SECURE YOUR OUTLOOK / MICROSOFT ACCOUNT

Protect the account behind your Outlook email.

Your Microsoft account can provide access to Outlook, OneDrive, Microsoft 365 and other Microsoft services. Protect the account itself, not just the inbox.

Start with account access.

Your Outlook inbox may contain password-reset messages, private conversations, documents and information that can help someone access your other accounts.

These checks focus on the Microsoft account that controls your Outlook access. Microsoft may use slightly different wording or offer different verification methods depending on your account and device.

What should I never share?
Never give anyone your Microsoft password, verification code, recovery code or authentication approval. Legitimate support should not require you to reveal these secrets.
Personal Microsoft account or work/school account?
This guide is primarily for personal Microsoft accounts used with Outlook.com or Hotmail. Work and school accounts may use different security controls managed by an organization.
MICROSOFT ACCOUNT SECURITY

Protect the account, not just the inbox.

Work through these checks one at a time. After making an important change, use the VERIFY section to confirm that the protection is actually active.

Turn on two-step verification

Add another layer of protection so a stolen password is less likely to be enough to access your Microsoft account.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account and sign in normally.
  2. Go to Security in your Microsoft account.
  3. Open Manage how I sign in.
  4. Look for the available two-step verification or additional verification options.
  5. Choose the available verification method you want to use.
  6. Follow Microsoft's instructions to complete the setup.
  7. If you use Microsoft Authenticator, complete the verification process in the app.
  8. Return to the security settings and confirm that your additional verification protection is active.

VERIFY: Confirm that your Microsoft account shows the additional verification method as active before relying on two-step protection.

Add more than one sign-in verification method

Keeping more than one legitimate way to verify your identity can make account recovery easier if one method becomes unavailable.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account Security settings.
  2. Select Manage how I sign in.
  3. Choose Add a new way to sign in or verify.
  4. Review the verification methods Microsoft currently offers for your account.
  5. Add a method that you personally control and can access.
  6. Complete the verification process.
  7. Review the list of available verification methods.
  8. Remove outdated or inaccessible security information where appropriate.

VERIFY: Check that your important verification methods belong to you and that you can access them when Microsoft asks you to verify your identity.

Set up Microsoft Authenticator when appropriate

Microsoft Authenticator can provide an additional way to verify sign-ins and can support passwordless account access.

Click to see protection steps

Step-by-step

  1. Install Microsoft Authenticator through your device's legitimate app store.
  2. Open your Microsoft account Security settings.
  3. Go to Manage how I sign in.
  4. Choose the option to add Microsoft Authenticator if it is available.
  5. Follow Microsoft's instructions to connect the app to your account.
  6. Complete the verification process using the Authenticator app.
  7. Test the sign-in verification method when appropriate.
  8. Keep your phone protected with a strong device lockand legitimate security updates.

VERIFY: Confirm that Microsoft Authenticator appears as an active verification method in your Microsoft account security settings.

Review your recent account activity

Recent activity can help you notice unusual sign-ins, password changes, security changes or other activity you did not perform.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account Security page.
  2. Select Review activity or open the Recent activity page.
  3. Review the activity shown for your account.
  4. Expand entries that you do not immediately recognize.
  5. Check the date, location, device or access method shown.
  6. If an unusual activity entry was not yours, use Microsoft's available option to report that it was not you.
  7. If you find suspicious activity, follow Microsoft's security instructions rather than ignoring it.
  8. If necessary, change your password and review your other security information.

VERIFY: You should be able to recognize the important recent account activity and investigate anything you did not initiate.

Use a strong, unique password

Your Microsoft account can provide access to Outlook, OneDrive, Microsoft 365 and other Microsoft services, so its password should not be reused elsewhere.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account Security settings.
  2. Choose the option to change your password.
  3. Create a strong password that you do not use on another important account.
  4. Avoid passwords based on easily guessed personal information.
  5. Store the password securely, preferably in a reputable password manager.
  6. Never give your Microsoft password to someone claiming to be Microsoft support.
  7. If you suspect that the password has been exposed, change it immediately.

VERIFY: Confirm that the new password has been accepted and that you can sign in normally using it.

Review your security information

Keep the email addresses, phone numbers, authenticator methods and other security information connected to your account under your control.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account Security settings.
  2. Go to Manage how I sign in.
  3. Review the security and verification methods currently listed.
  4. Check the email addresses and phone numbers shown.
  5. Check whether Microsoft Authenticator or another authentication method is connected.
  6. Remove or replace information that you no longer control where Microsoft provides that option.
  7. Do not add a recovery or verification method because an unknown person tells you to.
  8. If Microsoft warns that security information is being changed, investigate the change before continuing.

VERIFY: Confirm that every important security method belongs to you and that you can access it right now.

Generate and protect a recovery code

A Microsoft account recovery code can help you regain access if you lose access to your usual verification methods.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account Security settings.
  2. Go to Manage how I sign in.
  3. Find the Recovery code section.
  4. Choose the option to generate a new recovery code.
  5. Store the recovery code somewhere safe and separate from the devices you normally use to sign in.
  6. Do not send the recovery code to another person.
  7. Do not post the recovery code in a message, email or public location.
  8. Remember that generating a new recovery code makes the previous recovery code unusable.

VERIFY: Confirm that you know where your current recovery code is stored and that it is protected from unauthorized access.

Review devices connected to your Microsoft account

Review devices associated with your Microsoft account and investigate devices you no longer use or do not recognize.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account.
  2. Go to the Devices section of your account dashboard.
  3. Review the devices associated with your account.
  4. Check whether the devices shown belong to you.
  5. Identify devices you no longer use.
  6. Unlink or remove devices where Microsoft provides that option and where appropriate.
  7. If you find a device you do not recognize, investigate your account security rather than ignoring it.
  8. Secure the device itself with a strong device lockand current security updates.

VERIFY: Review the device list again and confirm that the devices associated with your account are ones you recognize and control.

Review connected applications and permissions

Applications and services can receive permission to interact with your Microsoft account, so review access you no longer need.

Click to see protection steps

Step-by-step

  1. Open your Microsoft account privacy or security settings.
  2. Look for applications, services or permissionsconnected to your account.
  3. Review the applications and services that have been granted access.
  4. Identify anything you no longer use or do not recognize.
  5. Review what access each service has before removing it.
  6. Remove unnecessary access where Microsoft provides that option.
  7. Do not approve access simply because an application asks you to do so urgently.

VERIFY: Review the connected applications again and confirm that the remaining services are ones you recognize and still need.

Protect Outlook email from suspicious requests

Because Outlook can contain password-reset messages, financial information and private conversations, unexpected requests deserve careful verification.

Click to see protection steps

Step-by-step

  1. Stop before responding to an unexpected request for money, passwords, codes or sensitive information.
  2. Check the actual sender and message details rather than relying only on the display name.
  3. Be cautious of messages claiming that your Microsoft account will be closed unless you act immediately.
  4. Do not give anyone your password, verification code or recovery code.
  5. Do not approve a sign-in request that you did not initiate.
  6. Avoid opening suspicious links or attachments simply because the message appears to come from Microsoft.
  7. Open your Microsoft account directly through a trusted route when you need to check your account.
  8. Report suspicious messages using the available Outlook controls.

VERIFY: Before acting on an important Outlook message, confirm the request through a trusted channel instead of relying solely on the message itself.

Review your account after suspicious activity

If you notice an unfamiliar sign-in, changed password, unexpected security information or other unusual activity, treat the account as potentially compromised.

Click to see protection steps

Step-by-step

  1. Stop sending sensitive information while you investigate.
  2. Open the Microsoft account Security page directly.
  3. Review Recent activity.
  4. Check your security and verification methods.
  5. Review the devices associated with your account.
  6. Change your password if you believe someone else may know it.
  7. Secure any other important account that uses the same exposed password.
  8. Use Microsoft's official account recovery or sign-in assistance if you cannot regain secure access.

VERIFY: Do not return to normal account use until you have reviewed the suspicious activity and confirmed that your security information and access methods are under your control.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
Outlook security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts