What should we do when a Microsoft 365 account is compromised?

Key facts

• A password reset alone does not end an attacker session; revoke sessions too.
• Attackers often add their own MFA method or an inbox rule to stay in.
• Malicious OAuth app consents survive password resets.
• Preserve logs before cleanup; investigation depends on them.
• Legal, insurance and notification duties may apply, so involve them early.

Contain the account in the first hour

Speed matters because a compromised mailbox is often used within hours to send invoice fraud or phishing to contacts. Work through containment in order, and note the time of each step for the incident record.

• Block sign-in for the user in the Microsoft Entra admin center or Microsoft 365 admin center.
• Reset the password; for synced accounts, reset in Active Directory and confirm it syncs, or use password writeback.
• Revoke sessions in Entra ID, or run Revoke-MgUserSignInSession, so refresh tokens stop working.
• Review authentication methods and delete any phone number, authenticator app or passkey the user does not recognize.
• If you have Entra ID P2, mark the user as compromised in Identity Protection to raise their risk level.

Remove persistence

Attackers set traps so they can keep reading mail or get back in after a reset. Check each of these before you unblock the user.

Investigate what happened

Before deleting anything, preserve evidence. Export the user's sign-in logs, the unified audit log for the account, inbox rules and message trace results. If Microsoft Defender XDR raised an incident, it often links the related alerts, sign-ins and emails in one place.

Answer four questions: how the attacker got in, when it started, what they accessed, and what they sent. The sign-in logs show IP addresses, locations, apps and whether MFA was satisfied. MailItemsAccessed and file access events in the audit log help show what data was viewed or downloaded.

Handle the business side

If the mailbox sent fraudulent payment instructions, call the recipients by phone using known numbers and tell finance to stop any pending changes to bank details. If sensitive or regulated data may have been exposed, bring in legal counsel and your cyber insurer early, because breach notification rules and policy terms can set deadlines.

If Microsoft restricted the account from sending because of outbound spam, release it in the Defender portal under restricted entities once the account is clean.

Close the gap

Most compromises trace back to a phished password and a weak or missing MFA method, legacy authentication, or a consent phishing app. Fix the root cause, not just the account.

• Move the user, and their peers in finance and leadership, to phishing-resistant MFA.
• Block legacy authentication and disable automatic external forwarding tenant-wide.
• Restrict user consent to apps and turn on the admin consent workflow.
• Add Conditional Access for compliant devices and risk-based policies where licensed.
• Write the incident up and update the response runbook.

How Accred Consulting approaches it

Accred Consulting helps organizations prepare for and respond to account compromise. For response, US-based specialists work with your team to contain the account, remove persistence, preserve and review the logs, and recommend fixes. For preparation, discovery reviews logging, MFA and consent settings, then the proposal sets a clear scope, fixed price and timeline for hardening and a written response runbook. Accred does not replace your legal counsel or insurer. Handover includes documentation, the runbook and knowledge transfer, with optional support retainers.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions