What is the recent activity page?


The recent activity page shows info about when and where you've used your Microsoft account within the last 30 days. This includes any time that you signed in to your account, whether you used a web browser, your phone, an email app, a third-party app, or another method. See your recent activity.

What info is available?

For each activity, the recent activity page lists the date and time, location, and type of activity. Keep in mind that if you use a mobile device, your location may not be reliable. This is because mobile phone services route your activity through different locations. This can make it look like you signed in from somewhere you're not.

You can click any activity to expand it and see additional details, including:

  • The IP address of the device on which the activity occurred
  • What type of device or operating system was used
  • What internet browser or type of app, if any, was used

How do I use this page?

We pay attention to how you tend to use your account, and will let you know right away if we think something is unusual. On the recent activity page, we divide your activity into two groups: Unusual activity and Recent activity.


Manage your unusual activity

If there is unusual activity on your account, we should already have notified you through email. Review the session and decide This was me or This wasn't me.

When you tell us that you don't recognize an activity, it's possible that a hacker or malicious user has gotten access to your account. Once you select This wasn't me, we'll walk you through several steps to help protect your account. This includes changing your password and updating your security info.

If we accidentally flag your activity as unusual, make sure you let us know that it was you. For example, this might happen if you use your account on vacation, get a new device, or allow an app to sign in as you.

Manage your recent activity

You should recognize most of the account activity in this section. If you know that you didn't initiate one of them, or if you see a suspicious pattern (like multiple sign-in attempts or profile changes to you didn't make) you can always let us know by selecting Secure your account.

What if some recent activity doesn't show up?

You might notice that not everything you do with your account is tracked on this page. We try to focus on the most significant events to help you keep an eye on your account security. That means that if you sign in from the same device and location several times in a row, we might only track the first time. Similarly, if you check the Keep me signed in box we won't track your everyday activity until something changes.

What are the different session types?

This table explains all the activities that are tracked in the recent activity page.

 Session type What it means
Account created  A Microsoft account was created.
Account name changedThe name that identifies you in the Microsoft products and services you use has changed.
Additional verification requestedAs an extra authentication step, you received a security code by text, email, or authenticator app.
Alias added;
Alias deleted;
Primary alias changed
An alias is an additional email address that uses the same inbox, contact list, and account settings as the primary alias (email address) for your Microsoft account. Learn more about aliases.
All security info marked for removalAll the security info for your account (like alternate email addresses, phone numbers, and authenticator apps) was scheduled to be removed. Learn more about replacing security info.
Alternate email added;
Alternate email deleted;
Identity verification app added;
Identity verification app deleted;
Phone number added;
Phone number deleted;
Recovery code added
A piece of security info for your account was added or deleted. Learn more about security info.
App password created;
App password deleted
App passwords are used for apps or devices that don’t support two-step verification. Learn more about app passwords.
Incorrect password enteredSomeone tried to sign in to your Microsoft account with the wrong password. We didn't allow this sign-in. (This might have been you, if you forgot your password—or it might have been someone else trying to access your account.)
Password changedYour Microsoft account password was changed. If you didn’t do this, you should reset your password.
Password resetYour Microsoft account password was successfully reset.
Permission given to an applicationYou allowed another application to access your Microsoft account.
Profile info changedProfile info such as your name, birth date, gender, country/region, or ZIP/postal code was changed. Update your profile info.
Sign-in blocked (Account compromised)We think that someone else accessed this Microsoft account. We required additional verification and a password change.
Sign-in blocked (Account temporarily suspended)We noticed suspicious activity on your account, so required additional verification to unblock it.
Successful sign-inSomeone signed in to your Microsoft account with the correct password. (This was probably you.)
Two-step verification turned on;
Two-step verification turned off
Two-step verification uses two ways to verify your identity whenever you sign in. You can turn it on or off whenever you want. Learn more about two-step verification.
Unusual activity detectedSomeone signed in to your account with the correct password, but from a location or device that we didn't recognize. We sent you a notification and required an extra security challenge. (This might have been you, but we weren't sure.)

Email protocols

Email apps and webmail services use different protocols, or communication formats, to access your account. You might see one or more of the following protocols listed in your recent activity:

Exchange ActiveSync: Syncs email, calendar, and contacts between your devices and your Outlook.com account.

Post Office Protocol 3 (POP3): Allows an app or service to access email messages in your inbox.

Simple Mail Transfer Protocol (SMTP): Allows an app or service to send email.

Internet Message Access Protocol (IMAP): Allows an app or service to access all email (in all folders) and sync email across your devices.


Properties

Article ID: 13782 - Last Review: Oct 25, 2016 - Revision: 51

Feedback