step verification can both be turned off from the same page while you are signed in, which is why you should set up and test the backup methods before turning either on.
If you think the account is compromised
- Change the password straight away if you can still sign in, at account.microsoft.com/security, and use one you use nowhere else.
- If the password was changed, try a reset first. If that fails, choose Forgot my password on the sign-in page, then I think someone else is using my Microsoft account, and follow the recovery steps. Your recovery code can also be used here under "Use a different verification option".
- Check security info and remove any email, phone or app you do not recognise, then add your own back.
- Look for mail tampering in Outlook.com: forwarding to an unknown address, inbox rules that delete or move messages, and sent items you did not write. The US FTC's recovery guidance lists deleting forwarding rules as a step after a hack.
- Check purchases and subscriptions on the account, including Xbox and Microsoft Store orders.
- Scan your PC for malware, because a password stealer will simply take the new password too. The Microsoft Defender Antivirus for Home Users Guide explains how to run a full and offline scan.
- Warn your contacts if messages were sent from your account, and report any money lost (UK: Report Fraud on 0300 123 2040; see the Consumer Reporting Routes Map for other countries).
Microsoft notes its support agents cannot send password reset links or change account details, so anyone who phones offering to "restore" your account is a scammer. The Hacked Social Media or Email Account Recovery Guide covers recovery across other services.
Common misconfigurations
- Two-step on, only one contact method: a lost phone or closed email address then locks you out for up to 30 days, or for good. Keep three methods and a recovery code.
- Old phone number or ex-partner's email as security info: whoever controls it can receive your reset codes. Review the list after any change of number or relationship.
- Recovery code saved in the same mailbox it protects: if the account is lost, so is the code. Print it or keep it in a separate password manager. See the Password Managers Explained for Everyone Guide.
- Approving a prompt you did not start: attackers who already have a password send repeated approval requests hoping you tap yes. If you did not just try to sign in, deny it and change the password.
- Forgotten app passwords: an app password created years ago for an old phone or camera still works and skips your second step until you remove it.
- Relying on text codes long term: Microsoft is phasing SMS out for personal accounts, and text codes are open to SIM swap fraud. Move to Authenticator or passkeys now.
How this maps to recognised guidance
For readers who look after a family's or small office's accounts, the settings above line up with recognised controls:
| Setting | Threat it reduces | Framework reference |
|---|---|---|
| Two-step verification, passkeys, passwordless | Password guessing, reuse and phishing (ATT&CK T1110 Brute Force, T1566 Phishing) | NIST CSF 2.0 PR.AA-03; NIST SP 800-53 IA-2 |
| Security info, recovery code, app password clean-up | Takeover through stale recovery routes | NIST SP 800-53 IA-5 Authenticator Management |
| Recent activity and unusual sign-in alerts | Use of stolen credentials (ATT&CK T1078 Valid Accounts) | NIST CSF 2.0 DE.CM-03; NIST SP 800-53 AU-6 |
| Checking Outlook.com forwarding and rules | Silent mail theft (ATT&CK T1114.003 Email Forwarding Rule) | NIST SP 800-53 SI-4 |
Simple measures of progress for a household: the number of family accounts with two-step or passwordless turned on, the number with three current security info methods, recovery codes stored offline per account, and the date each account's Recent activity was last reviewed (aim for monthly).
Practitioner checklist
- Review security info at account.microsoft.com/security and keep at least three current methods.
- Install Microsoft Authenticator and add the account.
- Add a passkey on your PC (Windows Hello) and on your phone.
- Turn on two-step verification, or go passwordless once older devices no longer need a password.
- Generate a 25-character recovery code and store it offline, away from your sign-in devices.
- Remove unused app passwords, trusted devices and third-party app access.
- Check Recent activity monthly and act on anything under Unusual activity.
- Only trust security emails from [email protected], and never click links in them.
- Move sensitive documents into OneDrive Personal Vault.
- Remove a lost or replaced phone from your sign-in methods the same day.
Standards and references
- Microsoft Support: How to use two-step verification with your Microsoft account
- Microsoft Support: How to go passwordless with your Microsoft account
- Microsoft Support: Signing in with a passkey
- Microsoft Support: How to get a Microsoft account recovery code
- Microsoft Support: What is the Recent activity page?
- Microsoft Support: What happens if there's an unusual sign-in to your account
- Microsoft Support: Protect your OneDrive files in Personal Vault
- US Federal Trade Commission: How to recover your hacked email or social media account
Related NHI Mgmt Group resources: Securing Your Apple ID and Google Account Guide · Two-Factor Authentication for Everyone Guide · Securing Your Email Account Guide · Windows 11 Security Settings Guide