Compromised account?

Question

I keep receiving email notifications from Microsoft that there is are suspicious log in activity in my account with location and IP number (not mine) and that there was a security breach and someone get access to my profile and I should retrieve my account, or that I should confirm if it was me. But when I log in I see everything is in order and there is nothing suspicious in the activity log, I don't see these log ins. Is it only scam? How do I know that my account is compromised or not? Thank you!

Answer 1

It sounds like you are receiving alerts that could indicate suspicious activity on your Microsoft account. Here are some steps you can take to determine if your account is compromised:

1. Check for Common Symptoms: Look for signs of compromise such as missing or deleted emails, suspicious inbox rules that forward emails to unknown addresses, or unusual activity in your sent items. If you notice any of these symptoms, your account may be compromised.
2. Review Sign-in Activity: Although you mentioned that you do not see anything suspicious in your activity log, it is important to check the Microsoft Entra sign-in logs for details such as IP addresses, sign-in locations, and times. This can help you identify any unauthorized access attempts.
3. Investigate Further: If you suspect that your account may be compromised, consider conducting a thorough investigation using the tools available in the Microsoft Entra admin center and the Microsoft Defender portal. This includes examining audit logs and message traces to see if any unauthorized actions were taken.
4. Secure Your Account: If you confirm any suspicious activity, take immediate action to secure your account. This includes changing your password and enabling multi-factor authentication if it is not already in place.
5. Be Cautious with Emails: If the emails you are receiving seem suspicious, verify their authenticity. Check the sender's email address and look for signs of phishing. Do not click on any links or provide personal information unless you are certain the email is legitimate.

If you remain unsure about the security of your account, it may be beneficial to contact Microsoft support for assistance.

---

References:

• Common symptoms of a compromised Microsoft 365 email account
• Respond to a compromised cloud email account