Windows 10: MS Account Compromised

I received an alert this morning on my Android MS Authenticator app about unusual activity - a sign in attempt from Indonesia that was unsuccessful. My password has been compromised it seems it's an old password I should have already changed so I immediately changed it to a new stronger password. Looking through recent activity there are a number of successful logins from Russia and Indonesia despite having 2FA enabled, reading the activity page they appear to have bypassed 2FA. I have never been to nor logged in via VPN from these countries, this is 100% not me.


MS services I use include Xbox, Office365, Azure, OneDrive.



Given my current situation I have a few questions:


1. How can I check any current logged in sessions on my account, and forceably sign any out if needed? unless changing my password does this automatically there is no 'this wasn't me' button for entries not under unusual activity, and that button just tells me to change my password anyway


2. How can I check for purchases/financial activity on my account across all MS services on 1 page?


3. How can I check for any security changes these attackers may have made? Obvious settings I have checked look fine so far


4. How have they successfully logged in when I have 2FA enabled!? Authenticator app, phone number and alternative email received no message, I can see one of their sign ins 'resolved unusual activity' - why did I receive no alert for this?


Any advice for other areas to check for activity or changes would be greatly appreciated.

:)

 

Remove account

I suggest you backup your personalized files first before removing the account.
To delete an account, follow these steps:

1. Press WIN + X keys and click Command Prompt (Admin) from the menu.
2. Type the following command and press Enter. Replace test with the name of your sister's account. Code:

 

Compromised Microsoft account

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that your query regarding Microsoft account. I’ll certainly assist you with the details.



As you have mentioned that your account has been compromised, I would suggest you to refer the article on
How to recover a hacked or compromised Microsoft account, which
will help you in recovering your account.



For additional information, refer
Reset or recover your Microsoft account.



If you still face issues, do not worry, you can certainly get in touch with our Microsoft account by following the article on

Get account help by email or you can
Chat with Microsoft support.



Regards,

Nikhar Khare

Microsoft Community - Moderator

 

My Microsoft Account is compromised

My Microsoft Account is compromised. Recently I have found out that somebody is trying to access my data. This person created a Microsoft account on another computer and is tracking my moves using browsing history. Please suggest a way to delete all my
accounts and log-ins