Compromised Microsoft 365 account: a first-response guide

A compromised account is an incident, not just a password reset

An attacker can retain several access paths after obtaining a password: issued tokens, an added MFA method, a hidden inbox rule, external forwarding, OAuth consent, or a session in a third-party application. Response must contain access, preserve evidence, remove persistence, and validate recovery.

This guide describes a structured first response. It does not replace a complete forensic investigation, especially when the account is privileged, sensitive data might have been accessed, multiple identities are affected, or the initial access remains unknown.

• Microsoft — Respond to a compromised email account ↗

The first 15 minutes: contain without destroying evidence

Collection must not delay urgent containment. Take a minimal timestamped snapshot, then block access. Store exports in a protected location with access control, hashing, or traceability appropriate to the incident process.

• Open an incident, work in UTC, and record time, trigger, user, administrator, and every action.
• Capture Defender XDR alerts, recent Entra sign-ins, authentication methods, devices, roles, and visible applications.
• Block new sign-ins. For a hybrid identity, also disable the authoritative on-premises account and accelerate synchronization when the process allows it.
• Revoke sessions and refresh tokens, while recognizing that some access tokens or application cookies can remain valid until expiry.
• Isolate the suspected device with the endpoint team or Defender for Endpoint; do not immediately return the user to a potentially compromised device.
• For a privileged account, review role, policy, application, domain, connector, and transport changes before restoring access.

1. Block sign-ins and revoke sessions

In Microsoft Entra, disable the account to prevent new tokens, then use Revoke sessions. Revocation invalidates refresh tokens and requires reauthentication, but it does not instantly erase every issued access token. An application with its own session cookie or a separate local account can also continue until expiry or deprovisioning.

Conditional Access protects the next sign-in evaluation; by itself, it is not a universal sign-out button. For federated or provisioned SaaS applications, also remove assignment, disable the application account, or use its revocation mechanism when available.

$Upn = 'user@contoso.com'
Connect-MgGraph -Scopes 'User.ReadWrite.All','UserAuthenticationMethod.Read.All' -NoWelcome

$user = Get-MgUser -UserId $Upn -Property Id,DisplayName,UserPrincipalName,AccountEnabled
$user | Select-Object Id,DisplayName,UserPrincipalName,AccountEnabled

# Containment action: prevent new sign-ins
Update-MgUser -UserId $user.Id -AccountEnabled:$false

# Invalidate refresh tokens and revocable sessions
Revoke-MgUserSignInSession -UserId $user.Id

• Microsoft — Revoke user access in an emergency ↗

2. Secure the secret and authentication methods

Reset the password to a random value through an approved administrative channel, without placing it in the ticket or email. In a hybrid environment, reset it at the correct authority. Provide a temporary secret only after verifying the user's identity and from a clean device.

Inventory MFA methods, FIDO2 keys or passkeys, Microsoft Authenticator, phone numbers, Temporary Access Pass, and software methods. Remove only methods added or controlled by the attacker; mass deletion without evidence can lock out the user and complicate attribution. Require new registration when the risk warrants it.

$methods = Get-MgUserAuthenticationMethod -UserId $user.Id
$methods | ForEach-Object {
  [pscustomobject]@{
    Id = $_.Id
    Type = $_.AdditionalProperties['@odata.type']
    Details = ($_.AdditionalProperties | ConvertTo-Json -Compress -Depth 4)
  }
} | Format-Table -AutoSize

• Microsoft — Manage a user's authentication methods ↗

3. Inspect the mailbox before cleaning it

Attackers use rules to forward, delete, or move replies into an inconspicuous folder. Check visible and hidden rules, mailbox forwarding, delegation, Send As, Send on Behalf, automatic replies, and applications with Exchange access.

Export results and modification times first when available. Then remove malicious rules or forwarding selectively. A compromised mailbox may also appear in Restricted entities after sending spam; remove it from that list only after regaining control.

$Mailbox = 'user@contoso.com'
Connect-ExchangeOnline -ShowBanner:$false

Get-Mailbox -Identity $Mailbox |
  Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward

Get-InboxRule -Mailbox $Mailbox -IncludeHidden |
  Select-Object Name,Enabled,Priority,ForwardTo,ForwardAsAttachmentTo,RedirectTo,`
    DeleteMessage,MoveToFolder,Description

Get-MailboxPermission -Identity $Mailbox |
  Where-Object { -not $_.IsInherited -and $_.User -notlike 'NT AUTHORITY\SELF' }

Get-RecipientPermission -Identity $Mailbox |
  Where-Object { $_.Trustee -ne 'NT AUTHORITY\SELF' }

• Microsoft — Investigate suspicious rules and forwarding ↗
• Microsoft — Restricted users and entities ↗

4. Look for OAuth consent and application persistence

A password change does not automatically remove OAuth consent granted to an application. In Entra ID, examine enterprise applications, user and admin consent, delegated permissions, service-principal sign-ins, owners, and credentials.

Do not delete an application because its name looks unfamiliar. Confirm publisher, AppId, ServicePrincipalId, scope, consenting user, and activity. Remove the compromised grant or assignment, disable the application if necessary, and search for other affected users. An application permission or admin consent expands the incident to the tenant immediately.

• Article — Audit OAuth apps and Microsoft Graph permissions →
• Microsoft — Compromised and malicious applications ↗

5. Build the timeline from logs

Define a window that begins before the first known signal. Preserve UTC timestamps, event identifiers, and original exports. Do not label an IP as malicious only because it is new: VPN, mobile networks, proxies, and travel can change geolocation.

MailItemsAccessed can help assess message exposure when licensing and audit coverage permit. The absence of an event does not prove the absence of access; document coverage, retention, and gaps.

• Microsoft — Use MailItemsAccessed to investigate compromised accounts ↗
• Microsoft — Search the audit log ↗

6. Determine the actual scope

If the account has a privileged role, consented to a high-impact Graph permission, or changed security controls, do not confine the analysis to the user's mailbox. Move to a tenant investigation and involve security, legal, privacy, and insurance stakeholders according to the incident plan.

• Email sent, deleted, accessed, or forwarded; internal recipients who clicked or replied.
• OneDrive and SharePoint files accessed, downloaded, shared, or deleted.
• Teams conversations, meetings, applications, tabs, and files available to the account.
• Groups, roles, shared mailboxes, and delegation that expand the account's reach.
• OAuth applications, registered devices, MFA methods, and secrets added during the window.
• Administrative actions, Conditional Access policies, Exchange connectors, transport rules, or domains changed.
• Other accounts sharing the same IPs, phishing campaign, application, or compromised device.

7. Recover the account without reopening the door

For a synchronized account, avoid a race between on-premises Active Directory and Entra ID. Record where password, account state, groups, and methods are managed so the next synchronization does not reintroduce an unwanted state.

• Confirm the original device was analyzed, isolated, or reset according to the verdict.
• Remove authentication methods, rules, forwarding, delegation, and OAuth grants confirmed as malicious.
• Reset the password at the correct authority and enroll a phishing-resistant method where possible.
• Re-enable the account only after documented exit criteria and second-person approval.
• Restore required access at least privilege; do not automatically restore an unknown permission.
• Test Outlook, Teams, OneDrive, and business applications from a clean device.
• Warn users about fraudulent messages sent from the account and provide a reporting channel.

8. Monitor after restoration

The monitoring period depends on the scenario, log retention, and risk. Use Defender XDR, Entra ID Protection, and Purview alerts where licensing provides them, while retaining manual follow-up for evidence or signals not covered.

A first-response report that supports the next step

Separate facts, hypotheses, and unknowns. First response aims to stop access and prepare a reliable investigation; it should not create artificial certainty about data that was read or exfiltrated.

When to escalate to a full investigation

A full investigation correlates identity, email, devices, applications, and data, then assesses notification obligations. It requires evidence handling, approved scope, and people authorized to process the data.

• Privileged account, activated role, or changed security policy.
• Admin consent, application permission, or suspicious multi-user application.
• Possible access to personal, financial, health, or regulated information.
• Multiple accounts, compromised device, internal phishing, or lateral movement.
• Incomplete logs, unknown origin, recurring persistence, or actions after revocation.
• Potential notification duty, legal hold, or insurer request.

• Service — Microsoft 365 and Entra ID security assessment →
• Article — Why MFA is not enough against token theft →
• Article — Move Conditional Access from report-only to enforced →