Windows 10: Unrecognized Login from Microsoft Azure? Compromised Account?

Hi All.


I never thought I would post here, but given the extraordinarily suspicious and unusual circumstances, and the inability of Microsoft Support to truly enter into detail on these issues due to account security restrictions over chat/phone, I have to post here.


A couple days after the New Year of 2019, I tried to login to my Microsoft account, only to find out I had forgotten my password.


Derp.


I had to completely revise my security information on my Microsoft account after miraculously logging in without either a recovery code or second-form factor authenticator available in the process, as my phone's SIM card had failed. Before I had successfully logged in to update everything though, I triggered a security information account review (which MS says takes approximately 30 days) with my logins through the account information recovery page, as I had forgotten my own password.


Long story short, password got changed, I got rid of two-factor authentication, and the Microsoft Authenticator app linked to my account (by deleting it straight from the app on the mobile device). I also security details to include a newly created third-party email address to my Microsoft account.


Thought everything was solved.


Then today I'm snooping around on my recent activity page under accounts.microsoft.com, and I find 2 "successful logins" that happened roughly 20 hours apart, exactly 1 week ago, not even with some form of verification that was used, each from an "Unknown" Device/Platform, from an "Unknown" Browser/App. The IP addresses (not listed here) both are tied to a domestic, Microsoft Azure managed servers after looking them up. But the locations are quite odd far away and odd, 1 of them having been a place I once was at within the past year.


What surprises me utterly is how this happened, given that the logins were AFTER my whole debacle detailed above about changing my password. They happened without even warning or an "unusual/suspicious activity" email from Microsoft. Could these have been associated to the security information audit I requested from Microsoft when I had failed to remember my password in trying to login earlier in the year? Could this be associated to something that happened when I activated a new device on the same day that these logins happened? I need answers, because frankly I refuse to believe my device is "hacked" as Microsoft warned me today when I changed the password yet again, and I never saw these sort of strange logins going on before.


Note that at the time of these instances, I was never using a mobile app or service on a third device for any Microsoft products whatsoever.

:)

 

Move Azure Microsoft Account to Organizational Account

I'm deeply disappointed with Microsoft support and how confusing all the various Microsoft and Organization account options are.

I have recently installed Windows 10 and log in via an Organizational Account.

I already use the Azure portal but with a Microsoft account.

How can I merge/transfer the accounts so that I can access my Azure VM's via the Organizational Account?

I found a page that said I should log a request in Azure to fix the issue. Only to find that I could not log a help request via 'Microsoft Azure>

«

Help + support>New support request >Subscription'.

The functionality was broken..

Help please?

 

Microsoft Account compromised

Hello Ade,

Thank you fo rposting your concern in Microsoft Community and welcome to the windows 10 Family.

From the description provided, I understand that the Microsoft Account you are using has been compromised which resulted in several security features barring you from making essential changes (including login).

If you are unable to access your primary account, you can use an alternate account (if you have one) or create a new one at https://signup.live.com

If it still does not help, follow the below steps and check if it helps.

• Sign in to your Microsoft account.
• Do one of the following:

A. If you can still sign in to your Microsoft account, you should change your password immediately. This will prevent anyone who knows your password from accessing the account. On the
Security & privacy page, tap or click Change password and then follow the instructions.

B. If you can't sign in to your account, your password may have been changed. Tap or click
Can't access your account? Select I think someone else is using my Microsoft account, tap or click
Next, and follow the instructions.

You can also go directly to the
Reset your password page, and follow the instructions.

Refer: Get back into your Microsoft account if it's been compromised

Write to us with the updated information for us to be able to assist you further.

Thank You.

 

Convert online Microsoft Azure account to local account?

Unfortunately, you cannot switch an Azure AD account to a local or Microsoft account. You need to create a new user account first, make it an admin account, then disconnect from your organizational account, restart and sign in to new local account.

All software remains installed and intact but all user specific customizations and settings are lost, new local user starting from scratch with default settings.

The whole process step by step:

1.) Copy your personal data (documents, images etc.) from current Azure AD user profile folder to respective folders in C:\Users\Public

2.) In Settings > Accounts > Other people, add a new local user (see Option One in this tutorial)

3.) Check that everything is correct, that you will see your Azure AD account under Work or school users (yellow highlight), and your new local admin account under Other people (blue highlight):





4.) Select Access work or school on left pane, select the connected Azure AD domain, click Disconnect:





5.) Click Yes:





6.) Click Disconnect:





7.) Enter the username and password for your new local admin account, click OK:





8.) Click Restart now:





9.) When back on desktop with your new local admin account, move personal data from Public folder and its subfolders you backed up in step 1 above to respective subfolders on new user profile folder. If the old Azure AD user profile folder is still present in Users folder, it can be deleted now.

That's it.