If you want to update your security info (such as a password). You need to verify your ID with your phone or another email. If you don't have any connected to you account (or forgot them), you can add them. After doing this you need to wait 30 days for verification and you can not change your password (and other security settings).[1]

If a hacker or someone has your password, you need to wait 30 days. Before you can change it. Giving the hacker free access for 30 days.

Why would a company still choose to make you wait 30 days?

  • As a side note. Thats a good example of why "One ring to rule them all" policy is risky. If they get limited or full access to the single account used as account recovery for several services it is a fair assumption to consider all services could be compromised. And restoring access to all services could be a pain in the ass.
    – bradbury9
    Apr 13, 2018 at 10:06

1 Answer 1


The 30-day waiting period helps Microsoft stop unauthorized people from trying to completely take over an account that isn't theirs. For example, an unauthorized person obtaining an account password through phishing or shared passwords across third party platforms. This waiting period gives the real account owner enough time to be alerted of any major changes and to cancel it if they didn't make those changes.

During this 30-day period, you'll still be able to access most Microsoft services. You won't, however, be able to do things that require a security code, like changing your password, viewing billing information, or buying new apps or games from Microsoft Store or on Xbox.

After the process of resetting your security information has started, you must wait the full 30 days for it to complete. However, if you regain access to a piece of your original security info, you can cancel the replacement yourself.

Source: Official Microsoft Source

  • 4
    Regardless if it's a smart move or not, that is their reason
    – toom
    Apr 13, 2018 at 9:33
  • But this also give the hacker 30 days to undo anything the real user did. Or am I missing something? Apr 13, 2018 at 9:38
  • 1
    Indeed, access to the account is granted, and the attacker could do several things, but no full control is given and the victim could react to the credential theft without economic implications (as long as MS is concerned). If the email has sensitive messages tha could help impersonate or password recovery other services it could be troublesome imho. I can not buy myself at microsoft store, but there goes paypal!
    – bradbury9
    Apr 13, 2018 at 9:47
  • As @bradbury9 it does deliver some security for your accounts and the settings but it also guarantees some free 'playtime' for the hacker
    – toom
    Apr 13, 2018 at 9:51
  • A user that is able to verify their ID can retain control of their account even vs a hacker that has managed to get their password. This is a very common situation and likely why the policy was implemented.
    – Brian
    Nov 26, 2019 at 21:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.