What to Do After a Microsoft 365 Account Is Compromised

Someone forwards you an email you did not send. Or a customer rings to query an invoice with bank details you do not recognise. Or a sign-in alert lands from a country none of your staff have visited. A Microsoft 365 account has been compromised, and the clock is now running on what the attacker does next.

This is the single most common serious incident we see at UK SMEs, and the good news is that it is usually recoverable if you act in the right order. This guide walks through exactly what to do, from confirming the compromise to locking the attacker out and checking what they touched. It is a companion to our full cyber incident response plan guide, focused specifically on a hacked Microsoft 365 or Entra ID account.

First, confirm it is actually a compromise

Not every odd email is a hack. Before you hit the panic button, confirm what you are dealing with. Signs of a genuine account compromise include: a sign-in from an unexpected location or device, multi-factor authentication (MFA) prompts the user did not trigger, emails in the Sent folder the user did not write, mailbox rules that quietly delete or move replies, or colleagues and customers receiving phishing or fake-invoice emails from the account. If you see any of these, treat it as a live incident and start an incident log with the current time.

Step 1: Contain the account

Your first job is to stop the attacker doing anything else while you investigate. In order:

• Block sign-in for the affected account in the Microsoft 365 admin centre or Entra admin centre. This is faster and less disruptive than deleting anything.
• Reset the password to something new and strong. Do not reuse an old one.
• Revoke active sessions and refresh tokens. This is the step people miss. In Entra ID, “revoke sessions” (or “sign out everywhere”) kills the attacker’s existing logins, not just future ones. Without it, a stolen session token can keep them in for hours.
• Re-secure MFA. Check the authentication methods registered on the account and remove any you do not recognise, because attackers often add their own phone number or authenticator so they can get back in.

Once the account is contained, you can investigate without the attacker moving the goalposts underneath you.

Step 2: Investigate what they did

An attacker in a mailbox is rarely just reading email. They set things up to profit and to keep access. Work through this list and record what you find:

Step 3: Check for payment fraud and onward phishing

The most costly outcome of a mailbox compromise is usually not the mailbox itself, it is business email compromise: the attacker sits in the account, watches for an invoice or payment conversation, and steps in to redirect the money. Check specifically for:

• Any emails about payments, invoices or changes to bank details, sent or received during the exposure window.
• Phishing sent from the account to colleagues, customers or suppliers, so you can warn them.
• Whether any payment or bank-detail change actually went through. If so, contact your bank immediately, as fast action can sometimes recall a payment.

Always verify any bank-detail change by phoning the other party on a known, trusted number, never using the contact details in the suspicious email.

Step 4: Check whether it spread

One compromised account is often the first of several. Ask: were other accounts phished the same way? Did the attacker use this mailbox to phish internally and harvest more credentials? Review sign-in patterns across the tenant for the same unusual locations or devices, and reset and re-secure any other account that looks affected. If the attacker reached an administrator account, treat the whole tenant as compromised and get expert help.

Step 5: Was personal data involved?

If the attacker read or took emails and files containing people’s personal data, this may be a personal data breach with reporting duties, separate from the technical incident. Do not assume it is or is not reportable, work it through: our data breach versus cyber incident guide explains the difference, and the free toolkit includes a personal data breach assessment form. Report to the ICO within 72 hours of becoming aware only where a notifiable breach has occurred. This is practical guidance, not legal advice.

Step 6: Prevent it happening again

Once the fire is out, close the door the attacker came through. The controls that stop most of these attacks are not exotic:

• MFA on every account, ideally phishing-resistant methods rather than SMS codes.
• Conditional access to block or challenge sign-ins from unexpected locations and risky conditions.
• Turn on unified audit logging and keep it long enough to be useful.
• Restrict who can consent to third-party apps, so a single click cannot hand over mailbox access.
• Agree a payment-verification process so no bank-detail change is actioned on email alone.
• Brief your team on what modern phishing looks like, since the bad spelling that used to give scams away is long gone.

Our Microsoft 365 security service and the free Cyber Incident Response Toolkit both help you put these in place.

Frequently asked questions

Related reading: the full Cyber Incident Response Plan guide, our guide to preserving evidence, and the free Cyber Incident Response Toolkit, which includes a phishing and business email compromise playbook.