How do you remediate a compromised Microsoft 365 account?

When a Microsoft 365 account is compromised, the attacker often does three things quickly: signs in from somewhere new, sets up a way to keep access, and starts using the mailbox to phish or defraud others. Remediation means undoing all three, in the right order. This guide is the admin checklist, with the portal path and PowerShell command for each step at the time of writing (November 2026).

If you're not yet sure the account is compromised, start with the signs an email account is compromised. Running Google Workspace instead? See Google Workspace compromised account recovery.

What should you do in the first 15 minutes?

Contain first, investigate second. Microsoft says its steps "address known methods that might allow the attacker to maintain persistence," so do every one of them (Microsoft Learn).

1. Disable the account in the Microsoft Entra admin center. Microsoft calls this "preferred and highly recommended until you complete the investigation."
2. Revoke sessions so existing sign-ins and refresh tokens stop working.
3. Reset the password from a device you trust. Don't email the new password to the user, "because the attacker could have access to the mailbox."
4. Delete app passwords and remove MFA methods the user didn't add.
5. Remove forwarding and malicious inbox rules, after noting what each one did.
6. Check app consents and admin roles.
7. Investigate sign-ins, the audit log and sent mail.
8. Restore the account and, only then, unblock sending.

How do you block sign-in and revoke sessions?

Disabling the account stops new sign-ins. Revoking sessions invalidates the refresh tokens the attacker already holds. You need both, because Microsoft Entra access tokens "last for 1 hour" by default and stay usable until they expire (Microsoft Learn).

In the Microsoft Entra admin center:

1. Go to Entra ID > Users > All users and select the user.
2. Under Account status, select Edit, clear Account enabled, and select Save.
3. On the user's Overview page, select Revoke sessions.

You need at least the User Administrator role for regular users, or Privileged Authentication Administrator if the compromised account is an admin.

The same steps in Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "User.ReadWrite.All","User.RevokeSessions.All"
$user = Get-MgUser -Search UserPrincipalName:'jason@contoso.com' -ConsistencyLevel eventual
Update-MgUser -UserId $user.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user.Id

If you only have the Microsoft 365 admin center open, Users > Active users > user > Block sign-in works too, but Microsoft warns that blocking "can take up to 24 hours to take effect." The faster route there is Reset password, then Sign out of all sessions on the user's Account tab, which prompts the user to sign in again "within an hour" (Microsoft Learn). Outlook on the web may stay open until the user refreshes or opens another app.

For synced accounts, disable the user and reset the password in on-premises Active Directory. Microsoft recommends resetting it twice to reduce the risk of pass-the-hash attacks. For federated accounts, change the password in the on-premises environment.

How do you remove attacker MFA methods and app passwords?

Attackers who get past MFA often register their own authenticator app or phone number, so they can sign in again after you reset the password. Remove anything the user can't vouch for.

1. In the Microsoft Entra admin center, go to Entra ID > Users, select the user, and select Authentication methods.
2. Review every method with the user over a phone call or in person, not by email. Delete any phone number, authenticator app, passkey or security key they don't recognize.
3. If you're unsure, select Require re-register MFA. Microsoft says this deletes the user's phone numbers, Microsoft Authenticator apps and software OATH tokens, and deactivates hardware OATH tokens, so the user sets up MFA again at next sign-in (Microsoft Learn).
4. Delete app passwords: Entra ID > Users > Multifactor authentication, select the user, Manage user settings, then Delete all existing app passwords generated by the selected users. Microsoft notes that app passwords "aren't automatically revoked when you reset the password."

These actions need at least the Authentication Administrator role. If the account isn't covered by MFA at all, fix that before you re-enable it; see Microsoft 365 security defaults and MFA.

How do you find and remove forwarding, inbox rules and delegates?

The mailbox is where attackers hide. Microsoft lists rules that forward mail to unknown addresses and rules that move messages to Notes, Junk Email or RSS Subscriptions as common symptoms. Check three places in Exchange Online PowerShell.

1. Mailbox forwarding.

Get-Mailbox -Identity jason@contoso.com | Format-List Forwarding*Address,DeliverTo*

A value in ForwardingSmtpAddress means mail is forwarded to an external address. Clear it with:

Set-Mailbox -Identity jason@contoso.com -ForwardingSmtpAddress $null -ForwardingAddress $null

2. Inbox rules, including hidden ones.

Get-InboxRule -Mailbox jason@contoso.com -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,Identity

Here's an illustrative example of a suspicious rule in the output (the values are invented):

Name                  : ..
Enabled               : True
RedirectTo            :
ForwardTo             : "acct.review@outlook.example" [SMTP:acct.review@outlook.example]
ForwardAsAttachmentTo :
Identity              : jason\10210541742734704641

A rule named with a single character or punctuation, forwarding externally or deleting messages containing words like "invoice" or "hacked," is a red flag. Export the details with Get-InboxRule -Identity "<Identity>" -IncludeHidden | Format-List for your incident notes, then remove the rule with Remove-InboxRule -Identity "<Identity>". Microsoft notes that changing Inbox rules in PowerShell removes any client-side rules created in Outlook, so record the user's legitimate rules first. Our guide to malicious inbox rules and auto-forwarding covers tenant-wide hunting and how to check when each rule was created.

3. Mailbox delegates.

Get-MailboxPermission -Identity jason@contoso.com | Where-Object { $_.IsInherited -eq $false }

Look for accounts with FullAccess that shouldn't have it. By default, only NT AUTHORITY\SELF is directly assigned to a user's own mailbox (Microsoft Learn), so any other direct entry needs an explanation. In Exchange Online PowerShell, Microsoft recommends the Get-EXOMailboxPermission version of this cmdlet.

Also check the user's Outlook signature and automatic replies. Attackers sometimes change them to support a payment fraud.

How do you check app consents and admin roles?

A consent grant isn't removed by a password reset or session revocation, so a malicious app can keep or regain access to the mailbox until you revoke it. In the Microsoft Entra admin center, review the user's application consents and revoke anything they didn't knowingly approve, especially apps with mail permissions such as Mail.Read or Mail.ReadWrite. Our guide to OAuth consent phishing shows how to find and revoke grants.

Then review the user's admin roles in Entra, Purview and Defender and remove any that shouldn't be there. If the compromised account is a Global Administrator, also review recent changes to other admin accounts, Conditional Access policies and mail flow rules.

How do you find out what the attacker did?

Use the sign-in logs to fix the time window, then review everything the account did inside it.

• Microsoft Entra sign-in logs: note the IP addresses, locations, times and whether each sign-in succeeded.
• Audit log (Defender or Purview portal): search from just before the first suspicious activity, without activity filters at first, as Microsoft advises. Then look for New-InboxRule, Set-Mailbox, Send and MailItemsAccessed. The audit log investigation guide explains each event.
• Message trace and Sent Items: list every message the account sent in the window. Payment requests, replies inserted into invoice threads and mass mailings are the most urgent.
• Device code and session attacks: if the user approved an MFA prompt or typed a code, read adversary-in-the-middle phishing and device code phishing, because these attacks steal tokens rather than passwords.

If the attacker sent phishing to other people in your tenant, remove those messages too, using the steps in how to remove a phishing email from all mailboxes.

How do you restore the account and unblock sending?

Once the investigation is done:

1. Set a new password and re-enable the account. Give the password to the user by phone or in person.
2. Confirm MFA is registered with methods the user controls.
3. Unblock sending if needed. If the account sent spam, Microsoft may have blocked it, and the user's mail bounces with 550 5.1.8 Access denied, bad outbound sender. In the Microsoft Defender portal, go to Email & collaboration > Review > Restricted entities, select the mailbox, and choose Unblock. Or run Remove-BlockedSenderAddress -SenderAddress jason@contoso.com.

Microsoft says restrictions should normally lift "within one hour," and the total wait "should be no longer than 24 hours" (Microsoft Learn). Before you unblock, Microsoft suggests running the Blocked Sender History diagnostic (https://aka.ms/senderhistory) to see the account's listing history and MFA status.

Who do you need to tell?

Tell the people who received mail from the account during the window, by phone for anyone who got a payment request. If money moved, call the bank immediately and report it to the FBI's Internet Crime Complaint Center at ic3.gov. Our guide to business email compromise covers the payment side. If the mailbox held regulated data, involve whoever handles your legal and notification obligations.

How do you stop it happening again?

Check that the User restricted from sending email alert goes to someone who reads it. By default it notifies the TenantAdmins group.

Next steps

• Write these steps into your email security incident response plan, with the names of the people who hold each admin role.
• Keep the original phishing email that started the incident, with headers. The Email Header Analyzer shows where it really came from.
• Run a tenant-wide check for hidden inbox rules and external forwarding after every compromise, not just on the affected mailbox.
• Fewer phishing emails reaching inboxes means fewer stolen passwords. iBlockSpam filters inbound mail at the MX for Microsoft 365 with per-domain pricing.

Browse our other email operations guides.