Microsoft 365 account compromised: what to do in the first hours

This guide is based on Microsoft’s playbooks and on our work in Microsoft 365 security projects.

Signs that something happened

Users get strange email from a colleague, or hundreds of messages went out from one account.
A new inbox rule forwards mail outside, or moves it to a folder nobody opens.
A risky user or risky sign-in alert in Microsoft Entra ID Protection or Microsoft Defender.
A new MFA method or device the user didn’t register.
An app that was granted access to mail or files, and nobody in the organization recognizes it.

Step 1: contain the account, in order

Disable the account. This is Microsoft’s first recommendation: while the account is disabled, nobody can sign in again.
Reset the password. For accounts synced from on-premises Active Directory, Microsoft recommends resetting it twice. Note that a password reset doesn’t revoke app passwords; delete those separately.
Revoke all sessions. A password reset alone doesn’t lock the attacker out: a token already issued can work for up to about an hour. In apps that support continuous access evaluation, such as Exchange, SharePoint and Teams, revocation usually takes effect within minutes.
Remove what the attacker added. Authentication methods and devices the user doesn’t recognize, and admin roles the account shouldn’t have.
Share the new password through another channel. Not by email: the attacker may still be reading the mailbox.

Step 2: find what the attacker left behind

Attackers rarely settle for one way in. They leave ways back, or ways to keep receiving mail after the account is closed:

Inbox rules, including hidden ones. A known sign is a rule that moves messages to the Notes, Junk Email or RSS Subscriptions folders, so the user doesn’t see replies.
Forwarding, both on the mailbox and in rules. The outbound spam policy can block automatic external forwarding for the whole organization.
App consents (OAuth): in the Entra ID audit log, look for the Consent to application activity. A consent granted for the whole organization is riskier than one granted by a single user.
Admin roles and registered devices: whether the account got a new role, and whether a device that isn’t the user’s was registered in Entra ID.

Three quick checks in PowerShell:

# Inbox rules, including hidden ones
Get-InboxRule -Mailbox user@contoso.com -IncludeHidden

# Forwarding set on the mailbox
Get-Mailbox user@contoso.com | Format-List Forwarding*Address,DeliverTo*

# Revoke all sign-in sessions (Microsoft Graph PowerShell)
Revoke-MgUserSignInSession -UserId user@contoso.com

Step 3: understand what was exposed

Tool	What it gives you	Note
Audit in Microsoft Purview	Who did what and when: sign-ins, file access, mailbox changes	On by default; check nobody turned it off. Records are kept 180 days, one year with Audit (Premium)
MailItemsAccessed	Which messages the attacker opened or synced	Included in Audit (Standard) for E3 and E5 users
Message trace	How many messages left the account, and to whom	Also what you use to notify recipients
Microsoft Defender	The full incident, with related alerts across email, identity and devices	With automatic attack disruption, Defender may already have contained part of the attack
Entra ID Protection	Risky users and risky sign-ins	Dismissing the risk doesn’t secure the account. Mark the user Confirm compromised, then reset the password; the reset is what clears the risk

Step 4: clean up and report

Malicious email already delivered: with Defender for Office 365 Plan 2 you can delete it from every mailbox through Threat Explorer. With Plan 1 you rely on ZAP, which automatically removes messages found to be malicious after delivery, and on submissions to Microsoft.
Recipients: tell the people who got email from the compromised account, inside and outside the organization.
Reporting: organizations covered by Israel’s data security regulations may have to report a severe security incident to the Privacy Protection Authority. Check with your privacy officer or legal counsel. Israel’s National Cyber Directorate takes cyber incident reports on its 119 hotline.

After the incident: close the door

Conditional Access and phishing-resistant MFA for admin accounts first, then for everyone.
Block automatic external forwarding by default.
Admin consent workflow: users request access for an app, and an admin approves it.
A written response plan: who decides, who acts, and who talks to customers. Microsoft publishes ready-made playbooks for phishing, password spray, app consent grants and compromised apps; start from those.

This guide summarizes Microsoft’s recommendations. It isn’t legal advice about your organization’s reporting duties.

A security incident in Microsoft 365? At OnCloud we handle incidents like this: we contain it, investigate and close the gap. And if it hasn’t happened yet, we’ll help you prepare the environment and the plan in advance.