How to Respond When Your M365 Account Was Hacked

How to Respond When Your Microsoft 365 Account Has Been Hacked

Your Microsoft 365 account is compromised. Here is what to do, in the order to do it.

Contain first. Investigate second.

Signs Your Microsoft 365 Account Has Been Compromised

Check these before starting the response sequence:

You cannot log in and did not change your password
Colleagues report strange emails from your address
Your Sent Items folder has messages you did not send
Mailbox rules include forwards you did not create
M365 admin center shows sign-ins from unfamiliar locations or devices
You received password reset notifications you did not request

If any of these match, treat the account as compromised and start below.

Step 1 - Sign the Attacker Out of All Sessions

The attacker is already logged in. Get them out first.

In the M365 admin center:

Go to Users > Active users
Select the compromised account
Click "Sign out of all sessions"

Or in PowerShell:

Revoke-MgUserSignInSession -UserId compromised@yourdomain.com

Do this before changing the password. If you reset the password first and the attacker still has a valid session token, they may be able to use it to request a new token.

Step 2 - Reset the Account Password

Now change the password. Use a strong, randomly generated password.

In the M365 admin center:

Users > Active users > select the account
Reset password
Require a change at next sign-in

Verify that the MFA method has not been altered. If the attacker added their phone number or an alternate email for recovery, remove it.

Step 3 - Revoke Suspicious App Consents

Attackers use OAuth app consents for persistence. Even after a password reset, a malicious app with held permissions can re-establish access.

Check and revoke at https://myapplications.microsoft.com while signed in as the compromised user.

Remove anything you did not approve. Pay special attention to apps with these permissions:

Mail.Read, Mail.Send
Files.ReadWrite
User.ReadWrite.All

In the M365 admin center, Azure AD Enterprise applications also shows consent grants across the tenant.

Step 4 - Review Mailbox Audit Logs

Find out what the attacker did.

Enable mailbox audit if not already on:

Set-Mailbox -Identity compromised@yourdomain.com -AuditEnabled $true

Search the last 30 days:

Search-MailboxAuditLog -Identity compromised@yourdomain.com -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) | Where-Object { $_.Operation -ne "MailboxLogin" } | Select-Object Operation, OperationResult, ObjectId, ClientInfoString

Watch for:

MailItemsAccessed -- emails read
SendAs, SendOnBehalf -- mail sent as you
SoftDelete, HardDelete -- evidence removed
UpdateInboxRules -- forwarding rules created

Step 5 - Remove Unauthorized Forwarding Rules

Attackers set up forwarding rules to keep reading your mail after you take it back.

Check inbox rules:

Get-InboxRule -Mailbox compromised@yourdomain.com | Select-Object Name, Enabled, ForwardTo, RedirectTo, DeleteMessage

Check mailbox-level forwarding:

Get-Mailbox compromised@yourdomain.com | Select-Object ForwardingSmtpAddress, DeliverToMailboxAndForward

Remove any you did not create:

Set-Mailbox -Identity compromised@yourdomain.com -ForwardingSmtpAddress $null

Then delete the malicious inbox rules.

Step 6 - Notify Affected Users and Your IT Team

Tell people what happened, briefly.

If the attacker sent phishing from your account, notify recipients to delete any suspicious emails. Do not include login links in this message.

If the compromised account had admin roles or access to shared resources, alert your IT team and check those access paths immediately.

Did the Attacker Send Email as Your Domain?

This step is easy to skip. Do not skip it.

If the attacker had access to your account, they had access to your contacts and potentially the ability to send mail "from" your domain.

The fastest way to find out is to check your DMARC aggregate reports for the days around the compromise. DMARC reports show every mail source that attempted to send from your domain, including the IPs, the result (pass or fail), and the volume.

Any IP you do not recognize in those reports is worth investigating. If you do not currently receive DMARC reports, set them up now -- the configuration takes minutes and the reports are the only way to see whether unauthorized sending actually happened.

Frequently Asked Questions

How long does account recovery take?

Most accounts can be restored within a few hours. Full damage assessment takes 24 to 72 hours depending on what the attacker accessed.

Should I delete the compromised account?

No. Deleting removes the mailbox and stops audit logging before you have finished investigating. Disable the account instead. Delete it only after the incident is closed and you have preserved the audit data.

Does MFA prevent account compromise?

MFA makes credential theft significantly harder but not impossible. SIM-swap attacks, MFA fatigue attacks, and real-time phishing can still bypass it. Still: enable MFA and prefer phishing-resistant methods (FIDO2 hardware keys or Windows Hello for Business) over phone-based OTP.

Can a compromised account hurt my domain's email reputation?

Yes. If the attacker sent mail through your M365 tenant using your domain, it used your SPF record. High volume or malicious content can affect your sender reputation. Check your outbound mail logs and DMARC reports for the compromise window.

Should I tell people my account was hacked?

Yes, if the attacker sent mail to your contacts. A brief, factual message helps them recognize any phishing that followed. Keep it short. Do not include login links.

Step 7 - Prevent the Next One

After the incident is closed:

Enable phishing-resistant MFA (FIDO2 or Windows Hello for Business)
Review who has privileged admin roles
Set up Conditional Access policies to block sign-ins from unexpected locations
Enable/examine sign-in risk detection in Microsoft Entra
Set up DMARC reports so the next compromise is visible in your mail flow data

The last point matters for email security specifically. DMARC reports do not prevent a compromise, but they are the fastest way to know whether one has spread to your email domain.

Summary

Sign the attacker out of all sessions
Reset the password
Revoke suspicious OAuth app consents
Review mailbox audit logs
Remove unauthorized inbox rules and forwarding
Notify affected users
Check DMARC reports for unauthorized domain sending
Enable phishing-resistant MFA and Conditional Access policies

Steps 1 through 3 take under ten minutes. Step 7 is the one most people skip -- do not skip it.