how do i find full sign in activitiy& history for all devices in my mircosoft account?

Question

how do i find full sign in activitiy& history for all devices in my mircosoft account?

Wendy C 0

my outlook was hacked yesterday i could see devices that were logged into my account. i changed my password. today i dont see any history of the scammers devices that logged in. i desperatley need to see them to prove how someone took thousands of dollars from me.

i dont understand tha select child tag. i might have picked the wrong one

0 comments

2 answers

Your answer

Answer 1

Adam Zachary 2,265

Typically this is one of the most confusing parts of a Microsoft personal account, because the sign-in history you see on the security page is limited and may not always show older devices once you change your password or remove a session. For personal Outlook.com / Microsoft accounts, all available sign-in activity is found at this page:

https://account.microsoft.com/security

From there you can open ‘Review recent activity’ to see sign-ins, locations, devices, and any unusual access. If a hacker logged in, that’s where it will appear. But once you change your password and force a sign-out, some old sessions may disappear from the list, which is why you might not see yesterday’s entries anymore.

If you need the information for a fraud or police report, the safest option is to contact Microsoft Account Support directly. They can review the account at a deeper level than what the public page shows and can confirm whether suspicious access took place, even if it no longer appears in your dashboard

linda caufield 0 Reputation points

2026-08-12T18:01:45.29+00:00

Thank you. I did find that a hacker logged into my account yesterday from Florida - I live in Idaho. I read several places where Microsoft wants me to report this to them directly, but I have been unable to find a way to successfully do that. Since most of my account is intact, and I have changed my password, I don't think I qualify for an account restoration. I just want them to look deeper so a can make a determination of what harm was done. Also, any recommendations on what entity I should report this to? Thanks again.
Rob Koch 26,070 Reputation points Volunteer Moderator

2026-08-12T19:45:19.6166667+00:00

Linda, you should have opened your own new question to ask this so it would receive prompt attention, not replied to an earlier thread you found via search, by selecting the 'Ask a question' button at the top right-hand corner of the page above.

If you discovered someone other than yourself had attempted to login to your account via a notification email or text from Microsoft, successful or not, it should have directed you to the page link below that describes how to notify Microsoft that the login attempt wasn't actually you, which is all you need to do since Microsoft already knew it was suspicious if they notified you, so this act by you confirms this actually wasn't you.

What happens if there's an unusual sign-in to your account | Microsoft Support

The best way to communicate with Microsoft is always through your account, since that's directly associated with you and so anything logged or selected there is automatically associated with you as well.

It's also why properly securing your account with as many alternate types of verification as possible and responding promptly to Microsoft notifications of potentially suspicious account activity are so important, since these are really the only way that Microsoft's automated systems can best protect your account as well, since no one within Microsoft really knows who you are or anything else about you, because they don't typically have direct access to your account or personal information in order to protect you.

How to help keep your Microsoft account secure | Microsoft Support

If someone managed to at least discover your account's email address, if not also password, it's possible that it was exposed in a publicly known breach of a business or similar listing of account information. To try and determine whether this occurred, you can go to the following website and safely enter your email address in the box on the main page displayed to see a listing with details of the personal information exposed if any.

Have I Been Pwned: Check if your email address has been exposed in a data breach

You can also select the Passwords item on the top menu bar on that same page and enter each of your most important passwords to confirm whether they have been exposed in breaches, which means they're typically being used in 'bot' attacks that attempt to breach other known account email addresses, especially if you've personally used that same password before on any of your own accounts that may have been breached.

Though if your email address is relatively simple such as myname at outlook [dot] com, it's possible someone else with a similar name (or possible misspelling) simply tried to login to your account, but if it's been in a known breach as described above, it's highly likely it's being regularly attacked in an attempt to steal it for resale or other abuse. This has become big business for both nation states (think recent wars) or criminal gangs worldwide looking to monetize personal accounts by reselling the personal or financial information and paid products they may contain or abuse them to attack your personal contacts or send spam email.

So yes, everyone is a target in today's connected world.

Rob
linda caufield 0 Reputation points

2026-08-12T23:23:01.6866667+00:00

Thank you, Rob for assessing my post and for the feedback. The website you recommended has been helpful, and I will be taking further measures to secure my account. Just for the record, I made several attempts to report this to Microsoft. They did not make it easy. And while they acknowledged the breach on the report I tracked down, they never advised me directly, nor have they contacted me since. As far as a warning about the "unusual activity", it came in a generic and unflagged email an hour after the breach had occurred. Between stumbling on the Physical Activity Page and helpful responses from you and others at this page, I have learned I need to know more. I do have the 2 way verification process in place and will follow up on your recommendations for better security. Thank you again.

Answer 2

To find the full sign-in activity and history for all devices associated with your Microsoft account, you can access the activity logs in the Microsoft Entra admin center. Here are the steps you can follow:

Log into the Microsoft Entra admin center: Use your Microsoft account credentials to sign in.
Access Activity Logs: Navigate to the activity logs section, where you can view sign-in attempts and activities associated with your account.
Filter Logs: You can customize and filter the logs based on specific criteria such as date range, user, and client app to narrow down the results to the relevant sign-ins.
Review Sign-in Details: Each sign-in attempt will provide details about the user, the client used for access, and the resources accessed. You can also check for any unusual activity or devices that were logged in during the time your account was compromised.

If you need to investigate specific sign-ins further, you can utilize the unique identifiers provided in the logs to correlate activities and gather more information about the sign-ins that occurred.

If you are unable to find the information you need or if the logs do not show the expected details, consider reaching out to Microsoft support for further assistance in recovering your account activity history.

References: