IT Life-Raft
+44 (0)1743 668200social@itliferaft.co.uk

Microsoft account recovery guidance

Microsoft Account Hacked? Start With The Right Recovery Route.

A personal Outlook.com account and a work Microsoft 365 account need different recovery steps. First, use a safe device and work out which type of account is affected.

Get remote recovery helpChoose your recovery route

Before you reset anything

Secure the account that controls the rest.

Microsoft accounts often control password resets, email, files and applications. If an attacker still has access, they may change recovery details, add their own authentication method or watch for a financial opportunity.

Use a separate trusted device. Go to Microsoft directly rather than using a link in an email or message. If you are not confident following the steps, use the recovery help route instead.

Choose the right route

Is this a personal account or a work account?

Follow the column that best matches the account. The final checks apply to both.

Personal Microsoft account

Outlook.com, Hotmail, Live, personal OneDrive or personal Microsoft 365.

  1. 1

    Use a device you trust

    Do not change passwords from a computer or phone you think may be infected or controlled by someone else.

  2. 2

    Secure the main account

    Go directly to Microsoft account security, change the password and remove any recovery email address, phone number or sign-in method you do not recognise.

  3. 3

    Sign out other connections

    Use the account security settings to make devices sign in again. This helps end existing sessions.

  4. 4

    Check Recent activity

    Look for unknown sign-ins, locations, browsers or apps. Note the earliest suspicious date before removing anything.

  5. 5

    Check Outlook and OneDrive

    Look for forwarding, inbox rules, deleted messages, shared files and activity you did not make.

  6. 6

    Secure reused passwords

    Change any other account that used the same or a similar password. Use a different password for every account.

Microsoft password reset →

Business Microsoft 365 account

Work email, Teams, SharePoint, business OneDrive or company administration.

  1. 1

    Tell your IT support first

    A work Microsoft 365 account may give access to email, Teams, SharePoint, OneDrive and other company systems. Follow your incident process and check cyber-insurance instructions.

  2. 2

    Contain the account safely

    Your IT support should reset the affected account, revoke active sessions, check MFA methods and keep a record of what changed.

  3. 3

    Check mailbox changes

    Review forwarding, inbox rules, delegated access and sent items. Attackers may hide messages while watching an email conversation.

  4. 4

    Check sign-ins and administrator access

    Review sign-in activity, unfamiliar devices, risky permissions and administrator roles. Standard staff accounts should not have tenant administrator access.

  5. 5

    Check files, apps and payments

    Review OneDrive, SharePoint, connected apps, supplier conversations and bank-detail changes. Verify payment requests through a known phone number.

  6. 6

    Plan the follow-up

    Check whether data may have been exposed, preserve useful evidence, update affected devices and make sure a break-glass administrator account is available.

Microsoft 365 support for business →

Checks for everyone

Could someone still be monitoring your account?

Re-authenticate connected devices

Once you have regained access, use the Microsoft security settings to make connected devices sign in again. This resets existing account connections.

Review authentication methods

Check every recovery email, phone, authenticator app, passkey and backup method. Keep only methods you recognise and control.

Update every device

Install current Windows, app and security updates on desktops, laptops, mobiles and tablets. Then run a trusted security scan on affected devices.

Keep control after recovery

One unique password for every account.

Never re-use a password between Microsoft, email, banking, shopping or work services. A password manager makes this practical and reduces the chance that one stolen password opens several accounts.

Need help now?

Get help recovering a hacked Microsoft account.

Choose your area on Been Hacked Fix to reach the right recovery route for your location.

Get remote recovery help