The first hour after someone says “I think my email was hacked” decides how bad the week gets. A good compromised Microsoft 365 account response is not about heroics, it is about doing a short list of things in the right order: contain the account, kill the attacker’s sessions, find what they changed, and work out what they touched.
This is the checklist I use when a client calls with a suspected account takeover. It assumes you have admin access to the Microsoft 365 admin center and the Microsoft Entra admin center, and that you are not yet sure how far the attacker got.
Minute 0 to 10: contain the account first, investigate second
The instinct is to start digging through logs. Resist it. Every minute the attacker keeps access, they can send more phishing from a trusted address, read more mail, or plant more persistence. Contain first.
Block sign-in. In the Microsoft 365 admin center, go to Users > Active users, select the user and choose Block sign-in. Microsoft notes that a block can take time to apply everywhere, so do the next steps straight away rather than waiting for it.
Reset the password. Use a long, unique password. Do not email the new password to the user, because the attacker may still be reading that mailbox. Give it to them by phone or in person. If the account syncs from on-premises Active Directory, reset it there.
Revoke all sessions. On the user’s Account tab, select Sign out of all sessions, or run Revoke-MgUserSignInSession -UserId user@yourdomain.com from Microsoft Graph PowerShell. This invalidates refresh tokens, which matters because many modern attacks steal a session rather than a password. A password reset on its own does not end a stolen session.
Remove unknown MFA methods. In the Entra admin center, open the user, go to Authentication methods, and delete any phone number, authenticator app or passkey you cannot account for. Attackers frequently register their own method so they can come back after you reset the password.
If the account belongs to an executive or someone who handles payments, call finance now and put a hold on any pending payment changes requested by email. Business email compromise is usually about money, not data.
Minute 10 to 25: hunt for persistence in the mailbox
Once the door is shut, look for anything the attacker left behind that keeps working without a sign-in. In the tenants I review after an incident, the most common leftover is an inbox rule.
Inbox rules and forwarding
Attackers love rules that move replies to RSS Feeds, Archive or a folder named with a single character, so the real user never sees the conversation. They also set up forwarding to an external address. Check both:
In Exchange Online PowerShell: Get-InboxRule -Mailbox user@yourdomain.com | Format-List Name,Enabled,MoveToFolder,ForwardTo,RedirectTo,DeleteMessage
In the Exchange admin center, review the mailbox’s Email forwarding setting and any delegates added under Mailbox delegation.
Screenshot or export anything suspicious before you delete it. You will want it for the timeline.
App consents and admin roles
An attacker with a user’s session can grant a malicious app access to mail and files. That access survives a password reset. In the Entra admin center, open the user and check Applications, or go to Entra ID > Enterprise apps and filter by recent consent. Revoke anything the user cannot explain. Then confirm the user has not picked up an admin role they should not have.
Minute 25 to 45: build the timeline from the logs
Now you can investigate. You are answering three questions: when did the attacker first get in, where from, and what did they do.
Log
Where to find it
What you are looking for
Entra sign-in logs
Entra ID > Monitoring & health > Sign-in logs
Successful sign-ins from unfamiliar countries, IPs or devices. Check both interactive and non-interactive tabs.
Entra audit logs
Entra ID > Monitoring & health > Audit logs
New MFA methods, password changes, app consents, role assignments.
Purview audit log
Microsoft Purview portal, Audit
New-InboxRule, Set-Mailbox, Send, file downloads and sharing from OneDrive or SharePoint.
Message trace
Exchange admin center, Mail flow > Message trace
Outbound mail sent during the compromise window, especially to many recipients.
Start from the first suspicious sign-in and work forward. Note the IP addresses. Then search the sign-in logs for those same IPs across all users, because attackers rarely stop at one mailbox.
One important caveat: audit logging is not switched on by default for every tenant. Microsoft’s documentation states that Business Basic, Business Standard and Business Premium tenants must enable it manually. If you find the audit log empty during an incident, that is a painful way to learn it. Turn it on today if you have not.
If the user has Defender for Office 365 Plan 2 or Microsoft 365 E5, the Microsoft Defender portal will often have already correlated the alerts into a single incident. Start there, it saves time.
Minute 45 to 60: scope, notify and restore
Decide what was exposed
Look at what the attacker could read. Did the mailbox contain patient records, client financials, or contracts? Did they access OneDrive or SharePoint files? The Purview audit log will show FileAccessed and FileDownloaded events. The MailItemsAccessed mailbox audit event, which Microsoft enables by default for users with E3 or E5 licenses, shows which messages were opened or synced, which helps a lot when you have to judge whether a breach is notifiable.
Warn the people who matter
If phishing went out from the account, tell recipients quickly and plainly that the message was not legitimate. Tell your own staff too, because internal recipients are the most likely to trust it. Regulated businesses, such as healthcare providers or accounting firms, should loop in whoever owns compliance so the notification clock is handled properly.
Give the account back safely
Before unblocking, confirm the user’s device is clean. A password stealer on the laptop will hand the new password straight back to the attacker. Run a full Microsoft Defender scan or reimage if there is any doubt. Then have the user register fresh MFA, ideally Microsoft Authenticator with number matching or a passkey, and unblock sign-in.
After the first hour: close the gap that let them in
Most account takeovers I see trace back to one of a handful of gaps: no MFA, MFA that can be phished, legacy authentication still allowed, or users free to consent to any app. Fix the root cause in the same week while everyone is paying attention.
Require MFA for every user with Conditional Access (Entra ID P1, included in Business Premium), and phishing-resistant MFA for admins.
Block legacy authentication so stolen passwords cannot be used against old protocols.
Restrict user consent to apps from verified publishers, with an admin consent workflow for everything else.
Enable the Purview audit log and confirm retention meets your needs.
Write this checklist down and store it outside Microsoft 365, so you can reach it if your tenant is the thing on fire.
Is resetting the password enough after a Microsoft 365 account is compromised?
No. A password reset does not end existing sessions or remove persistence. You also need to revoke sessions, remove unknown MFA methods, delete malicious inbox rules and forwarding, and revoke suspicious app consents.
How do I know what the attacker read?
The Purview audit log shows file access and mailbox changes. The MailItemsAccessed event shows individual messages opened or synced, and Microsoft enables it by default for E3 and E5 users. On other plans, check which mailbox actions are audited before you rely on it. Either way, you can still see sign-ins, rules, sent mail and file activity.
Should I disable the account or just block sign-in?
Blocking sign-in is the same as disabling the account in Microsoft Entra ID, and it is the recommended first step during an investigation. The mailbox keeps receiving mail, so nothing is lost while you work.
Not sure your tenant would hold up to an account takeover? Book a free Microsoft 365 security assessment and we will show you where an attacker would get in and how to close it.
The first hour after someone says “I think my email was hacked” decides how bad the week gets. A good compromised Microsoft 365 account response is not about heroics, it is about doing a short list of things in the right order: contain the account, kill the attacker’s sessions, find what they changed, and work out what they touched.
This is the checklist I use when a client calls with a suspected account takeover. It assumes you have admin access to the Microsoft 365 admin center and the Microsoft Entra admin center, and that you are not yet sure how far the attacker got.
Minute 0 to 10: contain the account first, investigate second
The instinct is to start digging through logs. Resist it. Every minute the attacker keeps access, they can send more phishing from a trusted address, read more mail, or plant more persistence. Contain first.
Users > Active users, select the user and choose Block sign-in. Microsoft notes that a block can take time to apply everywhere, so do the next steps straight away rather than waiting for it.Revoke-MgUserSignInSession -UserId user@yourdomain.comfrom Microsoft Graph PowerShell. This invalidates refresh tokens, which matters because many modern attacks steal a session rather than a password. A password reset on its own does not end a stolen session.If the account belongs to an executive or someone who handles payments, call finance now and put a hold on any pending payment changes requested by email. Business email compromise is usually about money, not data.
Minute 10 to 25: hunt for persistence in the mailbox
Once the door is shut, look for anything the attacker left behind that keeps working without a sign-in. In the tenants I review after an incident, the most common leftover is an inbox rule.
Inbox rules and forwarding
Attackers love rules that move replies to RSS Feeds, Archive or a folder named with a single character, so the real user never sees the conversation. They also set up forwarding to an external address. Check both:
Get-InboxRule -Mailbox user@yourdomain.com | Format-List Name,Enabled,MoveToFolder,ForwardTo,RedirectTo,DeleteMessageGet-Mailbox user@yourdomain.com | Format-List ForwardingSmtpAddress,DeliverToMailboxAndForwardScreenshot or export anything suspicious before you delete it. You will want it for the timeline.
App consents and admin roles
An attacker with a user’s session can grant a malicious app access to mail and files. That access survives a password reset. In the Entra admin center, open the user and check Applications, or go to
Entra ID > Enterprise appsand filter by recent consent. Revoke anything the user cannot explain. Then confirm the user has not picked up an admin role they should not have.Minute 25 to 45: build the timeline from the logs
Now you can investigate. You are answering three questions: when did the attacker first get in, where from, and what did they do.
Entra ID > Monitoring & health > Sign-in logsEntra ID > Monitoring & health > Audit logsStart from the first suspicious sign-in and work forward. Note the IP addresses. Then search the sign-in logs for those same IPs across all users, because attackers rarely stop at one mailbox.
One important caveat: audit logging is not switched on by default for every tenant. Microsoft’s documentation states that Business Basic, Business Standard and Business Premium tenants must enable it manually. If you find the audit log empty during an incident, that is a painful way to learn it. Turn it on today if you have not.
If the user has Defender for Office 365 Plan 2 or Microsoft 365 E5, the Microsoft Defender portal will often have already correlated the alerts into a single incident. Start there, it saves time.
Minute 45 to 60: scope, notify and restore
Decide what was exposed
Look at what the attacker could read. Did the mailbox contain patient records, client financials, or contracts? Did they access OneDrive or SharePoint files? The Purview audit log will show
FileAccessedandFileDownloadedevents. TheMailItemsAccessedmailbox audit event, which Microsoft enables by default for users with E3 or E5 licenses, shows which messages were opened or synced, which helps a lot when you have to judge whether a breach is notifiable.Warn the people who matter
If phishing went out from the account, tell recipients quickly and plainly that the message was not legitimate. Tell your own staff too, because internal recipients are the most likely to trust it. Regulated businesses, such as healthcare providers or accounting firms, should loop in whoever owns compliance so the notification clock is handled properly.
Give the account back safely
Before unblocking, confirm the user’s device is clean. A password stealer on the laptop will hand the new password straight back to the attacker. Run a full Microsoft Defender scan or reimage if there is any doubt. Then have the user register fresh MFA, ideally Microsoft Authenticator with number matching or a passkey, and unblock sign-in.
After the first hour: close the gap that let them in
Most account takeovers I see trace back to one of a handful of gaps: no MFA, MFA that can be phished, legacy authentication still allowed, or users free to consent to any app. Fix the root cause in the same week while everyone is paying attention.
Microsoft publishes its own step-by-step guidance in Respond to a compromised cloud email account, which is worth bookmarking alongside your own runbook.
If you want help with the prevention side, our MFA enablement service and Defender for Office 365 setup cover the two controls that stop most of these incidents. For ongoing monitoring, see our managed security service.
Frequently asked questions
Is resetting the password enough after a Microsoft 365 account is compromised?
No. A password reset does not end existing sessions or remove persistence. You also need to revoke sessions, remove unknown MFA methods, delete malicious inbox rules and forwarding, and revoke suspicious app consents.
How do I know what the attacker read?
The Purview audit log shows file access and mailbox changes. The
MailItemsAccessedevent shows individual messages opened or synced, and Microsoft enables it by default for E3 and E5 users. On other plans, check which mailbox actions are audited before you rely on it. Either way, you can still see sign-ins, rules, sent mail and file activity.Should I disable the account or just block sign-in?
Blocking sign-in is the same as disabling the account in Microsoft Entra ID, and it is the recommended first step during an investigation. The mailbox keeps receiving mail, so nothing is lost while you work.
Not sure your tenant would hold up to an account takeover? Book a free Microsoft 365 security assessment and we will show you where an attacker would get in and how to close it.