How to Remove Unknown Devices from Your Microsoft Account (and Lock Out Whoever Added Them)

To remove an unknown device from your Microsoft account, sign in at account.microsoft.com/devices, find the device you don't recognise, select Remove device, tick the confirmation box and select Remove. For a phone or tablet, go to account.microsoft.com/devices/android-ios and select Unlink. Removing a device only takes it off the list, though. It doesn't sign it out. If you think someone else is using your account, change your password, use Sign out everywhere and turn on two-step verification as well.

Finding a PC called DESKTOP-something in your device list that you've never seen before is unsettling. I've had that moment myself. Most of the time it turns out to be an old laptop or a family computer I signed into once. Sometimes it isn't, and then speed matters.

This guide walks you through working out which one you're dealing with, removing the device properly, and locking your account down so it can't happen again. It's part of my Windows security guides series.

In this guide:

• First, check if the device really is unknown
• Step 1: Check your recent sign-in activity
• Step 2: Remove or unlink the unknown device
• Why removing the device isn't enough
• Step 3: Scan your PC, then change your password
• Step 4: Sign out of your Microsoft account everywhere
• Step 5: Turn on two-step verification
• Step 6: Check what else an intruder could have changed
• What to do if a hacker was in your account
• If the unknown device keeps coming back
• Keep your account clean from now on
• Frequently asked questions

First, check if the device really is unknown

Before you panic, rule out the innocent explanations. Windows 10 and 11 PCs are added to your device list automatically whenever you sign in with your Microsoft account, so devices pile up over the years without you noticing.

Select Show details on any device to see its manufacturer, model and when it was last seen. If the details match something you own or used to own, you can simply remove it as housekeeping. If nothing fits, treat it as suspicious and work through every step below.

Step 1: Check your recent sign-in activity

Don't remove the device just yet. Look at your sign-in history first, because it tells you whether someone has actually been using your account.

1. Go to account.microsoft.com/security and sign in.
2. Open the Sign-in activity or Recent activity page.
3. Expand each entry to see the date, location, IP address, device type and browser or app.
4. If there's an Unusual activity section, open each item and choose This was me or This wasn't me.

Microsoft's page explaining what the Recent activity page is says it covers the last 30 days. It also warns that mobile networks route traffic through different places, so a phone sign-in can look like it came from another city. A slightly wrong town isn't a red flag on its own. A successful sign-in from another country while you were asleep is.

Choosing This wasn't me starts Microsoft's own protection process, which will ask you to change your password and update your security info. That's what you want if the activity wasn't yours.

Step 2: Remove or unlink the unknown device

Now remove it. There are three slightly different options, and they don't all do the same thing.

To remove a PC:

1. Sign in at account.microsoft.com/devices.
2. Find the device and select Show details.
3. Select Remove device (sometimes under More actions).
4. Tick the box confirming you're ready to remove it, then select Remove.

For a phone or tablet, go to the android-ios page instead and select Unlink. Microsoft's guide to managing devices used with your Microsoft account has the official steps for each type.

Why removing the device isn't enough

This is the part most guides skip, and it's the reason people find the same device back on their list a week later.

The device list is a record of devices tied to your account. It isn't a list of active logins. Removing an entry doesn't change your password and doesn't end any session. If someone signed in on that device with your password, they can simply sign in again, and Windows will add the device right back.

So if the device really is unknown, removing it is housekeeping, not protection. The protection comes from three things together:

• A new password the intruder doesn't know
• Ending every existing session
• A second sign-in step they can't pass

If you only do one thing today, change your password. Make it long and unique to this account. A reused password is the most common way strangers get into accounts in the first place. My guide on how to create a strong password explains what actually makes a password hard to crack.

Step 3: Scan your PC, then change your password

Microsoft recommends scanning for malware first. If a keylogger is on your PC, it would capture your new password as you type it.

1. Open Windows Security from the Start menu.
2. Go to Virus & threat protection > Scan options.
3. Choose Full scan and select Scan now. Let it finish.
4. Go to account.microsoft.com/security and select Change password.
5. Enter a new password you've never used anywhere else, then save it in a password manager.

If you can't sign in because the password has already been changed, use Microsoft's password reset or sign-in helper. Microsoft's support agents can't send you a reset link or change account details for you, so ignore anyone who calls or emails offering to "fix" your account.

If you need a strong password quickly, my free password generator makes one in your browser without sending it anywhere. Use 16 characters or more.

Step 4: Sign out of your Microsoft account everywhere

Changing your password stops new sign-ins, but it's sensible to kick out any existing sessions too.

1. Go to account.microsoft.com/security and open Advanced security options.
2. Scroll down to Sign out everywhere.
3. Select Sign out and confirm.

According to Microsoft's page on how to sign out of your Microsoft account everywhere, this signs you out of browsers, apps and anywhere else the account is used within 24 hours. The one exception is Xbox consoles, which you need to sign out of separately.

Expect some inconvenience. Outlook, OneDrive, Teams and the Microsoft Store will ask you to sign in again on your own devices too. That's the price of being sure the intruder is out.

Step 5: Turn on two-step verification

Two-step verification means a stolen password alone isn't enough to get in. Anyone signing in on a new device also needs a code from your phone, email or authenticator app.

1. Go to account.microsoft.com/security.
2. Select Manage how I sign in.
3. Under Additional security, find Two-step verification and select Turn on.
4. Follow the prompts. I recommend the Microsoft Authenticator app over text messages.

Two warnings from Microsoft's own help pages. First, Microsoft has said it will start phasing out SMS as a sign-in and recovery method for personal accounts, so an authenticator app is the safer long-term choice. Second, with two-step verification on, losing your security info can lock you out for 30 days. Microsoft suggests having three pieces of security info on the account, such as a backup email, a phone number and the app.

You can go further and remove your password entirely with a passwordless account, signing in through the Authenticator app, Windows Hello or a security key. For a plain-English walkthrough of how these methods compare, see my guide on how to set up two-factor authentication.

Step 6: Check what else an intruder could have changed

Attackers often leave something behind so they can get back in. Spend five minutes checking these:

• Security info: in Advanced security options, remove any phone number or email you don't recognise. If you see "security info change is still pending", someone replaced your security info, and the account sits in a 30-day restricted state.
• App passwords: also in Advanced security options. Remove any you didn't create. Older apps use these to bypass two-step verification.
• Apps with access: at account.microsoft.com/privacy/app-access, remove permissions for apps you don't use or recognise.
• Outlook.com rules: check forwarding, automatic replies and inbox rules. A forwarding rule quietly copies your mail to an attacker.
• Payment and orders: look for purchases or subscriptions you didn't make.

Microsoft only sends genuine security alerts from account-security-noreply@accountprotection.microsoft.com. Fake "unusual sign-in" emails are a common phishing trick, so check the sender before you click anything.

What to do if a hacker was in your account

If recent activity showed sign-ins that weren't you, or the attacker changed your password, act in this order:

1. Run a full antivirus scan on every PC you use.
2. Change or reset your password. If you can't sign in, use Microsoft's sign-in helper and, if that fails, the account recovery form at account.live.com/acsr. Fill it in from a device and location you normally use.
3. Sign out everywhere and turn on two-step verification.
4. Check Outlook forwarding, automatic replies and connected accounts. Microsoft resets some of these settings after a compromise, but check anyway.
5. Change the password on any other account that used the same password.
6. Tell your contacts not to trust strange messages "from you" sent during the break-in.

Microsoft's guide to recovering a hacked or compromised Microsoft account walks through the recovery tools in detail.

Be honest with yourself about one risk. If the attacker turned on two-step verification with their own phone, recovery can be slow and isn't guaranteed. That's another reason to set it up yourself before anyone else does.

If the unknown device keeps coming back

A device that reappears after removal is telling you something. Here's what usually causes it:

While you're checking your account, it's worth checking your own PC for local break-in attempts too. My guide on checking failed login attempts on Windows shows how to read Event ID 4625 in the Security log.

Keep your account clean from now on

Once everything is locked down, a short habit keeps it that way:

1. Every few months, look at account.microsoft.com/devices and remove anything you no longer own.
2. Rename new PCs straight away in Settings > System > About > Rename this PC, so you'll recognise them later.
3. Remove your account from a PC before you sell, give away or reset it.
4. Use a private browser window on shared or public computers, and sign out when you're done.
5. Keep your security info up to date whenever you change phone number or email.

Your Microsoft account email is also a target in data breaches. My guide on how to check if your email was breached shows how to find out whether your address and an old password are already circulating.

Frequently asked questions

Does removing a device from my Microsoft account sign it out?

No. Removing a device only takes it off the device list. Anyone signed in on it can carry on, and the device can reappear the next time it signs in. To end sessions, change your password and use Sign out everywhere in Advanced security options.

Why is there a device I don't recognise on my Microsoft account?

Usually it's a PC you signed into once and forgot, an old computer, an Xbox, a work laptop, or your own PC after a reinstall or rename. Windows 10 and 11 PCs are added automatically when you sign in. If the details don't match anything you've used and your recent activity shows strange sign-ins, treat it as unauthorised access.

How long does Sign out everywhere take?

Microsoft says it can take up to 24 hours to sign you out of browsers, apps and other places your account is used. It doesn't sign you out of Xbox consoles, which you need to do on the console itself.

What is the difference between Remove and Unlink?

Remove device takes a PC or Xbox off your account's device list. Unlink is used for phones and tablets, and on the content page it frees one of your 10 Microsoft Store download slots. Neither option changes your password or ends active sessions.

Can someone use my Microsoft account without my password?

Not normally. They need your password, a sign-in method such as a security code, or a session that's still active on a device you used. That's why changing your password, signing out everywhere and turning on two-step verification together are what actually lock someone out.

Can Microsoft tell me who added the device?

Microsoft doesn't reveal another person's identity, but your Recent activity page shows the date, location, IP address, device type and browser for sign-ins in the last 30 days. That's usually enough to tell whether it was you, someone in your household or a stranger.

Should I close my Microsoft account if it was hacked?

Usually not. Securing it with a new password, two-step verification and a clean set of security info is enough, and closing it would cost you any purchases, email and OneDrive files. Recover and secure the account first, then decide.

Last checked: 25 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.