To check your Microsoft account activity, sign in to Microsoft’s Recent activity page and expand an entry to review its sign-in details. You can inspect significant security events from the last 30 days, including when and where the account was used and how it was accessed.
For a personal account, you can use a web browser; work or school accounts have separate activity pages and an Android Authenticator route. Sign in only through Microsoft’s own app or website, and never share a code, password, or remote access with someone who contacts you.
The short version
- Start here: Open Recent activity and sign in to the account you want to review.
- Inspect the details: Expand an event and compare its time, device, and app with your own activity.
- Report unfamiliar events: Under Unusual activity, expand the event and select This wasn't me when you do not recognize it or are unsure.
- Choose the right history: The privacy dashboard shows collected usage data rather than account sign-ins.
| Place or option | When to use it | What to do |
|---|---|---|
| Recent activity | Go straight to personal account security events | Sign in and expand an entry |
| Microsoft account dashboard | Start from your personal account home page | Open Security, then select See your sign-in activity |
| Security basics | Investigate a personal account sign-in alert | Select Review activity |
| Activity response controls | Confirm or report a personal account event | Expand the entry and choose the applicable response |
| Privacy dashboard | Review collected app and website usage | Review the available activity categories |
| Work or school account website | Review organizational account sign-ins | Select Recent Activity and expand an entry |
| Microsoft Authenticator on Android | Review a work or school account from the app | Select Recent account activity |
| Microsoft Entra sign-in logs | Investigate organizational activity as an authorized administrator | Open Sign-in logs and adjust the filters |
Open your recent account activity
Open the Microsoft account activity page in your browser and sign in to the personal Microsoft account you want to check. This takes you directly to Recent activity, where you can expand individual events.
If you start from the Microsoft account dashboard, sign in, open Security, then select See your sign-in activity. Expand the events you want to inspect. The Security basics route uses the label Review activity instead, so use the direct activity link above if the dashboard wording leaves you unsure where to go.
Read the details of each event
Expand an entry to see its location details and how the account was accessed, such as through a web browser or phone. For entries under Unusual activity, the expanded details also include the IP address, a map of the location, the device or operating system, and the browser or app. Compare those details with the devices and services you used around that time. Reading them together gives you more context than judging an event by its location alone.
Network routing can make the reported location misleading. Check the event’s time, device, and app before deciding how to respond. An unfamiliar location by itself does not establish that someone else accessed your account.
The activity window covers significant security events from the last 30 days. It is not a complete audit trail, so treat it as a review of those events rather than a record of every account interaction. For collected app and website usage, use the privacy dashboard instead.
Respond to activity you do not recognize
When your account has an Unusual activity section, expand the entry you want to review. If you recognize the event, select This was me. If you do not recognize it or are unsure, select This wasn't me.
Those confirmation controls appear only for expanded entries under Unusual activity, and that section appears only when applicable. For a suspicious entry in Recent activity, select Secure your account and continue through Microsoft’s account security steps.
Check an unusual sign in alert
After receiving an unusual-sign-in email or text alert, open Microsoft account security directly in your browser and sign in. Select Review activity to open your recent events. This lets you investigate the alert without following links in the message.
Find the event associated with the alert and expand it before choosing a response. Compare its details with your own activity, then use the applicable confirmation or security control. When the event is under Unusual activity and you remain unsure, select This wasn't me.
Review your work or school sign ins
For a Microsoft Entra work or school account, open My Account on Microsoft’s work or school account website and sign in with that account. Select Recent Activity in the left navigation pane, then expand each sign-in entry you want to inspect. This is a separate route from the personal Microsoft account activity page.
On Review recent activity, use Search to find an app, operating system, location, or status. For example, enter Unsuccessful to find entries with that status, then expand the entries to review their details.
Review activity through Authenticator on Android
In Microsoft Authenticator on Android, open the home page for your work or school account. Select Recent account activity, then sign in when prompted. Review each sign-in entry and make sure you recognize it.
This route applies to work or school accounts in the Android app. For a personal account, use the personal Recent activity page; for your work or school account’s browser route, open My Account and select Recent Activity.
Use organizational logs with administrator access
If you are an authorized administrator, sign in to Microsoft Entra with at least the Reports Reader role. Open Entra ID > Monitoring & health > Sign-in logs. Adjust the filters to locate the account and events you need to inspect.
For related account changes, open Audit logs. These logs apply to organization-managed Microsoft Entra accounts, so use the personal activity page for a personal account. If you need administrative assistance with a work or school account, ask your organization’s authorized administrator to review the relevant logs.
Review app and website usage separately
For collected usage activity, sign in to your Microsoft account’s privacy dashboard and review its available activity categories. That history concerns your use of Microsoft apps and services rather than account sign-ins.
To review Microsoft website and app usage by day, open the privacy activity history page while signed in. Use Recent activity when you need to investigate account access instead.
Frequently Asked Questions
Which personal Microsoft accounts can use Recent activity?
You can use it with personal Microsoft accounts associated with Outlook.com, Microsoft 365 Personal or Family, and Xbox. Sign in with the account whose activity you want to inspect.
Can you review Microsoft account activity with a screen reader?
Yes, Microsoft documents a screen reader route through the personal account web dashboard. Open Security, select See your sign-in activity, and expand the events you want to inspect.
Why does the privacy dashboard show different data for different accounts?
The available usage data depends on the Microsoft service, collection settings, and region. Those factors affect which collected activity you can review.
Do you need to install an activity viewer?
No installation or product download is required. You can review your personal Microsoft account activity in a web browser.
Should you use Windows Timeline or activity history syncing to check sign-ins?
Use Recent activity for Microsoft account sign-ins. Windows Timeline concerned local app, file, and website history, and Microsoft retired it in Windows 11. Cloud syncing of Windows activity history is deprecated, and remaining local-history settings do not provide account sign-in records.