How to Stop Third-Party Access to Your Microsoft Account

This guide shows you how to lock down your Microsoft account so apps, services, and other people can’t access your data without your permission. You’ll learn where to review connected apps, remove unwanted access, and strengthen your account security. You’ll need your Microsoft account sign-in details and access to the email or phone associated with the account.

What You’ll Need

Your Microsoft account email and password
Access to the recovery email or phone number linked to your account (for verification)
A web browser on any device

Step-by-Step

Sign in to your Microsoft account security dashboard. Go to account.microsoft.com and sign in with your Microsoft account credentials. If you have two-step verification enabled, complete that prompt as well.
Open the “Privacy” section. Once signed in, click the “Privacy” tab on the top navigation bar. This page shows all the data Microsoft collects and how it’s used.
Review “Apps and services that can access your data.” Scroll down to the “Other privacy settings” section and click “Apps and services that can access your data.” This will open a list of every third-party app or service that has been granted access to your Microsoft account data (such as your profile, location, or calendar).
Remove any app you don’t recognize or no longer use. For each entry, click “Edit” and then “Revoke” or “Remove access.” Confirm the action when prompted. This immediately cuts off that app’s ability to read your data.
Check “Apps and services that have access to your info” (if present). Some accounts also show a separate list under “Your data” > “Apps and services.” Review this list too and revoke anything you don’t trust.
Review “Security” settings. Go back to the top and click the “Security” tab. Click “Advanced security options.” Here you can:
Enable two-step verification. Under “Two-step verification,” click “Turn on” and follow the prompts. This adds a second check (like a code sent to your phone) whenever you sign in from a new device.
Remove old or unknown devices. Scroll to “Devices” and click “Review devices.” Remove any device you don’t recognize by clicking “Remove.”
Review “Sign-in activity.” In the “Security” section, click “Sign-in activity.” Check for any sign-ins from unfamiliar locations or browsers. If you see one, click “Secure your account” and follow the prompts to change your password and sign out of all devices.
Change your password if you suspect any compromise. In “Security” > “Password security,” click “Change my password.” Choose a strong, unique password that you don’t use elsewhere.
Set up security alerts. Under “Security” > “Security alerts,” make sure you have alerts enabled for unusual activity. You can choose to get alerts via email or text.
Regularly repeat this review. Make it a habit to check the “Apps and services” list every few months, especially after you install new apps or sign in to new services with your Microsoft account.

Common Mistakes

Not checking all sections. The “Apps and services” list is not the only place where access can be granted. Some apps appear under “Your data” or “Privacy” in different submenus. Always review both the “Privacy” and “Security” tabs.
Revoking an app you still use. If you revoke access to an app like a game or a cloud service, that app will stop working until you sign in again. That’s not harmful, but it can be confusing if you didn’t intend to lose access.
Ignoring the “Sign-in activity” log. Many users focus only on app access and forget to check for unauthorized sign-ins. A successful sign-in from another country is a red flag that your password is already compromised.
Using a weak password. Even if you revoke all third-party apps, a weak password can still allow someone to log in directly. Always use a long, random password.
Skipping two-step verification. This is the single most effective way to prevent unauthorized access, yet many users skip it because it adds a step.

Tips

Use a password manager. Generate and store a strong, unique password for your Microsoft account. This prevents reuse of passwords from other sites.
Turn on two-step verification. Even if you don’t want to use an authenticator app, you can use a phone number. This makes it much harder for someone else to sign in.
Check the “Recently used apps” list. In the Privacy section, you’ll also see a list of apps you’ve recently used to sign in with Microsoft. If you see one you don’t remember, revoke it.
Use the “Security dashboard” regularly. Microsoft provides a security score that shows you how secure your account is. Aim for a high score by following its recommendations.
Sign out of devices you no longer use. When you sell or give away a device, make sure to sign out of your Microsoft account and remove the device from your account’s device list.

Troubleshooting

I can’t sign in to my Microsoft account. If you’ve changed your password and now can’t sign in, try using the “Forgot password” link on the sign-in page. You’ll need access to your recovery email or phone number. If you don’t have access to those, you’ll need to fill out the account recovery form. It may take up to 24 hours for Microsoft to review it.

I revoked an app but it still shows up. Sometimes the list takes a few minutes to update. Refresh the page after a few minutes. If it still shows, try revoking again and confirm that you clicked “Save” or “Revoke” (not just “Edit”).

I see a sign-in from a location I don’t recognize. Click “Secure your account” on the sign-in activity page. This will guide you through changing your password and signing out of all devices. Do this immediately, even if you think it might be you (e.g., using a VPN).

I can’t find the “Apps and services” list. The exact wording may vary depending on your account type (personal, work, or school). If you have a work or school account, your admin may have disabled this feature. For personal accounts, look under “Privacy” > “Other privacy settings.” If you still can’t find it, try going directly to account.microsoft.com/privacy.

Two-step verification isn’t working. Make sure your phone number is correct and that you have a signal. If you’re using an authenticator app, check that the time on your phone is correct. If you lose your phone, you’ll need to use a recovery code (which you should have saved when you set up two-step verification).

Frequently Asked Questions

Q: What counts as “third-party access”?
A: Any app or service that you’ve signed into using your Microsoft account, such as a game, a productivity tool, or a third-party email client. These apps can read data you’ve allowed them to access, like your profile or calendar.

Q: Can I see what data an app has accessed?
A: Microsoft provides a “Recent activity” page under Privacy that shows when apps accessed your data. However, it doesn’t show the exact content. If you’re concerned, revoke access.

Q: Will revoking an app delete my data from that app?
A: No. Revoking access only stops future access. The app may still have data it already collected. To delete that data, you’ll need to contact the app’s support or delete the app account itself.

Q: How often should I review third-party access?
A: At least every three months, or after you install a new app that uses Microsoft sign-in. Also check if you ever suspect your account has been compromised.

Q: Does two-step verification prevent all third-party access?
A: No, but it makes it much harder for someone to sign in as you. Third-party apps that you’ve already authorized can still access your data until you revoke them. Two-step verification only protects against new sign-ins.

Q: What if I use a work or school Microsoft account?
A: Your organization’s admin controls many security settings. You can still review and revoke third-party apps under the “Privacy” section, but some options may be disabled. Contact your IT admin for help.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →