What to do if a Microsoft 365 account is hacked

Block sign-in and revoke the account's sessions, reset the password and MFA methods, then remove any forwarding, inbox rules or delegates the attacker added. Microsoft's guidance on compromised Microsoft 365 mailboxes lists unexpected forwarding and inbox rules as common signs. Search the audit log before cleanup so you can show what was read and who was emailed.

• Contacts report phishing or odd invoices from the user's address.
• Inbox rules that forward mail outside, delete it, or move it to folders like RSS Subscriptions, Notes or Junk Email.
• New external forwarding on the mailbox.
• The mailbox is blocked from sending (Microsoft restricts accounts that send spam).
• Sign-ins from unfamiliar countries or hosting providers, or MFA methods the user didn't add.

1. 01

   Block sign-in or disable the account

   Microsoft's guidance is to block access as soon as possible. If you can't disable it, reset the password immediately.

2. 02

   Revoke sessions and refresh tokens

   In Microsoft Graph PowerShell: Connect-MgGraph -Scopes User.RevokeSessions.All, then Revoke-MgUserSignInSession -UserId <user>. This ends sign-ins that a stolen session would otherwise keep alive.

3. 03

   Check the account's admin roles

   If the user held any admin role, the investigation now covers the whole tenant.

• Set a new strong password from a clean device. For accounts synced from Active Directory, reset in AD; Microsoft recommends resetting twice.
• Delete existing app passwords; they aren't revoked by a password reset.
• Review the user's registered MFA methods and remove any phone number or authenticator the user doesn't recognize. Attackers often register their own so they can return.
• Re-enable sign-in only once rules, forwarding and consents are dealt with.

Microsoft's documentation gives two quick Exchange Online PowerShell checks: Get-Mailbox -Identity <user> | Format-List Forwarding*Address,DeliverTo* shows mailbox-level forwarding, and Get-InboxRule -Mailbox <user> -IncludeHidden lists every rule, including hidden ones, with their forward and redirect targets.

Also check mailbox delegates (Full Access, Send As, Send on Behalf) and, if the attacker had admin rights, whether a mail flow (transport) rule was added.

Review enterprise applications in Microsoft Entra ID for permissions the user granted, and revoke anything unexpected, especially apps that can read or send mail, read files or keep offline access. A malicious app keeps working after a password reset. Consider restricting user consent tenant-wide so admins approve new apps.

The Microsoft Purview audit log is your record of what the attacker did: sign-ins, mailbox items accessed (MailItemsAccessed, where your licence records it), rules created, files downloaded and messages sent. Audit (Standard) records generated since October 2023 are kept for 180 days by default, so export the relevant window now. If the findings have to stand up for an insurer, a bank or counsel, see Microsoft 365 and Exchange forensics.

Combine the audit log with Entra sign-in logs and message trace to build a timeline. That timeline answers the two questions you will be asked: what did they see, and what did they send?

Use message trace and the Sent Items folder to identify mail sent during the compromise window. Warn recipients by phone or from a clean account. Search other mailboxes for the same phishing message and purge it.

If the attacker could read mail containing personal information, you may have a privacy breach to assess under PIPEDA or provincial law, and a breach record to keep either way. If money changed hands, see What to do if you sent a payment to a fraudster. For help, call the 24/7 line at (289) 582-9930.