Review recent sign-ins

Open Settings → Recent sign-ins in webmail, or Activity in the mailbox portal.

Review the time, connection type, source IP, device information, and result. An entry may identify an app password by its label, which helps match a connection to a device.

Location information may be unavailable or approximate. A mobile network, VPN, or changing internet connection can make a familiar device appear in a different location.

If you cannot explain an entry, change your mailbox password, revoke unfamiliar app passwords, and contact support with the timestamp and connection details. Do not send your password.