Skip to content
LatchkeyDaily
Subscribe

Lockdown guide · about 10 minutes

Lock down your Outlook or Microsoft account

By The Latchkey Daily Team, EditorsPublished Updated Verified January 19, 2027

What's at risk: Your Microsoft account is your email, your OneDrive files and often your Windows login. It resets everything else.

Verified against Outlook web and Microsoft account, January 2027.

You'll need: a password manager, Microsoft Authenticator.

One account a day

The Deadbolt series runs in the daily brief. Get the next guide tomorrow morning.

Free. Weekday mornings. Includes free access to In Case and Serum, the Latchkey tools. Unsubscribe in one click.

Step by step

  1. Open account security. Go to account.microsoft.com, Security. Everything below is here.
  2. Change the password. Security, Change password. Long, unique, saved in your password manager. Or choose "passwordless account" and sign in with the Authenticator app instead.
  3. Turn on two-step verification. Security, Advanced security options, Two-step verification, turn on. Use Microsoft Authenticator (or add a passkey) rather than text codes.
  4. Fix recovery options. Advanced security options, Ways to prove who you are. Remove any email or phone you do not recognize; add ones you control.
  5. Review recent activity. Security, Sign-in activity. If you see sign-ins you do not recognize, choose "Sign out everywhere" and change the password again.
  6. Check forwarding and rules. In Outlook on the web, Settings, Mail, Forwarding: off unless you set it. Then Rules: delete anything you did not create.
  7. Review app access. Account, Privacy, Apps and services; remove anything you no longer use.

Microsoft accounts carry a second risk beyond email: they are the name scammers use most in tech-support pop-ups. The account itself can be locked down in ten minutes; the pop-up is beaten by the rule that Microsoft never calls and never needs to connect to your computer.

Do this for a parent

  1. Set up Authenticator on their phone and choose the passkey or number-match sign-in; nothing to type, nothing to read to a caller.
  2. Add your email as a recovery option.
  3. Show them how a real Microsoft message looks and the rule: Microsoft never calls about a virus.

The whole set, in one afternoon: the Family Setup Kit.

If you get locked out

  1. Go to account.live.com/acsr to recover from a device you have used before; the more familiar the device, the better.
  2. If a scammer set recovery details, keep working the form; it may take more than one attempt.

Questions people ask

Is a passwordless account safe?
Yes. There is no password to steal or phish; sign-in is approved on your phone. It is the setup Microsoft recommends for most people.

Related

  • Guide

    Lock down your Gmail account

    Your email is the master key. Anyone inside it can reset the password on your bank, your Amazon and everything else.

  • Guide

    Lock down your home Wi-Fi router

    The router is the front door for every device in the house, and most are still on the password printed on the box.

  • The scam this stops

    The tech support scam

    The tech support scam is a pop-up, call or email claiming your computer is infected or a subscription is about to renew, which leads to a "technician" taking remote control of your computer and either charging for fake repairs or using the access to get into your bank.

  • The scam this stops

    The recovery scam

    The recovery scam targets people who were already scammed, with a call or message from a "lawyer," "recovery agency" or "government investigator" offering to get the lost money back for an upfront fee, which is itself the scam.