A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Add the new Gmail as a verification method first, then remove the hacked Gmail from Additional security options; changing the Microsoft account’s sign-in email does not automatically replace its security verification email.
Remove the old Gmail from verification
Since another sign-in method still works:
- Sign in to your Microsoft account.
- Open Security → Advanced security options.
- Select Add a new way to sign in or verify.
- Add your new Gmail address, phone number, or Microsoft Authenticator.
- Complete the verification code or approval for that new method.
- Expand the old Gmail verification method and select Remove.
Microsoft may show the old method as Scheduled for removal. Removal can take 30 days, and the method remains available for verification until the displayed removal date.^1^^2^
Because the Gmail was hacked, also inspect this page for phone numbers, email addresses, or Authenticator registrations you do not recognize and remove them.
If the old Gmail is also a sign-in address
A verification method and an account alias are separate. An alias is an email address used as a username for the same Microsoft account.
To remove the old Gmail as an alias:
- Go to Your info → Manage how you sign in to Microsoft.
- Ensure the new address is listed.
- If necessary, select Make primary beside the new address.
- Select Remove beside the old Gmail.^3^
Do not remove the new working verification method or your only usable sign-in alias.
If Microsoft will not let you remove it
If the verification page only offers the inaccessible Gmail and none of your alternatives work, select I don’t have any of these and replace the security information. Replacing all security information triggers a 30-day waiting period before normal sign-in access is restored.^1^
Support agents cannot manually send verification codes or change protected account details, so the account’s security replacement or recovery process must be completed if all working methods are lost.
References