[Moderator Note: Personal Info Removed] - case wrongly auto-closed, need human review

Question

I'll post the reply I sent to what seems like an automated system, even though you are not told the case is closed.

Additional attempt on [Moderator Note: Personal Info Removed]

This was a live, same-day incident. The account was removed from our Microsoft Family group at 09:45:37 UTC, 19 August 2026 (confirmed by your own automated notification, subject "[Moderator Note: Personal Info Removed] is no longer in your family group" — the profile display name had already been changed to "[Moderator Note: Personal Info Removed]" by that point). Given how fresh this is, I'd expect sign-in logs, session data, and any pending security-info-change window to still be intact, which is exactly why I'm asking for this to be escalated now rather than worked through the standard queue.

1. Basis of the suspension

You state the account was suspended following confirmed unauthorised access, but this was only identified after it was reported by us and investigated — not flagged proactively by your automated monitoring. The account also had Microsoft Authenticator configured as the sign-in method for new/unrecognised logins, yet no approval prompt was received before the sign-in alias and recovery details were changed.

Please confirm, from the account's sign-in and security-change logs, how the change to sign-in alias and security info was authorised without an Authenticator approval being issued. This is relevant both to understanding whether this was a credential compromise or a session/token-level compromise, and to whether your MFA enforcement performed as intended on this account.

2. Xbox account details

The Gamertag and Xbox Network Device ID for this profile were already submitted via the account recovery form referenced above. I'd prefer not to repeat them in this open ticket thread; happy to resupply via a verified secure channel if that's needed to progress the case.

3. A minor's account, stripped of parental controls, with no verification

The account holder is 13 years old. During the takeover, the account was removed from our Microsoft Family group. I understand Microsoft's own policy is that accounts aged 13 and over can leave a Family group unilaterally, with no organizer password or additional verification required. If that's what occurred here, it means whoever took over this account was able to strip a minor's account of all parental oversight in a single step, with no friction and no security check — using a legitimate self-service flow, not a separate exploit.

I'd like this treated as a safeguarding concern, not just an account security ticket: a 13-year-old's account is currently under the control of an unidentified third party, with no parental controls in place and no way for us to monitor or restrict it. The family-group-removal notification was received (09:45:37 UTC today, to the family organizer's registered email), so that part of your system worked as intended — but it also confirms the profile was already renamed to "[Moderator Note: Personal Info Removed]" by that time, which should be checkable against sign-in/change logs for this account from the morning of. Please route this case to whichever team handles child/teen account safety, in addition to standard account recovery, given how recent this is.

4. Paid content and services now inaccessible

As a direct result of the suspension, the Xbox profile associated with this account — and all purchased content and services linked to it — is no longer accessible, through no fault of the account holder. This is content and services that were paid for and are no longer being supplied. I would like this treated as a formal request for restoration of access or remedy (replacement value / refund) for the affected purchases, and I'll reference the timeline and this ticket if this needs to be pursued further via Money Claim Online.

5. OneDrive / personal data

Personal documents stored in OneDrive on this account are also now inaccessible. Please advise the quickest route to restore access to retrieve these files. Separately, I will be submitting a formal Subject Access Request via Microsoft's data subject request channel for a copy of personal data held on this account — please treat this paragraph as advance notice, not as the SAR submission itself.

6. Device impact

The Windows PC used with this account is now locked to the last-applied Family Safety schedule and restrictions, cannot be updated or removed because the account can no longer be validated, and repeatedly prompts for sign-in to revalidate Family settings — interrupting use of the device. Please advise how this device-level lock can be released independently of the account recovery outcome.

7. Next steps requested

• Escalation of this case to your account recovery review / complaints-handling team and, given point 3 above, to whichever team handles child/teen account safety, rather than remaining with first-line support.
• A written timeline for response.
• Answers to the questions raised in sections 1 and 3 above.

I look forward to your response.

Kind regards, 

Answer 1

 Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.  

---

Hello Karl Fleming

I’m sorry that your support request appears to have been automatically closed without the requested human review. Given the reported takeover of a minor’s account, its removal from the Microsoft Family group, and the loss of access to OneDrive files and Xbox purchases, I understand why you are requesting urgent escalation.

Please note that this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, are not permitted to interfere with Microsoft product features or access back-end systems. Our role is limited to providing technical guidance on reported incidents, requests, and ideas.

We cannot access account sign-in or security-change logs, investigate Microsoft Authenticator activity, reopen support requests, restore purchases or files, or escalate the matter internally. Please contact Microsoft Support and ask for a human review of the complete support history, with escalation for the account-security and child-safety concerns.

1. Open Contact Microsoft Support.
2. Under “We’re here to help,” enter “Microsoft 365,” select “Get Help,” and then select “Contact Support.”
3. Sign in to your Microsoft account when prompted.
4. Under Products & Services, select “Microsoft 365 and Office,” choose “Technical Support,” and confirm.
5. Select “Chat with a support agent in your web browser.”

I hope Microsoft Support can review the existing support history and route the matter to the appropriate account-security and child-safety teams.

Have a nice day.