A new 2-step method was added
What happened
A phone, app or key was added to an account's 2-step verification. Normal when someone sets up a new phone; dangerous when someone else did it, or right after a sign-in from a new country: an attacker keeps access this way.
How serious
Usually low: it goes into the daily summary. Serious when someone else added it or the phone number changed; critical right after a sign-in from a new country.
Steps: Microsoft 365
Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.
Check their 2-step methods: Microsoft Entra admin center → Users → the person → Authentication methods. Delete any phone or app they don't recognise.
Open the page:
entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.Reset their password: Microsoft 365 admin center → Users → Active users → the person → Reset password. Give the new one by phone or in person.
Open the page:
admin.microsoft.com/#/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.Sign them out everywhere: Microsoft Entra admin center → Users → the person → Revoke sessions. This also logs out an attacker who copied their session.
Open the page:
entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Steps: Google Workspace
Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.
Check their 2-step settings: user page → Security → 2-step verification and Recovery information. Remove phones or keys they don't recognise.
Open the page:
admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.Reset their password: Google Admin console → Directory → Users → the person → Reset password. Give the new one by phone or in person.
Open the page:
admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.Sign them out everywhere: user page → Security → Sign-in cookies → Reset. This also ends a session an attacker copied.
Open the page:
admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
How to check it’s fixed
Fixed when the person confirms the activity, or when the password is new, all sessions are signed out and no unknown method, rule or app is left. Ojava raises no new alert for them.
When to call your IT provider
Call your IT provider now if the person didn't do this, or if you are unsure.