What to Do if You Notice Suspicious Activity on Your Sync Account

If you notice unusual activity on your Sync account such as an unfamiliar sign-in, unexpected file changes, or a device you don't recognize, take action right away to help protect your account and files.

1. Change your Sync password immediately

If you suspect your account may have been compromised, change your Sync password as soon as possible. Choose a strong, unique password that you don't use for any other account.
Learn how to change or reset your Sync password

2. Enable two-factor authentication (2FA)

2FA provides an additional layer of protection if someone has obtained your password.
Learn how to enable 2FA

3. Review your connected devices and web sessions

Check the devices and web sessions currently connected to your Sync account. If you find a device or session you don't recognize, remotely disable it.
View a list of devices connected to your account here.

4. Check your account Events

Review the Events audit log for unusual activity, including unexpected file changes, user activity, or account notifications. This can help you determine what happened and identify activity you don't recognize.
View Events here.

5. Secure the computer or device you use to access Sync

Your Sync files are encrypted in transit and at rest, but local files on your computer can still be exposed if someone gains physical access to the device or compromises your computer password.
Learn more here.

6. If you're on a Teams account

If you're a Teams administrator, review user access and permissions. Role-based access controls (RBAC) can help administrators manage who can access and share files across the organization.
Learn more here.

7. Contact Sync Support if the activity remains unexplained

If you continue to see suspicious activity after securing your account, contact our Support Team and provide as much information as possible, including what you noticed, when it occurred, and which users or devices may be affected.

Quick response checklist

Change your Sync password immediately.
Make sure your new password is strong and unique.
Enable 2FA.
Review connected devices and web sessions.
Disable any unfamiliar devices or sessions.
Review the Events audit log.
Secure the computer or mobile device you use to access Sync.
If you're a Teams administrator, review user access and permissions.
Contact Sync Support if you need further assistance.