You can view all of your recent work or school account sign-in activity, from theMy sign-inspage of theMy Accountportal. Reviewing your sign-in history helps you to check for unusual activity by helping you to see:
-
If someone is trying to guess your password.
-
If an attacker successfully signed in to your account, and from what location.
-
What apps the attacker tried to access.
Notes:If you see an error while signing in with a personal Microsoft account, you can still sign in by using the domain name for your organization (such as contoso.com) or theTenant IDof your organization from your administrator in one of the following URLs:
-
https://myaccount.microsoft.com?tenantId=your_domain_name
-
https://myaccount.microsoft.com?tenant=your_tenant_ID
View your recent sign-in activity
-
Sign in to your My Account page with your work or school account.
-
SelectMy sign-insor select theReview recent activitylink from theMy sign-insblock.
-
Expand and review each of the sign-in items, making sure that you recognize each one. If you find a sign-in item that doesn't look familiar, change your password to protect the account in case it's compromised.
If you see a successful sign-in
Sometimes, while reviewing your own normal sign-in activity, you might see a successful sign-in from an unfamiliar location, browser, or operating system. Unfamiliar sign-ins can mean an attacker has gained access to your account. If you see activity that you didn't authorize, we recommend you immediately change your password, and then go toSecurity infoto update your security settings.
Before you determine something is incorrect, make sure you're not seeing a false positive (where the item looks questionable, but is okay). For example, we determine your approximate location and map based on your IP address. Mobile networks are especially hard to pinpoint since they sometimes route traffic through distant locations. Even if you sign in using your mobile device in Washington state, the location might show the sign-in coming from California. We strongly suggest that you check details beyond just the location. Make sure the operating system, browser, and app all make sense, too.
If you see an unsuccessful sign-in
If you see an unsuccessful sign-in, it could mean that you mistyped your credentials. It could also mean that an attacker was trying to guess your password. To respond to this risk, you don't have to change your password, but we recommend that you register for two-step verification. With multi-factor authentication, even if the hacker guesses your password, it won't be enough to access the account.
If you see an unsuccessful sign-in, with a note underSession activitythat says"Additional verification failed, invalid code," it means that your primary authentication credentials succeeded, but two-step verification failed. This condition could mean that an attacker correctly guessed your password but was unable to pass the two-step verification challenge. We recommend that you still change your password, because the attacker might have that already, and go to theSecurity infopage to update your security settings.
Search for specific sign-in activity
You can search your recent sign-in activity by any of the available information. For example, you can search for your recent sign-in activity by operating system, location, app, and so on.
-
On theReview recent activitypage, type the information you want to search for into theSearchbar. For example, typeUnsuccessfulto search for all unsuccessful sign-in activity collected by the My Account app.
-
Type in theSearchbox to begin searching for unsuccessful activity.
-
Confirm unusual activity.Sign-ins that are flagged as unusual activity can be confirmed in the tile for that activity in theMy sign-inspage.
View sign-in activity on Android
Each time you view or change security information, you must sign in to your work or school account to continue.
-
Open the Microsoft Authenticator app, and select the home page for your work or school account.
-
SelectRecent account activity.
-
If your sign-in is successful, review each of the sign-in items, making sure that you recognize each one. If you find a sign-in item that doesn't look familiar, change your password to protect the account in case it's compromised.
Change your password on Android
Your administrator can make it possible for you to reset your password from the Authenticator app. Each time you sign in to view or change security information, you must sign in to your work or school account to continue.
-
Open the Microsoft Authenticator app, and select the home page for your work or school account.
-
SelectChange password.
-
If your sign-in is successful, you can update your password info on theChange passwordpage.
Update security info on Android
Each time you sign in to view or change security information, you must sign in to your work or school account to continue.
-
Open the Microsoft Authenticator app, and thenselect the home page for your work or school account.
-
SelectUpdate security info.
-
If your sign-in is successful, you can thenupdate your security details theSecurity infopage.
Next steps
After viewing your recent sign-in info, you can:
-
View or manage yoursecurity info
-
Change yourMy Account portal settings
