Managing personal Outlook.com account settings, security, and privacy
Do not click any links in the email until you verify whether it is legitimate. Open a new browser window, go directly to your Microsoft account Recent activity
https://account.live.com/Activity
Check the location, device, browser, and whether the attempt was successful. Microsoft may send these alerts when your account is accessed from a new device or location.
If you recognize the activity, mark it as yours. If you do not recognize it, select This wasn’t me or Secure your account, then immediately change your password to a new, unique password.
Also verify that your recovery email address and phone number have not been changed, and enable two-step verification or Microsoft Authenticator.
https://account.live.com/proofs/manage/additional
Legitimate Microsoft account-security emails normally come from the @accountprotection.microsoft.com domain. However, it is still safer to access your account directly rather than using the email link. If the message appears suspicious, report it as phishing and delete it.