Securing Guide

Head to account.live.com/password/reset.

Input the email from your account format, then click "Next".

Microsoft will offer you a couple of recovery options, but none of them are yours yet, so click "I don't have any of these" at the bottom of the page.

Paste the recovery code from your account format and click "Next".

Choose a strong new password and a new security email you control (a personal Gmail / Outlook works fine). Submit the form to finalize the takeover.

Sign in to login.live.com with your new password, then open the Devices tab. Click "Sign out everywhere" and remove every device you did not add yourself. This kicks any pre-existing sessions instantly.

Open the Activity page in a new tab and skim the last few entries. If you see a sign-in from an unfamiliar country right after your takeover, report it on the same page so Microsoft locks the account against that IP.

Some stolen accounts have hidden rules that forward every incoming email to a third party. Go to Outlook forwarding settings and disable any active forwarding address.

Open Manage how I sign in and delete every phone number, security email, and authenticator app that is not yours. You added a fresh recovery email in Section 1 - keep that, drop everything else.

Visit App access and revoke every connected app you do not recognise. Old OAuth grants can be used to bypass password changes, so remove them all and re-authorize the ones you actually use.

Back in your security settings, click "Generate a new code" under Recovery code. Save the new code somewhere offline. This invalidates the original recovery code that came with your account, so nobody else can re-enter with it.

In the same security panel, turn 2FA back on and bind it to an authenticator app you control (Microsoft Authenticator, Aegis, 2FAS, any of them work). This is the final seal against future takeover attempts.

Open your Minecraft profile to verify the in-game name and (if applicable) cape are intact. From this page you can also change the username after the standard cooldown.