Which route is yours?
Choose what you still have. Start from the top: each route below is slower than the one before it.
I know my password, but every verification method was on the lost phone.
- Sign in with your password
- Choose “I don’t have any of these”
- Wait out the 30-day hold 30d
Replacing all security info locks changes for 30 days. Microsoft notifies your original security info during the wait, so a change you didn’t make can be cancelled.
Your route, step by step
Choose what you still have. Each route lists Microsoft's own steps and where it waits.
The recovery order, in full
- Look for a saved recovery code. Microsoft calls it a 25-digit code. People keep it in a password manager, a printout or an email to themselves.
- Try every other verification method. On the sign-in screen choose Other ways to sign in. A backup email, a second phone number or an authenticator on a tablet all count.Other ways to sign in → Use my password → Forgot password? → Use a different verification option → I don't have any of these
- If you only know the password, replace your security info. Microsoft accepts the change but holds it for 30 days. If you still have one method, use it instead: Advanced security options → Add a new way to sign in or verify → Remove the lost one
- If you have none of these, try the Sign-in Helper. With two-step on and nothing left to verify with, Microsoft says it cannot help further; the account recovery form is the route when two-step was off.
- Back on the console, sign in to your Xbox profile again and add a new phone or authenticator before anything else.
The 30-day wait
When can the change take effect?
Pick a date to see the earliest day, 30 days later.
It counts 30 calendar days, as Microsoft's page states. Nothing you enter leaves this page.
| What you have | Route | Wait |
|---|---|---|
| Recovery code | Sign in with the code | 30 days with two-step on |
| Another method | Add the new method, then remove the lost one | No hold stated |
| Password only | Replace security info | 30 days |
| Nothing, two-step on | Sign-in Helper; Microsoft says it can't help further | — |
| Nothing, two-step off | Account recovery form | 24 hours to 5 working days |
No code and no password
The honest limit first: if two-step verification is on and you can’t reach any way to verify, Microsoft’s own page says “we cannot help you, sorry.” The form below is the route when two-step was off.
The account recovery form is Microsoft's last route. It asks for details only the owner would know: passwords you used before, contacts and exact subject lines of emails you sent, and the hardware ID of a console you use. Fill it in from a device and place you've used before, and give as many answers as you can.
If it’s declined, you can try again up to twice a day; Microsoft asks you to resubmit only with new information. Replies can take from 24 hours to 5 working days.
What no one can do for you
Microsoft says its support agents are not allowed to send verification codes or change account details. Anyone who offers to do it, for a fee or for your password, is trying to take the account. Microsoft is also phasing out SMS codes for personal accounts, so plan on an authenticator app or email.
When the usual route won't work
- You changed every security detail at once. Microsoft may restrict the account for 30 days. Add the new method first, then remove the old one.
- You found the old phone or email during the wait. You can still sign in with it, but doing so cancels the pending update.
- The recovery form was declined. Try again up to 2 times a day, and only when you remember new details.
- Two-step is on and nothing is left to verify with. Microsoft says it cannot help in this case. Check every old phone, email and saved code before you give up.
- Nobody signed in for more than 2 years. Microsoft says such an account may have been deleted and can no longer be reopened.
- Your backup was a text message. Microsoft is phasing out SMS codes for personal accounts, so choose an authenticator app or an email you control.
Questions about two-step recovery
Does a recovery code skip the 30-day wait?
No. Microsoft says that if two-step verification is on, you must wait 30 days for changes to take effect, even after a valid recovery code.
Can I keep playing on my Xbox during the 30 days?
Plan for no access. One Microsoft page lists signing in to Xbox among the services you keep; another says that with two-step verification on, you won’t have access during the restriction.
Can Xbox or Microsoft support turn off two-step verification for me?
No. Microsoft says its support agents are not allowed to send verification codes or change account details, whatever the reason.
Where do I find my console ID for the recovery form?
On the console, press the Xbox button, then go to Profile & system → Settings → System → Console info. The console ID is second in the list. For a forgotten-password reset, Xbox Support asks for the Xbox network device ID instead.
How often can I send the recovery form?
Up to two times a day. Microsoft asks you to send it again only when you remember new information, because repeat submissions slow the reply.
I got a notice about a change I didn’t ask for. What now?
Use the cancel link in the notice. You need access to the security info the notice was sent to; that is what lets the real owner stop the change.
Should I start with the Sign-in Helper?
Yes. Xbox Support calls it the fastest way to get signed in, and Microsoft suggests trying it before the longer recovery form.
Sources
- Microsoft Support: How to get a Microsoft account recovery code Checked October 2026
- Microsoft Support: What does “Security info change is still pending” mean? Checked October 2026
- Microsoft Support: Help with the Microsoft account recovery form Checked October 2026
- Microsoft Support: Troubleshoot Microsoft verification code issues Checked October 2026
- Xbox Support: Reset or recover your lost Microsoft account password Checked October 2026
- Xbox Support: Find the Xbox console ID, device ID, and serial number Checked October 2026
Verified October 2026 against the Microsoft and Xbox support pages above. Microsoft’s pages give different reply times for the recovery form, so we quote both.