Unauthorized Log In from different region

Follow these steps immediately to protect the account and stop the repeated sign-in prompts from other regions:

1. Secure the account and change password once more

• Go to the Security basics page for the Microsoft account.
• Select Change password and set a strong, unique password that is not used on any other site.
• Do this from a trusted device and network (home PC, not public Wi‑Fi).

2. Review all recent and unusual sign-in activity

• On the same Security basics page, select Review activity to open the Recent activity page.
• In the Unusual activity section, expand each sign-in from Japan, Germany, Netherlands, Russia, or any other location that is not recognized.
  • For each suspicious entry, select This wasn't me.
  • Follow the prompts so Microsoft can help secure the account.
• In the Recent activity section, expand items and, if something is clearly not recognized, select Secure your account and complete the steps.

3. Let Microsoft mark the activity as unsafe and enforce protection

• When This wasn't me is chosen for suspicious activity, the service will guide through:
  • Confirming identity.
  • Changing the password (if not already done).
  • Reviewing and updating security info.

4. Check and update security info

• From Security basics, review phone numbers, alternate email addresses, and sign-in methods.
• Remove any security info that is not recognized.
• Ensure at least one trusted phone number or email is present and up to date so alerts and verification codes go only to trusted channels.

5. Understand why locations look different

• On the Recent activity page, each sign-in shows IP address, map location, device/OS, and browser/app.
• Mobile networks and some ISPs can route traffic through distant locations, so a sign-in from the real region might appear as another country. Always check:
  • Device type / operating system.
  • Browser or app.
  • Time and date. If those match actual usage, it may be a false alarm.

6. If sign-ins are still clearly unauthorized

• Continue to mark them as This wasn't me and complete the secure-account flow each time.
• If unable to sign in because someone changed the password, follow:
  • When you can't sign in to your Microsoft account and then choose I think someone else is using my Microsoft account on the sign-in page.

7. Ongoing monitoring

• Periodically review the Recent activity page to ensure all sign-ins, devices, and apps are recognized.
• If new unusual activity appears, immediately repeat the steps above.

These actions use Microsoft’s built-in unusual-activity detection and Recent activity tools to lock out attackers and keep the account safe.

References:

• What happens if there's an unusual sign-in to your account
• What is the Recent activity page?
• View your work or school account sign-in activity from My Sign-ins