A tool for managing user identities, credentials, and access across on-premises and cloud environments
Follow these steps, in order, using only the official Microsoft flows shown in the documentation.
- Secure the current device
- Disconnect from the internet and run a full malware/antivirus scan to remove the trojan before doing anything else.
- Only continue once the device is clean, or use a different trusted device.
- Use the hacked‑account recovery guide
- Go through the official hacked/compromised account flow: How to recover a hacked or compromised Microsoft account.
- This guide is the only supported way to try to regain access when an attacker has changed the password, security info, and aliases.
- Submit the Microsoft account recovery form
- If normal reset and the troubleshooter no longer work because all security info and the primary alias were changed, fill in the account recovery form as completely as possible: Help with the Microsoft account recovery form.
- Use an alternate email that is still under control (can be a new Outlook.com address or a friend/relative’s address) so Microsoft can contact about the case.
- Complete the form from a device and location that were previously used to sign in to the stolen account, if possible, to improve the chances of success.
- If security info was fully replaced and the form fails
- The documentation states that when two‑step verification is enabled and none of the security methods are accessible, or when the attacker has completely replaced the security info and the recovery form is not successful, support agents are not allowed to override security or send manual reset links. In that situation there is no additional method to recover the account beyond the form and the Sign‑in Helper.
- After recovery or if creating a new account
- Enable strong security on the recovered or new Microsoft account:
- Add multiple security methods (alternate email, phone, Microsoft Authenticator, security key) via Advanced security options.
- Consider going passwordless using methods such as Microsoft Authenticator or security keys, as described in the two‑step verification guidance.
- Regularly review recent activity and security info so similar changes are detected quickly.
- Enable strong security on the recovered or new Microsoft account:
References:
- How to recover a hacked or compromised Microsoft account
- Microsoft account has been locked
- Troubleshoot Microsoft verification code issues
- Help with the Microsoft account recovery form
- Common problems with two-step verification for a work or school account
- Hello , welcome to Account help & learning
- my microsoft account has been compromised - Microsoft Q&A
- My account got hacked - Microsoft Q&A
- Me robaron una cuenta - Microsoft Q&A
- My account got hacked. - Microsoft Q&A
- How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A