A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
The notification likely indicates that someone (or something, like an app) attempted to sign in and triggered a security check, but it doesn’t always show as a full sign-in on your Recent activity page, especially if the attempt failed early or was just a verification challenge.
Since the password has already been changed, the key next steps are:
- Review all recent activity
- For a personal Microsoft account, go to the Recent activity page or the Security basics page and select Review activity.
- Expand each item and confirm it was actually performed by you.
- If you see anything you don’t recognize:
- In Unusual activity: select This wasn’t me.
- In Recent activity: select Secure your account.
- Understand what you might see there
- Activity types include:
- Incorrect password entered – someone tried a wrong password.
- Successful sign-in – someone signed in with the correct password.
- Unusual activity detected – correct password, but from an unrecognized location/device; an extra security challenge is required.
- If only “Password changed” or “Password reset” appears and all other entries are yours, the account is likely secure now.
- Activity types include:
- Strengthen account security
- From the Security basics or Security settings page:
- Change the password again if there is any doubt and ensure it is unique and strong.
- Review and update security info (phone numbers, alternate emails) and remove anything unfamiliar.
- Consider turning on two-step verification if not already enabled, and keep security info current so alerts and codes reach only trusted devices.
- From the Security basics or Security settings page:
- If you suspect someone had access
- Follow the guidance under If someone has accessed your account: check the Recent activity page and report any activity that was not you.
- If sign-in issues appear (for example, username and password stop working), use the documented recovery steps for compromised accounts.
Even if the activity page currently shows only your own password change, continuing to monitor it for a while and keeping security info up to date is recommended.
References: