What an unauthorized security info replacement means
If the security information on a Microsoft account is replaced without the owner’s knowledge, the account enters a defined holding period. That period is not a formality: it is the window in which the real owner can notice the change and respond.
Replacing all Microsoft account security information puts the account into a restricted 30-day state. Source
Microsoft sends notifications to the original security contact methods during that period. Source
Because notifications go to the original contact methods, an owner who still controls those methods has a route to see what happened. An owner who no longer controls them faces a harder problem, and this guide does not pretend otherwise.
First, decide which situation you are in
Use this checklist before taking any action. The right steps depend on whether you received an alert and whether the change was yours.
| Situation | What you are seeing | What to do first |
|---|---|---|
| You requested the change | You replaced security info yourself and received a notice | No report needed. Keep your recovery methods current and expect the restriction period to run its course. |
| You did not request the change | An alert arrived at an original contact method about a security info replacement | Use the official reporting route in that alert. Do not wait for the period to end on its own. |
| You did not request the change and received no alert | You suspect a change but have no notification | Check whether you still control the original contact methods. If you do not, you cannot rely on the alert route and should treat access to the account as the open question. |
| Someone else asked you to report a change | A third party says a change happened and offers to “fix” it | Do not act on instructions from that party. Use only the notification Microsoft sent to your own contact methods. |
How to report the change through the official alert
- Open the notification Microsoft sent to your original security contact method. This is the alert generated by the pending change, not a message forwarded by anyone else.
- Read the pending-change window details. The window describes the restriction and the reporting option available during it.
- Use the let us know link in that window to report that you did not request the change.
If the owner did not request the change, the pending-change window offers a let us know link for reporting it; Microsoft does not expedite the waiting process. Source
- Keep the original notification. Do not delete the email, message or alert. It records what was changed, when the notice arrived and which contact method received it.
- Do not attempt to shorten the waiting period through support requests or repeated reports. The process does not speed up on request.
What not to do
- Do not hand account details, codes or recovery information to anyone who contacts you about the change, even if they claim to be helping.
- Do not treat a changed profile, photo or display name as proof that the account is secure or that the change was reversed. Appearance is not the same as account state.
- Do not assume that removing a login connection or editing visible profile information deletes stored data or completes a security review.
- Do not rely on a username search to recover an account, reveal connected logins or change platform settings. A public-handle scan reviews public handles only; it is not an account recovery tool.
- Do not report the change through unofficial forms or third-party “unlock” services. The approved route is the one in the notification itself.
What the 30-day restriction does and does not do
The restriction is a waiting state, not a resolution. It gives the owner time to notice the change and report it. It does not, by itself, restore the original security information, and Microsoft does not shorten it on request.
If you still control the original security contact methods, you will receive the notification there. If you do not, the alert route may be unavailable to you, and the practical question becomes how to regain control of the account through the platform’s own recovery process. This guide does not describe that process because the approved claims do not establish its steps.
A useful verification step
After you report the change, verify what you can verify:
- Confirm that the original notification is still in your possession and note the date it arrived.
- Confirm which original contact method received it, so you know which channel the platform considers yours.
- Check that you still control that contact method. If you do not, treat that as the priority problem, separate from the report itself.
- Do not expect a confirmation of resolution within a fixed number of days. No delivery or resolution deadline is established here.
Where this task ends and the next one begins
This guide covers one task: reporting a security info replacement you did not request, through the official alert route, while preserving the original notification. It does not cover finding every account tied to a phone number, handle or email address. If your next question is which accounts exist under an identifier you control, that is a different task with different limits.
For that separate question, see account inventory. Keep the two tasks apart: reporting an unauthorized change is about protecting one account, while an inventory is about reviewing what public handles exist. Neither task proves who controls an account, and neither should be treated as identity verification.