Managing personal Outlook.com account settings, security, and privacy
The official recovery path is:
- Start with the hacked account recovery flow using Microsoft’s sign-in helper tool. It asks for the account email address or phone number and then either provides the correct self-help path or offers the option to talk to an agent.
- Scan the PC for malware before changing anything else. In Windows Security, open Virus and threat protection → Scan options → Full scan → Scan now. This matters because changing the password on an infected device can expose the new password again.
- Try to reset the password. If sign-in is still blocked because the attacker changed the password and recovery details, use the Microsoft account recovery form.
- Submit the recovery form with a working contact email. Microsoft sends the result to that working email address within 24 hours.
- If Microsoft verifies the account, instructions to sign back in are sent to that same working email.
- If Microsoft cannot verify the account, the form can be retried up to two times per day.
- If access is restored, immediately review account settings that are commonly changed after compromise, especially:
- connected accounts
- forwarding
- automatic replies
- If there was an unusual sign-in alert and the account is still accessible anywhere, go to Security basics → Review activity and mark suspicious events as This wasn't me or Secure your account. Then change the password from Security basics.
- If the account is blocked, use the Sign-in Helper for Outlook.com account unblocking. If unblocking by security code or password change does not work, continue with the Microsoft account sign-in recovery guidance.
- If self-service does not restore access, use Contact Microsoft Support and select Get Help, then Contact Support for the best support option.
Important limits in the official process:
- Microsoft support agents cannot send password reset links.
- Microsoft support agents cannot access or change account details.
- Recovery depends on successful verification through the official recovery process.
References: