"an illegal state change was requested."

The error is caused by the old, partially signed‑in, compromised Microsoft account still being cached on the PC while a new Microsoft account using the same Gmail address now exists. The PC is trying to use an invalid/blocked sign‑in state for that old account.

Because the original account was hacked and its security info/email were changed, only Microsoft’s official recovery and security processes can resolve the underlying account state. Use these steps:

1. Check for unusual or blocked activity
   • Go to the Security basics page and sign in with the current Microsoft account that uses the Gmail address.
   • Select Review activity and check the Recent activity page. If any sign‑ins or attempts are not recognized, expand them and choose This wasn’t me (for Unusual activity) or Secure your account (for Recent activity). This ensures the current account is secure.
   • If there is any sign that someone else may have accessed the current account, go back to Security basics and select Change password to set a strong new password.
2. If the old hacked account is still needed, attempt recovery
   • If the old account itself was hacked and cannot be accessed, follow the guidance in How to recover a hacked or compromised Microsoft account and use the sign‑in helper tool: it will ask for the email or phone and either show self‑help options or offer a chance to talk to an agent.
   • If recovery fails and the attacker changed security info or enabled two‑step verification, recovery might not be possible; in that case, continue using only the new account and remove traces of the old one from the PC.
3. Handle “security info change is still pending” (if shown)
   • If any sign‑in shows messages like “Your security info change is still pending” or “You can't access this site right now”, it means all previous security info was removed and replaced, and the account is in a restricted 30‑day state. During that period, access is limited and the change cannot be bypassed.
4. Clean up the old account on the PC
   • On the Windows 11 PC, remove the old Microsoft account profile and cached sign‑in from Settings → Accounts (e.g., under Email & accounts, Access work or school, or Family & other users, depending on where it appears) and then sign in only with the new Microsoft account.
   • If the PC is still trying to use the old token, fully sign out of all Microsoft apps (Store, Xbox, Office, etc.), restart the PC, and then sign in again with the new account.
5. If sign‑in problems persist
   • Use the guidance in I can't sign in to my Microsoft account and, if needed, choose I need to talk to a customer support agent to contact Microsoft Support. Explain that a hacked account using the same Gmail address existed previously and that the PC now shows “an illegal state change was requested” when signing in.

These steps ensure the current account is secure, remove the invalid cached state from the PC, and route any remaining account‑state issues through Microsoft’s official recovery and support channels.

References:

• What happens if there's an unusual sign-in to your account
• What does “Security info change is still pending” mean?
• I can't sign in to my Microsoft account
• How to recover a hacked or compromised Microsoft account
• hello my email was (Moderator note: PII removed)@icloud.com and now its (Moderator note: PII removed)@jerkoffmail.com can please someone help me and the team change it my username in xbox is (Moderator note: PII removed) please help me team and change it - Microsoft Q&A
• Entraron a mi cuenta de microsoft y cambiaron el gmail y contraseña - Microsoft Q&A
• Lock or block login attempts - Microsoft Q&A