The sender address (******@accountprotection.microsoft.com) does indicate that Email may be genuine.
The best option is to not click anything in the Email, log into your Microsoft account on this link to check the recent activity on your account, do you see any login attempts form location(s) you do not recognise and if so, are the login attempts indicated as successful.