Microsoft Account Password Recovery: How to Use account.live.com/acsr

You forgot your Microsoft account password, went through the normal reset flow, and Microsoft sent you to a long form instead of just resetting it. That form lives at account.live.com/acsr, and it exists because your account failed the quick identity checks Microsoft normally uses.

I've walked several people through this form after they got stuck on it for weeks. Most failures come down to the same handful of mistakes. Here's how the process actually works and how to avoid the rejections.

What is account.live.com/acsr and why did I get sent here?

ACSR stands for Account Compromise/Security Recovery. Microsoft routes you here when it can't confirm your identity through a code sent to your phone or backup email, usually because you no longer have access to either.

You'll typically land on this form after:

• You forgot your password and don't have your recovery phone anymore.
• Someone changed your recovery email or phone without your permission.
• Your account got flagged as compromised and locked for your protection.

The form asks about your account's history instead: past passwords, contacts you've emailed, subject lines from recent messages, and other details someone who genuinely owns the account would know.

How do I fill out the Microsoft account recovery form correctly?

Answer only what you know for certain, and leave blank anything you're guessing at. A guess that turns out wrong hurts your score more than an honest blank field.

The form is scored, not reviewed word by word by a person on your first submission. It compares your answers against Microsoft's account activity data and gives you a confidence score. Score high enough, and you get back in within a day. Score too low, and you get a rejection with no specific reason given.

Fields that matter most for your score:

1. Previous passwords. List every password you remember using on this account, even old ones. Recent passwords count more, but older ones still help.
2. Email subject lines. Open your sent folder on another device if you're still logged in anywhere, or recall specific subjects from memory. Generic guesses like "hello" or "meeting" don't help.
3. Contacts you email regularly. Real addresses you've actually messaged from this account, not just names you remember.
4. Account creation details. The approximate month and year you created the account, plus the device or service you first used it with.

Why does Microsoft keep rejecting my recovery attempt?

The most common reason is submitting the form more than once with different guesses. Each new submission resets your review, and repeated attempts with inconsistent answers lower your trust score instead of raising it.

Other rejection causes:

• Leaving most fields blank instead of answering what you actually know.
• Using an old recovery email or phone number you no longer control as your contact method, which prevents Microsoft from reaching you with updates.
• Filling out the form from a device or location wildly different from where you normally use the account, which can look suspicious to Microsoft's automated review.

How do I get to the ACSR form if Microsoft doesn't send me there automatically?

Start the normal recovery flow first. Go to account.live.com/password/reset, enter the email or phone number tied to the account, and pick "I forgot my password." Microsoft only routes you to account.live.com/acsr after you fail the standard verification step, so you can't jump straight to the form and skip the earlier checks.

If you land on a "we couldn't verify this was you" message instead of the ACSR form, click through the prompts that follow it. Microsoft usually presents ACSR as the next option once your phone or email verification fails, rather than as a separate link you type in directly.

What's the difference between this and other Microsoft account recovery pages?

account.live.com/acsr is specifically for personal Microsoft accounts (Outlook.com, Hotmail, Xbox, Skype logins). Work and school accounts managed by an organization go through a completely different process, usually handled by that organization's IT admin rather than Microsoft support.

A few related pages people confuse with ACSR:

• login.live.com/acsr redirects to the same form. It's the older domain for the same tool.
• account.microsoft.com/security is where you manage recovery methods once you're already signed in, not where you recover a locked account.
• Aka.ms/mysecurityinfo covers work and school accounts through Microsoft Entra, not personal Microsoft accounts. If your email ends in a company domain instead of outlook.com or hotmail.com, this is likely the page you actually need, not ACSR.

How do I check the status of my Microsoft account recovery request?

Check the email address you provided during the ACSR submission. Microsoft sends status updates there, not to the locked account itself, since you can't access that inbox yet.

If you haven't heard back after a week, submit a fresh request rather than repeatedly refreshing the same one. Use the same contact email each time so Microsoft can match your case history.

What do good and bad ACSR answers actually look like?

A password field asking for an old password you used is not the place to write "I don't remember" or leave a placeholder guess. Either type an exact password you're confident you used, or skip the field entirely. A half-remembered guess scores worse than an honest blank.

For the subject line question, "invoice" or "photos" as a guess scores low because thousands of accounts have emails with those exact words. A specific subject you actually recall, like "Flight confirmation DL4821" or a real project name from your work, scores far higher because it's something only the real account owner would know.

For contacts, list people you've actually exchanged multiple emails with, not everyone in your address book. Someone you emailed once three years ago carries less weight than a contact you've messaged regularly.

What should I do before I ever get locked out?

Add two recovery methods now, not after you're locked out. Go to account.live.com, sign in while you still can, and under Security add both a phone number and an alternate email you actually check.

Turn on two-step verification and download backup codes to a place other than your phone, like a password manager or a printed copy in a safe spot. If your phone is ever the single point of failure for your Microsoft account, one lost or broken phone turns into a multi-day recovery process.

A quick checklist for the ACSR form

• Answer every field you're certain about. Skip anything you'd be guessing on.
• List old passwords first, most recent last, if the form allows multiple entries.
• Pull real subject lines and contacts from any device still logged into the account.
• Use a recovery email you actually check as your contact method.
• Submit once. Wait for a response before trying again.
• Add a second recovery method the moment you're back in, so you don't end up back on this form.

Most people who get rejected the first time made one of two mistakes: guessing on fields instead of leaving them blank, or submitting the form more than once before Microsoft finished reviewing the first attempt. Slow down, answer only what you know, and submit once.