A tool for managing user identities, credentials, and access across on-premises and cloud environments
If the security code is being sent to an unknown address, the supported recovery path is to recover the Microsoft account or use the hacked-account flow.
- Start with the hacked account recovery process. It guides by email address or phone number and can either provide self-help or offer the chance to talk to an agent.
- Before changing the password, run a full malware scan on the PC used with the account:
- Open Virus and threat protection
- Select Scan options > Full scan > Scan now
- After the scan, try to change or reset the password.
- If sign-in works again, immediately review the account security:
- Go to Security basics
- Select Review activity and mark suspicious sign-ins as This wasn't me or Secure your account
- Change the password again if needed
- Check connected accounts, forwarding, and automatic replies
- If the code cannot be received because the listed security info is no longer accessible, select I don't have any of these during sign-in and follow the prompts.
- If the normal recovery form was already rejected for not having enough details, read the guidance for the recovery form and submit it again with as many accurate details as possible.
- If the account is locked due to suspicious activity or Terms of Use review, sign in at https://account.microsoft.com. If Let's prove you're human does not appear, use the aka.ms/ link shown in the lock message to submit the reinstatement request. Do not submit multiple requests, because that can slow the response.
A full reset of the account is not described as a self-service option in the available guidance. If recovery and reinstatement fail, support agents also cannot send password reset links or change account details directly.