Few things cause panic faster than discovering someone may have access to your Microsoft 365 account.
Your email often contains years of business communications, customer information, invoices, contracts, and sensitive data. If an attacker gains access, they may be able to impersonate you, steal information, or launch additional attacks against your organization.
The good news is that acting quickly can significantly reduce the damage.
If you suspect your Microsoft 365 account has been compromised, follow these steps immediately.
Warning Signs Your Account May Be Compromised
Common indicators include:
- Unexpected password reset emails
- MFA prompts you didn’t initiate
- Emails appearing in your Sent folder that you didn’t send
- Missing emails
- New inbox rules you didn’t create
- Customers receiving suspicious messages from your account
- Sign-in alerts from unfamiliar locations
- Locked-out accounts
- Unexpected forwarding rules
If you notice one or more of these signs, assume the account may be compromised until proven otherwise.
Step 1: Change Your Password Immediately
The first priority is preventing further access.
Change your Microsoft 365 password immediately and choose a strong, unique password that is not used anywhere else.
Avoid:
- Reusing old passwords
- Using company names
- Using predictable patterns
A password manager can help generate and store strong passwords securely.
Step 2: Revoke Active Sessions
Changing the password alone may not be enough.
Attackers sometimes maintain active sessions even after credentials have changed.
Administrators should sign the user out of all active Microsoft 365 sessions and require reauthentication.
This forces any unauthorized users to log in again using the new credentials.
Step 3: Enable Multi-Factor Authentication
If MFA is not already enabled, do so immediately.
MFA remains one of the most effective protections against account compromise.
Even if an attacker obtains a password, MFA can prevent them from accessing the account.
Step 4: Check for Suspicious Inbox Rules
Attackers frequently create mailbox rules to hide evidence of their activity.
Examples include:
- Moving security alerts to deleted items
- Automatically deleting certain messages
- Forwarding emails to external accounts
Review all mailbox rules carefully and remove anything suspicious.
Step 5: Check for Email Forwarding
A common tactic is forwarding all incoming email to an external address controlled by the attacker.
Review:
- Forwarding settings
- Mail flow rules
- Shared mailbox permissions
Unauthorized forwarding can allow attackers to continue monitoring communications even after passwords are changed.
Step 6: Review Sign-In Activity
Microsoft 365 provides sign-in logs that can reveal:
- Unfamiliar locations
- Suspicious IP addresses
- Failed login attempts
- Unusual devices
Reviewing this information helps determine whether unauthorized access actually occurred and may provide clues about the scope of the incident.
Step 7: Notify Affected Employees
If the compromised account belongs to someone with significant access, other employees should be informed.
Attackers often use compromised accounts to send convincing phishing emails internally.
Employees should be cautious of:
- Unexpected attachments
- Urgent payment requests
- Password reset requests
- Requests for sensitive information
Step 8: Check for Business Email Compromise
One of the most common outcomes of Microsoft 365 account compromise is Business Email Compromise (BEC).
Attackers may:
- Request wire transfers
- Modify vendor payment information
- Send fake invoices
- Impersonate executives
Review recent communications carefully to determine whether fraudulent messages were sent.
Step 9: Review Other Accounts
Many users reuse passwords across multiple systems.
If the compromised password was used elsewhere, additional accounts may be at risk.
Review:
- Banking portals
- CRM systems
- Remote access tools
- Vendor portals
- Cloud storage platforms
Change passwords where necessary.
Step 10: Determine How the Compromise Happened
Recovering the account is important.
Understanding how it was compromised is equally important.
Common causes include:
- Phishing emails
- Fake login pages
- Password reuse
- Malware
- Weak passwords
- Missing MFA
Without identifying the root cause, the same problem may occur again.
What Happens If You Ignore It?
Many businesses assume changing the password solves the problem.
Unfortunately, attackers often leave behind:
- Inbox rules
- Forwarding rules
- OAuth application permissions
- Additional compromised accounts
Failing to investigate thoroughly can allow unauthorized access to continue long after the initial compromise.
Final Thoughts
A compromised Microsoft 365 account should always be treated as a serious security incident.
The faster you respond, the greater your chances of limiting damage and preventing additional compromise.
If you’re unsure whether your account has been fully secured, consider having your environment reviewed by a qualified cybersecurity professional.
In cybersecurity, speed matters—and every minute counts once an attacker gains access.