Suspected Microsoft 365 account compromise: a practical IT checklist

Prerequisites and impact

For Microsoft 365 administrators. Blocking an account affects the user's work: confirm the correct organisation and account and coordinate with the incident owner. Use a secure computer and a communication channel outside the suspected compromised mailbox.

1. Restrict access

Microsoft recommends disabling the affected account during the investigation and revoking the user's sessions. Change the compromised password at the identity source that actually manages the account. Do not send a new password through the compromised email account. [1]

2. Look for ways back in

1. Review registered authentication methods and remove unfamiliar methods after preserving the necessary information. [1]
2. Review consented applications and assigned administrative roles. Revoke unauthorised access based on a documented assessment. [1]
3. Check mailbox forwarding and inbox rules, including hidden rules. Preserve details of suspicious rules before removing them. [1]

3. Investigate the scope

Review sign-in and audit logs from before the suspected activity onwards. Where logs allow, check what was actually read, changed or sent. Available logs and retention vary with service and licence; missing logs are not proof that nothing happened. [1]

4. Restore and verify

• The attacker's identified access paths have been addressed and the user's identity has been verified.
• The intended strong authentication works in a new sign-in.
• Email rules, forwarding and important account settings have been reviewed.
• Restore access only when the responsible person considers it appropriate; monitor for further anomalies afterwards.

Your checkmarks are stored only in this browser.

Important limitation

Revoking sessions does not mean that every previously issued token and each application's own session end at the same instant. Follow Microsoft's guidance for the affected services and continue monitoring activity. [2]