I get one every few days. As long as you've got some form of two factor authentication, it's nothing to worry about. You might want to check haveibeenpwned, because this sort of thing usually happens after a data breach.

In my opinion, it's just the cost of doing business. Is your email address listed publicly somewhere? Mine isn't, except on CVs and things, and I've had the same thing happen to me a couple of times, but it stopped after a handful of attempts. If you're the estate agent and you have your email address listed on your website, maybe replace it with a picture of your email address so it's harder for bots to scrape it. If you post your email address in lots of places, then yes, people will try to log in as you just to see if they can.

I had several attempted logins per day for years, as my email address and related passwords have been leaked over the years (check haveibeenpwned as otherlad suggests).

The only easy "solution" I could work out was to add a second email to the account, one that is in no breaches because I use it only as a back up for my other emails, and set that as the only log in email.

That way I still get legitimate emails from MS to my main email, but nobody can even get to the stage of attempting to put in a password without using the secondary email, which as I said is thus far in no breaches so not known to bad guys. If I try to log in with the main email it says there is no log in with that email.

I'm sure there's a better solution, but at least now I don't deal with constant log in attempt notifications.

>>29002

Many email providers support subaddresses, so if your address is "bob@mail.com" you can also accept emails to "bob+microsoft@mail.com" or "bob+steam@mail.com". Gmail offer it by default, as do Protonmail and (IIRC) Office 365. You can just send a test message to yourself using a + subaddress to see if it works with your mail provider. Obviously that isn't ironclad security, but it's very useful for filtering messages and identifying breaches.

>>28999
You definitely have MFA enabled, right? That's about the best you can do and is pretty secure.