Suspicious Microsoft 365 or Google Workspace sign-in: what to check first

Suspicious Microsoft 365 or Google Workspace sign-in: what to check first

Do not approve a request you did not initiate. Use the official address from a trusted device and preserve the alert details. An unfamiliar location may need VPN or provider context, but it should be investigated alongside device, time and subsequent activity.

Investigate a suspicious sign-in

Understand the situation before making changes

Distinguish a blocked attempt from a successful sign-in. A different city alone does not prove an attack because IP geolocation can be approximate. Compare the event with known devices and working times.

Where compromise is suspected, the administrator should review sessions, authentication methods, authorized applications and mailbox changes. A password change alone may leave other access or malicious configuration unaddressed.

Risks to review

• Approving repeated prompts to make them stop.
• Dismissing unfamiliar access without checking activity.
• Sharing screenshots containing codes or sensitive details publicly.

Safe recommendations

1. Keep alert time and details without opening questionable links.
2. Review activity through the official account portal.
3. Notify the administrator if the access is unfamiliar or you approved a prompt by mistake.
4. Request investigation of sessions, new methods, mail rules and connected applications.
5. Validate protective measures and continue monitoring new alerts.

When to seek specialized help

• Have you found a sign-in you do not recognize? Soportered can help assess the evidence and coordinate protective measures with your business email administrator.
• Tell us when it started, how many people are affected and the exact error. Do not send passwords, verification codes or confidential files in the initial message.