Microsoft Account (Rant)

[jaizan]

I have a Microsoft account. I'd really rather not have one, but it was forced upon me when I tried to download something off their app centre. Plus I have it for Skype, for the rare cases when I need to make overseas phone calls.

Using it and logging in is generally an unpleasant experience.


Anyhow, I keep getting daily messages about failed login attempts, typically from the US or Iran. I think someone else is trying to login, so I decided to change the registered e-mail address from one of my gmail addresses to another.

So I do this, including receiving a verification link by e-mail to the new e-mail address. I set my alias to the new e-mail address.

Anyhow, then I try logging in on Skype. It accepts the new e-mail address and password. Then invites me to have a passcode sent to the OLD e-mail address.
I edit the Skype profile, adding the new e-mail address & removing the old one.

Then I try to login to Skype on my phone. It again accepts the new e-mail and password, but then STILL asks me to have a passcode sent to the OLD e-mail address.

I now like Microsoft accounts even less than I did 24 hours ago.

The one thing I'm probably doing right is having several e-mail addresses.
The e-mail addresses I use for sites like this is totally different to the one I use for banks.

[Infrasonic]

I
Anyhow, I keep getting daily messages about failed login attempts, typically from the US or Iran. I think someone else is trying to login, so I decided to change the registered e-mail address from one of my gmail addresses to another...

As long as you have robust 2FA/MFA set up (biometric auth apps/passkeys /hardware Fido2 keys) then the chances of them successfully hacking your MS account are very slim.

My main MS account gets about 40 attempts a day logged, and has done for years.

If you have any API things linked like POP/IMAP email mirroring (I mirror my main Outlook.com account to a Gmail one as an online backup) then you'd need to use passkeys now as MS have changed the authentication environment, which broke the standard password model.
I had to fix mine a few months back - all runs as before now.
So some of the failed login alerts could potentially be legitimate failed sync alerts if you haven't updated your authentication credentials.