I got a notification for a sign on code I did not ask for.

AJ Troilo 0 Reputation points
2026-05-20T01:04:57.0133333+00:00

I feel like someone is trying to sign in to my account. I changed my password immediately. After, I went to the past activity page where I only found myself changing my password, no prior log in attempts.

Microsoft Security | Microsoft Authenticator
0 comments No comments

1 answer

Sort by: Oldest
  1. AI answer

    2026-05-20T01:05:11.7166667+00:00

    The notification likely indicates that someone (or something, like an app) attempted to sign in and triggered a security check, but it doesn’t always show as a full sign-in on your Recent activity page, especially if the attempt failed early or was just a verification challenge.

    Since the password has already been changed, the key next steps are:

    1. Review all recent activity
      • For a personal Microsoft account, go to the Recent activity page or the Security basics page and select Review activity.
      • Expand each item and confirm it was actually performed by you.
      • If you see anything you don’t recognize:
        • In Unusual activity: select This wasn’t me.
        • In Recent activity: select Secure your account.
    2. Understand what you might see there
      • Activity types include:
        • Incorrect password entered – someone tried a wrong password.
        • Successful sign-in – someone signed in with the correct password.
        • Unusual activity detected – correct password, but from an unrecognized location/device; an extra security challenge is required.
      • If only “Password changed” or “Password reset” appears and all other entries are yours, the account is likely secure now.
    3. Strengthen account security
      • From the Security basics or Security settings page:
        • Change the password again if there is any doubt and ensure it is unique and strong.
        • Review and update security info (phone numbers, alternate emails) and remove anything unfamiliar.
        • Consider turning on two-step verification if not already enabled, and keep security info current so alerts and codes reach only trusted devices.
    4. If you suspect someone had access
      • Follow the guidance under If someone has accessed your account: check the Recent activity page and report any activity that was not you.
      • If sign-in issues appear (for example, username and password stop working), use the documented recovery steps for compromised accounts.

    Even if the activity page currently shows only your own password change, continuing to monitor it for a while and keeping security info up to date is recommended.


    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.