Unknown Device

Question

There is an unknown device listed in my live.com account. It is listed as in another country. I delete it, change my password, but then it shows up again a day or two later. What should I do?

Answer 1

Hi Patrick Dunn,

I understand that an unfamiliar device keeps returning after being removed and the account password has been changed. Unfortunately, as fellow users on this public user-to-user forum, contributors cannot access or modify personal Microsoft accounts.

The Q&A Assist answer provides appropriate initial security steps. Have you had a chance to complete them, particularly Sign out everywhere, and wait up to 24 hours for the process to finish?

I would also like to add:

1. If two-step verification is not enabled, turn it on from Microsoft account Security. This adds another verification requirement when signing in from an untrusted device.
2. If Recent activity shows an unfamiliar successful sign-in, run a full security scan on every device normally used to access the account. See What is the Recent activity page?
3. Check whether an email app or connected service is automatically signing in again, as recurring synchronization activity may reappear.
4. Please clarify whether the unknown entry returns on the Devices page or only on the Recent activity page. Do not post the device ID, IP address, or full email address publicly.

If the device continues to return after completing the above steps, contact Microsoft Support for further assistance:

1. Visit the Microsoft Support contact page: Contact - Microsoft Support    
2. In the search bar provided on the page, type "Account Security" and press Enter.    
3. Click on the "Get Help" button that appears.    
4. Scroll down the page until you see and click on the "Contact Support" option.    
5. When prompted to select your product or service, choose "Other Products".    
6. For the category, choose "Manage Account Security".    
7. Look for and click on "Chat with a support agent in your web browser".    
8. When prompted, provide a valid contact email where Microsoft can reach you regarding your case.    
9. Explain your situation clearly: Be concise but provide all the relevant details.      

I hope these additional checks help determine whether this is a registered device or recurring sign-in activity.

Answer 2

If an unknown device keeps reappearing, treat it as either an active session that has not fully expired yet or a device that is still signing in again.

Recommended steps:

1. Go to the Security basics page and select Review activity.
   • Check whether the sign-ins from the other country are in Unusual activity or Recent activity.
   • If an entry is not recognized, select This wasn't me for unusual activity, or Secure your account for suspicious recent activity.
2. Change the account password again from Security basics.
   • Use a strong password that is not used anywhere else.
   • If a breached or reused password was involved, change it anywhere else it was used.
3. Sign out of all sessions everywhere.
   • A Microsoft Q&A resolution for this exact symptom recommends forcing a sign-out on all devices linked to the account so the unknown device loses access.
   • Another accepted answer notes this can take up to 24 hours to take effect.
4. Review the Devices page.
   • Make sure every listed device is recognized.
   • Remove or disable anything unfamiliar.
   • For work or school accounts, disabling a device blocks it from accessing organizational resources. Important: if a work or school device is disabled by mistake, it cannot be undone without an administrator.
5. Check account security details.
   • Make sure the security contact methods are current and belong to the account owner.
   • If unusual activity continues, verify sign-in methods and aliases are all recognized.
6. If the account is blocked because of unusual sign-in behavior, follow the sign-in screen prompts to receive a security code and unlock it.

Important note about location:

• The country or IP shown in recent activity is not always exact. Mobile phone services and similar routing can make activity appear from a different location than the actual one.

If the device still reappears after password change, review activity, and sign-out everywhere, use Microsoft support through the public support entry point.

---

• What happens if there's an unusual sign-in to your account
• What is the Recent activity page?
• Manage devices used with your Microsoft account
• Manage devices used with your Microsoft account
• remove sign in from my account - Microsoft Q&A I am trying to remove a suspicious signed in device from my account but it will not disappear.
• Different IP address and location shown for log-in - Microsoft Q&A During my daily (evening) ritual of blocking/reporting the many scam/junk emails I receive daily, I was suddenly locked out of my outlook account. I immediately exited outlook and turned my laptop off. Today, I was still blocked but managed to sign-in. However, checking my recent activity shows me located in London (I'm not) with a different IP address. I have changed my password but am still concerned that I may need to do something else. Microsoft's own 'tool' to check my account tells me there are no issues, but then I'm unable to tell it that my location and IP address are both wrong.