After adding passcode and 2 verfication to my outlook acccount still getting sign-in from all over the world.?

Question

After adding passcode and 2 verfication to my outlook acccount still getting sign-in from all over the world.?

Mark A 0

After adding a passcode and 2-step verification to my Outlook account, I'm still getting sign-ins from all over the world.? Can't Microsoft stop external IP hacking my account?

Rob Koch 26,055 Reputation points Volunteer Moderator

2026-08-22T22:58:33.78+00:00

Your problem isn't really related to IP addresses; it's due to the fact that Microsoft allowed passwordless login ability typically using the authenticator app, which by its very nature means that account recovery processes must be performed using only the username (primary email address), typically followed by an authenticator notification. Unfortunately, attackers recognized the flaw here that by sending multiple false attempts to login themselves, they might eventually annoy or simply confuse a victim into allowing the request to login, giving up their own account in the process.

To resolve this issue, the only current solution other than switching entirely to passkeys and Windows Hello Face, Fingerprint or PIN (or similar controls for a phone) on the local devices is to hide the exposed email address alias from access.

Since you'll typically want to keep the current email alias for others to continue to send you messages, this means you'll need to add a new alias to your account, then make that new address primary while selecting 'Change sign-in preferences' to remove the old alias ability to be used for login, which effectively stops any future use of that original alias for login by you or attackers.

Manage how you sign in to your account

This is called 'security by obscurity', since the only thing keeping attackers from abusing the new alias is that they don't know it, but as long as you never use that new alias for email or anything else that might get exposed, it should remain unknown to anyone other than you and possibly those with direct access to your device(s).

Rob

1 answer

Your answer

Rob Koch 26,055 Reputation points Volunteer Moderator

2026-08-22T22:58:33.78+00:00

Your problem isn't really related to IP addresses; it's due to the fact that Microsoft allowed passwordless login ability typically using the authenticator app, which by its very nature means that account recovery processes must be performed using only the username (primary email address), typically followed by an authenticator notification. Unfortunately, attackers recognized the flaw here that by sending multiple false attempts to login themselves, they might eventually annoy or simply confuse a victim into allowing the request to login, giving up their own account in the process.

To resolve this issue, the only current solution other than switching entirely to passkeys and Windows Hello Face, Fingerprint or PIN (or similar controls for a phone) on the local devices is to hide the exposed email address alias from access.

Since you'll typically want to keep the current email alias for others to continue to send you messages, this means you'll need to add a new alias to your account, then make that new address primary while selecting 'Change sign-in preferences' to remove the old alias ability to be used for login, which effectively stops any future use of that original alias for login by you or attackers.

Manage how you sign in to your account

This is called 'security by obscurity', since the only thing keeping attackers from abusing the new alias is that they don't know it, but as long as you never use that new alias for email or anything else that might get exposed, it should remain unknown to anyone other than you and possibly those with direct access to your device(s).

Rob

Answer 1

Unsuccessful sign-in attempts from many locations do not mean attackers are getting into the account. Anyone who knows the email address can try to sign in from anywhere, but with a strong password and two-step verification enabled, the account is better protected.

What to do next:

Check recent sign-in activity.
- Go to the My sign-ins page in the Microsoft account portal and review the activity.
- Look for whether the attempts are successful or unsuccessful.
- If they are unsuccessful, that indicates the protection is working.
If any sign-in is successful and not recognized, change the password immediately.
- Then update security settings in Security info.
Be careful interpreting location data.
- Microsoft notes that location is approximate and can be inaccurate, especially on mobile networks.
- Review the browser, operating system, and app details too, not just the map location.
Make sure multiple verification methods are available.
- Keep more than one verification method configured so sign-in and recovery remain possible.
If repeated sign-in attempts continue, keep monitoring rather than expecting Microsoft to block every external IP.
- The context supports reviewing sign-in history and securing the account with password and MFA, but does not describe a user option to block individual attacker IP addresses for a personal Outlook/Microsoft account.

If there are sign-in problems, blocks, or unusual activity warnings:

Try another verification method if one is blocked.
Avoid repeated attempts, because high-volume retries can trigger temporary blocks.
If needed, use the Microsoft sign-in helper.

References: