Verified October 2026 against PlayStation, Xbox and Microsoft support pages.
The Recent activity page lists when and where your Microsoft account was used over roughly the last 30 days, including successful sign-ins, failed password attempts and changes to your security info. Most entries are routine, and locations are often approximate. The entries worth acting on are ones you cannot explain: a successful sign-in you did not make, security info you did not change, or anything under Unusual activity that was not you.
Where the page is and what it covers
Because your Xbox profile signs in with a Microsoft account, this page is the most direct record of who has been using that account. Microsoft's help article on the page has a See your recent activity link; it opens the list after you sign in with your own account.
According to that article, it shows activity from the last 30 days. When you expand an entry, you typically see the date and time, an approximate location, the device type or operating system, the browser or app, and the IP address. Exact layout can change over time, so treat the labels below as a guide rather than a fixed list.
What the common entry types mean
Successful sign-in
Someone signed in with the correct password. Microsoft lists extra checks, such as a code sent to you, as a separate Additional verification requested entry. A successful sign-in from a device and place you recognize is normal. A successful sign-in from a device type you do not own, at a time you were not playing or browsing, is the entry that matters most on the whole page.
Incorrect password entered
A sign-in attempt failed at the password step. This can be you mistyping, an old device still holding a previous password, or someone else guessing. On its own it means the attempt did not get in. A long run of these from places you do not recognize is a reason to strengthen your sign-in, not a sign that the account is already lost.
Security info and account changes
Entries such as a phone number or alternate email being added or deleted, two-step verification being turned on or off, a password change or reset, or an alias change record edits to how the account is protected. If you made the change, it simply confirms it happened. If you did not, treat it seriously: changing security info is a common step in a takeover, because it lets the other person receive codes and reset the password.
Automatic sync and app permissions
Microsoft says connecting your account to an app or service that manages email makes it sign in as you automatically, at regular intervals, which appears as automatic sync. Entries about permission given to an application mean an app was allowed to use your account. Unfamiliar app names deserve a second look.
Blocked sign-ins and Unusual activity
A Sign-in blocked entry is not routine filtering. Microsoft uses it when it thinks someone else may have accessed the account, or when it has suspended the account for suspicious activity, and it then asks you for extra verification to unblock it. The Unusual activity section is where Microsoft asks you to confirm an entry by choosing This was me or This wasn't me. Choosing the second option starts Microsoft's own steps for securing the account.
Why the location can look wrong
Treat the location as approximate. Microsoft shows the IP address and a map for each entry, and the place can be off, sometimes by a whole region:
- Mobile networks can route your traffic through a gateway in another city or state, so a sign-in from your phone at home may show somewhere else. Microsoft notes this directly in its help article.
In our experience, a VPN can have a similar effect, since sites see the VPN server rather than your own connection. Microsoft's article does not discuss this.
A useful habit is to look for consistency rather than an exact match. Microsoft notes that travel, a new device or an app signing in as you can be marked as unusual activity. If your sign-ins usually show one or two nearby places and the same device types, an entry that breaks that pattern is more telling than a location that is merely a few hundred miles off.
Which entries are worth acting on
Ask three questions about each entry that catches your eye: was it a success or a failure, do you recognize the device type and app, and does the timing fit what you were doing. Then sort it:
- Usually no action needed: successful sign-ins from your own devices, automatic sync from your mail app, a location that is odd but consistent with your mobile carrier.
- Worth tightening your sign-in: repeated incorrect password attempts from unfamiliar places. The attempts failed, but a stronger password, a passkey or an authenticator app reduces the chance of a later one working.
- Act now: a successful sign-in you cannot explain, security info or two-step settings you did not change, a password change you did not make, any Sign-in blocked entry (see what to do when your Xbox account is locked), or anything in Unusual activity that was not you. Microsoft's Security settings page is where you change your password, update your security info and remove all trusted devices.
Before calling an entry an intrusion, check with anyone in your household who uses the same console. A family member signing in on a shared Xbox looks exactly like any other successful sign-in. If you are unsure whether a console is involved, our guide on checking for an unknown console signed in to your Xbox account covers the device side.
What the page cannot tell you
The page shows sign-ins to the Microsoft account itself. Microsoft says it does not show all account activity, usually only significant events, and repeated sign-ins from the same device and place may appear only once; the 30-day window means older events are no longer listed. It also does not end sessions for you. Signing out of your account everywhere does not sign you out of an Xbox console, so a console that already has your profile saved needs separate attention. The page also cannot tell you who someone is; an IP address points to a network, not a person, and you should not try to trace or confront anyone from it. If money was taken, contact your bank and report fraud through official channels.
What to do next
- If everything is recognizable, no action is needed.
- If you see a successful sign-in or security change that was not you and you can still sign in, follow our walkthrough for an Xbox account that has been hacked, which covers securing the account in the right order.
- If Microsoft has locked the account or asks you to verify before you can continue, see what to do when your Xbox account is locked.
Only review your own account. Never share your password or security codes with anyone who offers to read or check this page for you.