A tool for managing user identities, credentials, and access across on-premises and cloud environments
Use the Microsoft account Sign-in Helper first. It is the primary recovery path for a hacked Microsoft account and can guide to self-help steps or an agent option.
If access is still possible anywhere on the account, do this immediately:
- Run a full antivirus or malware scan on the PC before changing anything.
- Change the password, or reset it if sign-in no longer works.
- Check account settings that are commonly changed after compromise, especially connected accounts, forwarding, and automatic replies.
- Go to the Security basics page and review Recent activity. For sign-ins that were not authorized, select This wasn't me or Secure your account where shown.
If sign-in no longer works because the attacker changed the password:
- On the sign-in page, select Forgot my password.
- Select I think someone else is using my Microsoft account.
- Follow the recovery instructions.
If the account shows "Let's protect your account" or "Help us secure your account", complete the verification prompt using an alternate email address or phone number that is accessible. It does not have to belong to the account owner; it only needs to be reachable to receive the code.
If two-step verification was turned on and none of the alternate verification methods are accessible, support agents cannot reset the password or change account details. If two-step verification was not turned on and the listed verification options are not recognized, use the Sign-in Helper tool.
For the recovery form process, a working email account that can be accessed is required so Microsoft can send updates about the request.
After recovery, add another way to sign in or verify identity in Advanced security options so future recovery is easier.