How to Revoke Microsoft Account App Permissions and Sign Out Everywhere in Windows 10 and 11

Before you start​

These steps apply to personal Microsoft accounts, including accounts used with Outlook, Xbox, OneDrive, and Microsoft 365 for home. The account may use an Outlook or Hotmail address, but a personal Microsoft account can also use another email provider’s address.

The permission and security pages are web pages, so the main procedure is the same on Windows 10 and Windows 11. You need:

• A trusted PC, an internet connection, and a browser.
• The personal Microsoft account you want to inspect. If you have several, check the account shown after signing in.
• Access to a registered verification method, such as an authenticator app or recovery email address.
• Time to sign back in to trusted apps and services afterward. The account changes take only a few minutes to request, but the full sign-out can take longer.

If you suspect malware on the PC, use another trusted device to secure the account if possible. Microsoft recommends running an up-to-date antivirus full scan before changing the password on a potentially infected PC. In Windows Security, select Virus & threat protection > Scan options > Full scan > Scan now. Follow the protection software’s instructions for any threats it finds before using that PC to sign in again.

Windows 10’s regular security support ended on October 14, 2025. The browser-based account procedure still applies, but use a supported and updated device where possible when securing a compromised account.

Review and revoke connected app permissions​

An app can receive permission to access specified account information when you approve a Microsoft sign-in or consent request. The permission is separate from an app’s installation on your PC: uninstalling a program is not the same action as revoking its account access.

Before removing a permission: A legitimate app may stop syncing, signing in, or accessing the Microsoft data it needs. Note its name and the permissions shown so you can investigate or reconnect it deliberately later. Revoking access does not guarantee that information the app already copied has been deleted.

1. In your browser, search Microsoft Support for “Where can I find privacy settings in Microsoft products?” Open the Microsoft Support result with that exact title.
2. In the article, find More privacy resources > Apps and services. Select apps and services that can access your data. This opens Microsoft’s personal-account consent management page.
3. If prompted, sign in. Check that the account is the personal Microsoft account you intended to review.
4. Look through the listed apps and services. For an entry you want to inspect, select Edit. Review the information or permissions displayed.
5. For an app you do not recognize, no longer use, or no longer trust, select Remove these permissions. Complete any confirmation shown.
6. Repeat for other unwanted entries. Return to the list and check that the removed connection is no longer shown.

Microsoft’s support page provides the route to the consent page; the FBI’s Outlook account security guidance documents the Edit > Remove these permissions action.

An unfamiliar name is worth investigating, but it is not proof of an attack: a service may use a publisher or product name you do not immediately recognize. Conversely, don’t leave a permission in place solely because its name sounds reassuring. Check what access it has and whether you actually use the service.

If you remove a trusted app by mistake, open that app or service and reconnect your Microsoft account through its normal sign-in process. Review the new permission request before accepting it. Do not reconnect an app you still consider suspicious.

Change your password if access may have been unauthorized​

Removing an app’s permission addresses that connection; it is not a substitute for changing a potentially exposed password. If you suspect someone accessed your account or learned your password, change it after securing the device you are using.

Before changing it: Make sure you can receive a verification prompt and have a safe way to retain the new password. You will need to use the new password wherever Microsoft asks for it again. If you use a passwordless account, follow its existing sign-in and security options rather than assuming it has a password to change.

1. Open your Microsoft account dashboard in the browser and sign in to the same personal account.
2. Select Security, then Change Password.
3. Complete any identity check Microsoft requests.
4. Enter the new password in the fields provided and select Save. Choose a strong password you do not use on another account.
5. When prompted on your trusted devices, sign in again with the new password.

If you do not know the current password or cannot sign in, use Microsoft’s Sign-in Helper or the password-reset option on the sign-in screen rather than repeatedly guessing. Microsoft Support’s article “Change your Microsoft account password” distinguishes changing a known password from resetting a forgotten one.

Changing the password does not undo data an app may already have obtained, and it does not replace the separate app-permission review.

Turn on two-step verification​

Two-step verification adds another check to account sign-in. It helps protect against someone who knows the password, but you should still remove unwanted app permissions and review suspicious account activity.

Before turning it on: Check that your verification methods belong to you and that you can access them. Microsoft recommends having three pieces of security information as backups. Losing your available methods can make recovery difficult or, in some circumstances, impossible. Do not remove every existing security method at once.

1. In the Microsoft account dashboard, select Security.
2. Select Manage how I sign in and complete any identity check.
3. Review the available ways to sign in or verify your identity. Add a method you control if needed, and follow Microsoft’s prompts to verify it.
4. Under Additional security, find Two-step verification and select Turn on.
5. Follow the on-screen setup instructions until the process is complete.
6. Return to the security page and check that two-step verification is shown as on.

If you decide to undo this change, return to Security > Manage how I sign in > Additional security > Two-step verification and choose Turn off. That removes the extra sign-in requirement, so keep it enabled unless you have a specific reason to change it.

Sign out account sessions​

Before you proceed: Save your work in Microsoft-connected apps. Expect to sign in again on devices you trust, and have your new password and verification method available. Microsoft 365 apps may need you to sign back in to remain activated.

1. In your personal Microsoft account dashboard, open Security and go to Advanced security options. Complete any requested verification.
2. Scroll to Sign out everywhere and select Sign out.
3. Follow any confirmation presented.
4. Allow up to 24 hours for the sign-out to take effect across browsers and apps.
5. Sign back in only on devices and apps you trust, using your updated credentials where requested.

Microsoft says Sign out everywhere excludes Xbox consoles. If your account is signed in on an Xbox, sign out there separately; do not assume the dashboard action removed that console session. If you cannot access the console, use Xbox Support’s account-security guidance for that situation.

This action is different from signing out of the Windows desktop. Signing out of Windows closes the local user session; the account dashboard action is the relevant remote-session step here.

Verify the account and look for remaining changes​

After completing the changes, check both the account permissions and the places an attacker might have altered. A clean app list alone does not prove that no information was accessed.

1. Return to the apps and services that can access your data page and confirm the unwanted entries remain absent. If an entry returns, check whether you or another trusted app reconnected it; do not approve a new consent request you do not understand.
2. In the Microsoft account Security area, select Review activity. Expand activity you do not recognize and inspect its details. For an item in Unusual activity, select This wasn’t me if appropriate; for an item in Recent activity, select Secure your account if offered.
3. Check the sign-in and verification methods under Manage how I sign in. Investigate any method you do not recognize. Keep working methods available while you secure the account.
4. If you use Outlook mail, review forwarding and rules. In Outlook’s web settings, check Mail > Forwarding and IMAP and Mail > Rules. Investigate forwarding addresses or rules you did not create; disable unwanted forwarding and save the change.
5. After the sign-out window has passed, open a trusted app or browser where the account was previously signed in. If it asks you to sign in again, use the updated credentials and verification method.

Microsoft notes that a new device, travel, or an app signing in can generate unusual-activity alerts, so assess the details rather than treating a location alone as conclusive. Microsoft also recommends checking forwarding and other account settings after a compromise.

Troubleshoot missing apps, sign-in prompts, and access problems​

The app list is empty or the suspicious app is missing​

First check that you signed in to the intended personal Microsoft account. A different personal account has its own connections. A work or school account is managed separately.

Also check that you opened the account consent page, not the Windows app-permission settings or the privacy dashboard’s apps and services activity history. Clearing activity history is not the same as removing an app’s account permission. An app that is installed locally, or a connection managed outside this consent list, may require separate investigation.

A trusted app stops working after permission removal​

Open the app and reconnect the account through its normal sign-in flow. Read the permissions it requests before accepting. If the requested access seems unnecessary, cancel and check the app provider’s documentation rather than granting it automatically.

If an app asks for the new password after the password change or remote sign-out, that can be expected. Enter it only into a sign-in prompt you reached through the trusted app or Microsoft’s own account pages—not through an unexpected email or message.

You cannot complete Microsoft’s security check​

Make sure you can use one of the verification methods already registered to the account. If the browser’s security check itself fails, Microsoft suggests trying a regular browser window rather than private browsing, allowing cookies and JavaScript, or trying another browser or network. Restore any browser protections you temporarily change after the test.

If you have lost access to your verification methods, use Microsoft’s Sign-in Helper. Microsoft states that support agents cannot send password-reset links or change account details for you; recovery options are especially limited when two-step verification is on and none of the alternate methods is available.

The account belongs to work or school​

Contact your organization’s IT administrator or help desk promptly if you see an unfamiliar app or suspect unauthorized access. Give them the app name, the permissions shown, and the relevant activity details; do not send passwords or verification codes.

Your organization may show apps in the My Apps portal. Permissions you personally consented to may have a Revoke Permissions option, but administrator-consented permissions cannot be revoked by the user there. Ask the administrator to investigate those permissions and handle organizational sessions according to its security process.

Suspicious activity continues​

Do not keep reconnecting the unknown app to test it. From a trusted device, repeat the permission and recent-activity checks, confirm your security methods, and use Microsoft’s Sign-in Helper or Contact Microsoft Support for the personal account. If the problem involves Outlook mail, include the suspicious forwarding or rule details when describing the incident.