Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
Sorry to hear that you’re having trouble with this situation. Since you have already been able to regain access to the Microsoft account using your phone number, I recommend securing the account immediately.
First, change the account password and review the recent sign-in activity to make sure there are no sessions or activities that you do not recognize.
Then, check both the aliases associated with the account and the security information. These are two different settings in a Microsoft account.
If the attacker changed the primary alias, you can add a new email address as an alias, make the new address the primary alias, and then remove the attacker’s alias.
However, there is an important limitation regarding your original email address. If your original address was a Microsoft address such as @outlook.com, @hotmail.com, @live.com, or @msn.com and the attacker removed it from the account, Microsoft states that the address is permanently deleted as an alias and cannot be associated with a Microsoft account again.
Also check the account’s security information and remove any recovery email address, phone number, or verification method that you do not recognize, but make sure you add and verify your own security method first.