Definition of "Unusual Activity Detected"

Question

Hello,

I recently received an email notification that "Unusual sign-in activity was detected."

I reviewed the Recent activity page and under the column labeled "Session Type"> "Sesson activity" it was listed with "Unusual activity detected"

Does this mean that they were successful in signing into my account or were they blocked by a security code or question?

I know there is another question posted with this same subject title, however, they did not get a helpful answer, so I am reposting.

Thanks for the assistance!

Answer 1

is there any possible way I can request data Microsoft has stored from the intruder's activity on my account. To include files downloaded or viewed, if they imported passwords, etc.? I know a lot of data is already stored regarding our searches and what not so it doesn't seem like an unrealistic question to get more data on how the time was spent in my Microsoft account when the intruder was using it.

And the most important question goes unanswered. Why am I not surprised?

And no, this is not unrealistic or even unreasonable in any way. I have no doubt that data exists. They literally track our every move. Apparently they just don't want to share that. It's for their eyes only.

Answer 2

Hello, this is Emily.

Unusual activity actually means they managed to get through at least the first step of the sign in process, which is usually the password step. If you don't have two-step verification set up, then it means this activity has fully accessed your account. But if you have two-step set up, it can mean it didn't get through the second step (verification), and it can also mean it got through the second step. You will need to review the activities history to find out more about it.

Sign into the account here: https://account.microsoft.com, then go to Security to review the sign in activities. When you reviewed the account's sign in activities, Click into those labeled as "unsuccessful sign in", you can click on it to expand it to review the Session activity. If it says " request denied xxx", that means this activity had your password entered correctly, and a code was generated, but it didn't pass the two-step verification. If you see this, and this activity wasn't yours, you need to change your password asap.

Answer 3

To learn about Unusual Activity Detected, select and expand Learn what activity descriptions mean (scroll down the list) on the Recent activity page.

Quote

Session type -Unusual activity detected
 
What it means - Someone signed into your account using the correct password, but from a location or device that we didn't recognize. To make sure it was you, we sent you a notification and required an extra security challenge. (This might have been you, but we weren't sure.)"

Answer 4

Thank you for the reply. I was hoping to get additional detail though.

This is what was shown. Since then, I've reset my password (notice it mentions it in bottom left corner) but it does NOT give additional information on the activity. Also, I did NOT have 2 step verification on. Is it guaranteed they've accessed my account then?

Answer 5

I hope you have turned on the two-step verification since. Because if you didn't have it on then, and you received the unusual activity alert, it does mean that they have gained access to your ccount via correctly entering the password.