Microsoft Account Recovery: How to Get Back Into Your Account

Losing access to a Microsoft account locks you out of Outlook email, OneDrive files, Xbox Game Pass, and Microsoft 365 documents simultaneously. The recovery path isn’t obvious, and taking the wrong step first can cost you the 30-day window to reverse a hacker’s changes. This guide covers every available recovery method in order of speed and success rate: instant verification, the account recovery form at account.live.com/acsr, recovery codes, Xbox hardware ID submission, and live support escalation.

Start Here: Quick Recovery Methods

Before escalating to manual review, exhaust these automated options. Microsoft surfaces them on the sign-in page, and each takes under 3 minutes.

1. Recovery email link — Microsoft sends a verification link to your backup email. Click it to confirm identity and reset access.
2. SMS verification code — A six-digit verification code is sent to your registered phone number. Enter it at the sign-in prompt.
3. Authenticator app approval — If you set up Microsoft Authenticator, approve the push notification from a secondary device.
4. Trusted device bypass — On a device already signed into your account, navigate to account.microsoft.com to change security settings without re-verifying.
5. Hotmail/Outlook recovery — These use identical infrastructure. Go to login.live.com, enter your @hotmail.com or @outlook.com address, and select “Forgot password.”

Pro tip: If you still have a trusted device signed in, use it immediately to add a new recovery email or phone number before the session expires. This resolves most lockouts in under 5 minutes.

How to Use the Microsoft Account Recovery Form

When standard verification fails — no access to the recovery email, phone number changed, or authenticator app lost — the account recovery form is the primary self-service escalation path.

1. Navigate to account.live.com/acsr.
2. Enter the Microsoft account email address you’re trying to recover.
3. Provide a contact email where Microsoft can send its decision.
4. Enter your full name as it appears on the account.
5. Fill in the historical account details section (covered below).
6. Submit and wait — Microsoft states review takes up to 24 hours; responses often arrive within 12.

Common mistake: Submitting with minimal information. Microsoft staff review these manually against account history. Sparse submissions are denied at a high rate. Resubmission with more detail is allowed and often necessary.

You can also review backup codes as a preventive measure to avoid needing this form in the future.

How to Maximize Recovery Form Success

The form succeeds or fails based on how much verifiable history you provide. Gather these details before submitting:

• Previous passwords — Every password you remember, including partial ones
• Account creation date — Even an approximate month and year
• Subject lines of old emails — Specific subjects you sent or received
• Frequent contacts — Email addresses of people you regularly communicated with
• Subscription and purchase history — Microsoft 365 dates, Xbox purchases, app purchases with approximate dates
• Devices used — Phone models, laptop brands, operating system versions
• IP location history — Cities or regions where you typically signed in

Pro tip: Check bank or credit card statements for Microsoft charges. Transaction dates and amounts are highly specific and carry significant weight in manual review.

If your first submission is denied, compile additional details and resubmit. Microsoft imposes no stated limit on resubmissions.

Recovering a Hacked Account Where Security Info Was Changed

This scenario is the most time-sensitive. An attacker who replaces your recovery email and phone number cuts off all standard verification paths. Microsoft enforces a 30-day window after any security information change, during which the original owner can reverse it.

Within 30 days of the change:

1. Check the email address originally linked to the account for a Microsoft alert titled “Microsoft account security info was changed.”
2. Open that email and click “This wasn’t me.”
3. Follow the prompts to reverse the change and regain access.

After the 30-day window closes:

1. Navigate to account.live.com/acsr and submit the recovery form.
2. Include maximum account history (see section above).
3. Explicitly state that the account was compromised and security info was replaced without your authorization.

Per Microsoft’s account security documentation, acting within that 30-day window is the single most reliable path to recovering a hacked account. After it closes, manual review is the only option, and approval is not guaranteed.

Recover Using a Recovery Code

A Microsoft recovery code is distinct from a verification code used for two-factor authentication. Recovery codes are generated in advance from your account’s security settings and are intended for use when all other verification methods are unavailable. Don’t confuse this with the 48-digit BitLocker recovery key Microsoft also stores in your account — that one unlocks an encrypted Windows drive, not the account itself.

Steps:

1. Go to login.live.com and enter your account email.
2. Select “Sign in another way” on the verification prompt.
3. Choose “Use a recovery code.”
4. Enter the 25-character code you saved when generating it.

Recovery codes are generated under account.microsoft.com → Security → Advanced security options. If you never generated one, this option will not appear. Proceed directly to the account recovery form.

Xbox and Console Account Recovery: Hardware ID Submission

Xbox users have one additional option: submitting the console’s hardware ID as proof of ownership. This is useful when an account has years of gaming history, achievements, and purchases tied to a specific console.

Finding your hardware ID:

• Xbox One: Settings → System → Console info → Console ID
• Xbox Series X/S: Settings → System → Console info → Console ID

The Console ID is a 16-character alphanumeric string. Include it in the recovery form’s “Additional details” field, or reference it in a support chat session. Microsoft can cross-reference the console ID against account sign-in history — strong proof of ownership when no other verification method is available.

When the Recovery Form Fails: Live Support Escalation

If the recovery form is denied twice or receives no response after 48 hours, escalate to live chat.

1. Navigate to support.microsoft.com.
2. Select “Account & billing” as the product category.
3. Choose “Microsoft account” as the specific issue.
4. Select “Chat” as the contact method.
5. When connected, explain that you’ve already submitted the recovery form and provide the confirmation number if available.

Live agents cannot bypass Microsoft’s security policies or manually unlock accounts. They can re-escalate your recovery form for secondary review or identify whether the account has been flagged for a specific issue.

Critical policy: Microsoft permanently deletes accounts inactive for more than 2 years. Once deleted, all associated data — emails, OneDrive files, Xbox history — is unrecoverable. No support escalation can restore a deleted account. This policy is documented in Microsoft’s Services Agreement.

Recovery Method Comparison

Decision Framework

• Have access to recovery email or phone → use instant verification at login.live.com
• Trusted device still signed in → update security info immediately at account.microsoft.com
• Security info changed by a hacker within 30 days → find the Microsoft security alert email and click “This wasn’t me”
• All verification methods inaccessible → submit the recovery form at account.live.com/acsr with maximum historical detail
• Xbox user with no other options → include console hardware ID in the recovery form
• Recovery form denied → escalate to live chat at support.microsoft.com
• Account inactive over 2 years → account may be permanently deleted; no recovery path exists

Frequently Asked Questions

How do I recover a Microsoft account without access to the recovery email or phone? Submit the account recovery form at account.live.com/acsr with as much historical account information as possible — previous passwords, old email subjects, purchase history, and devices used. This is the only self-service path when all verification methods are unavailable.

What is the Microsoft account recovery form? A manual review form at account.live.com/acsr reviewed by Microsoft staff. Enter your account email, a contact email, your name, and detailed account history. Approval depends on the specificity of the information provided.

What if the recovery form fails or gets no response? Resubmit with additional historical details, or escalate to live chat at support.microsoft.com under Account & Billing. Agents can re-escalate the review but cannot override security policies.

How do I recover a hacked account where security info was changed? Check your original email for a Microsoft security alert. If within 30 days of the change, use the “This wasn’t me” link to reverse it. If the window has passed, submit the recovery form with proof of ownership.

Can Microsoft support manually restore my account? No. Support agents can escalate recovery form reviews and provide guidance, but account restoration depends on the automated review outcome.

How do I reach a live person at Microsoft for account recovery? Go to support.microsoft.com, select Account & Billing, then Microsoft Account, and choose Chat.

What is the 30-day waiting period after security info is changed? Microsoft holds a 30-day window after any security information change during which the original owner can reverse it via a notification email. After 30 days, the change is permanent and the recovery form becomes the only option.

Does Microsoft delete inactive accounts? Yes. Accounts inactive for over 2 years are permanently deleted under Microsoft’s Services Agreement. Deleted accounts cannot be recovered by any method.

Summary

The recovery hierarchy runs in sequence: instant verification (recovery email, SMS, authenticator app, trusted device) → account recovery form with maximum historical detail → pre-generated recovery code → live support chat. Xbox users should include their console hardware ID in any recovery submission.

Two factors determine success: speed and detail. The 30-day reversal window for hacked accounts closes fast. On the recovery form, one precise transaction date or email subject line can tip a manual review in your favor. Accounts inactive over 2 years face permanent deletion.

To avoid this situation: set up a recovery email, save a recovery code, and enable Microsoft Authenticator before a lockout occurs.