What to do when a Microsoft 365 account is compromised

Resetting the password is the step everybody knows and it is not enough on its own. An attacker with an hour in a mailbox leaves things behind that survive a password change: a live refresh token, a hidden forwarding rule, a consented application, an extra authentication method registered to their own phone. This is the order to work in, and the things to look for that are easy to miss.

Signs that this is what you are dealing with

Microsoft’s own list of common symptoms, which is a good starting point because it maps to what people actually report.

• The mailbox has been blocked from sending email.
• Messages are missing or have been deleted.
• Suspicious inbox rules: anything forwarding externally, or quietly moving messages into Notes, Junk Email or RSS Subscriptions.
• Odd messages in Sent Items or Deleted Items.
• Changes to the person’s entry in the address list, such as a changed telephone number.
• Frequent password changes or unexplained lockouts.
• Recently added external email forwarding.
• Strange email signatures, often fake banking or prescription drug ones.

The order to work in

1. Disable the account, or reset the password. Disabling is cleaner if you can. If not, reset to a genuinely strong password, and if the account is synchronised from on-premises Active Directory, reset it there, twice, to mitigate pass-the-hash. Delete and recreate any app passwords, which a reset does not revoke.
2. Revoke the sessions. This is the step most often skipped and it is the one that matters. A password reset alone leaves existing refresh tokens valid, so the attacker stays signed in. In Microsoft Graph PowerShell: Connect-MgGraph -Scopes User.RevokeSessions.All then Revoke-MgUserSignInSession -UserId <UPN>. From the admin center, the equivalent is Users, Active users, the user, the Account tab, Sign out of all sessions.
3. Check the registered authentication methods. Attackers add their own. Remove any device or method you and the user cannot both account for, then confirm multifactor authentication is enabled and enforced.
4. Look at consented applications. An illicit consent grant keeps access to the mailbox with no password at all. Review what the account has granted and revoke anything unexpected.
5. Check what roles the account holds. If it was an administrator, widen the investigation immediately. The blast radius is the whole tenant, not one mailbox.
6. Hunt the forwarding and the rules. See below. This is where the persistence usually hides.
7. Then, and only then, re-enable the account. Reset the password again and bring it back.
8. Get it off the restricted list if it sent spam. See below.

Hunting the rules properly

Two separate things forward mail and both need checking. Mailbox level forwarding is set on the mailbox; inbox rules are set inside it. And rules can be hidden, which is exactly why the switch exists.

If the mailbox is blocked from sending

An account that has been used to send spam usually ends up on the restricted list, and users see a bounce with code 5.1.8 saying they were not recognised as a valid sender. Clear it only after you have finished the investigation, not before.

1. Open the Microsoft Defender portal. Go to Email & collaboration, then Review, then Restricted entities.
2. Select the user and click Unblock. Work through the flyout, click Next, then Submit, then confirm with Yes. You can enable multifactor authentication and reset the password from the same flow.
3. Allow up to an hour. Restrictions usually clear within the hour. Occasionally it takes longer, but it should never be more than 24 hours.

Where to look for the evidence

• Sign-in logs in the Microsoft Entra admin center. Compare IP address, location, time, and whether each attempt succeeded or failed.
• Audit logs in the Microsoft Defender portal. Microsoft’s advice is worth following exactly: filter by a date range starting just before the suspicious activity, and do not filter by specific activities on the first pass. You do not yet know what you are looking for.
• Message trace in the Defender portal, alongside the contents of the Sent Items folder, to work out what actually went out and to whom.

Afterwards

• Work out what left the building. If client or staff personal data was in that mailbox, the business may have a reportable breach and the deadlines are short. That decision belongs to whoever advises them on data protection, and they need telling today.
• Warn the contacts who were emailed from the account. The next wave usually goes to whoever appears in the sent items.
• Ask why the account was reachable. A compromised account almost always means either no multifactor authentication, or a method that can be phished. Fixing that is the only part of this that stops it happening again.

A note on portal names

Microsoft renames these regularly, and older guides you find online will use the previous names. The Security and Compliance Centre is now the Microsoft Defender portal. The Azure AD portal is now the Microsoft Entra admin center. Restricted Users is now Restricted entities.

If you need a hand

Call the service desk on 03333 22 11 00. If you believe an account is compromised right now, ring rather than emailing, and say so at the start of the call. If we manage your tenant we will work the sequence above with you and give you a written account of what we found.

Response sequence, commands and portal paths checked against Microsoft’s documentation, Respond to a compromised cloud email account and Remove blocked users from the Restricted entities page, September 2026. Checking mailbox delegates, which Microsoft covered in older guidance and dropped from the current page, remains worth doing. Nothing here is legal advice on breach reporting.