"Successful Sign-in" followed by "Unusual Activity Detected" log

vu hai dao 20 Reputation points
2026-09-02T11:43:26.5066667+00:00

Hi Microsoft Experts,I recently checked my Microsoft account's Recent Activity and noticed something confusing. At the bottom of the log, there was a "Successful sign-in" from an unfamiliar IP address. Immediately above that entry,the session activity of it say "unusual activity resolved", at the exact same time, the system flagged "Unusual activity detected.",and the session activity of it only said " unusual activity detected" My account did not have 2FA enabled at that moment.I would like to clarify the exact technical scenario of this event:Does "Successful sign-in" here simply mean the attacker guessed my password correctly and enter my account succesfully because i dont have 2FA, but was immediately blocked/kicked by the AI because of the strange IP (which generated the "Unusual activity" flag above it)?Or is it possible that the attacker used stolen session cookies to bypass authentication, causing this specific sequence of logs?

Microsoft Security | Microsoft Authenticator

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.