# How do you remediate a compromised Microsoft 365 account?

URL: https://iblockspam.com/blog/microsoft-365-compromised-account-remediation
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Running email day to day
Author: iBlockSpam Team

> Microsoft 365 hacked account checklist for admins: disable sign-in, revoke sessions, remove attacker MFA, rules and forwarding, then investigate and unblock.

## Short answer

Disable the account in the Microsoft Entra admin center, select Revoke sessions, and reset the password from a clean device. Then delete app passwords, remove MFA methods the user doesn't recognize, check app consents and admin roles, and remove forwarding and inbox rules. Investigate the logs, re-enable the account, and only then unblock it on Restricted entities.

When a Microsoft 365 account is compromised, the attacker often does three things quickly: signs in from somewhere new, sets up a way to keep access, and starts using the mailbox to phish or defraud others. Remediation means undoing all three, in the right order. This guide is the admin checklist, with the portal path and PowerShell command for each step at the time of writing (November 2026).

If you're not yet sure the account is compromised, start with the [signs an email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised). Running Google Workspace instead? See [Google Workspace compromised account recovery](https://iblockspam.com/blog/google-workspace-compromised-account-recovery).

## What should you do in the first 15 minutes?

Contain first, investigate second. Microsoft says its steps "address known methods that might allow the attacker to maintain persistence," so do every one of them ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)).

1. **Disable the account** in the Microsoft Entra admin center. Microsoft calls this "preferred and highly recommended until you complete the investigation."
2. **Revoke sessions** so existing sign-ins and refresh tokens stop working.
3. **Reset the password** from a device you trust. Don't email the new password to the user, "because the attacker could have access to the mailbox."
4. **Delete app passwords** and **remove MFA methods** the user didn't add.
5. **Remove forwarding and malicious inbox rules**, after noting what each one did.
6. **Check app consents and admin roles.**
7. **Investigate** sign-ins, the audit log and sent mail.
8. **Restore the account** and, only then, unblock sending.

| Step | Microsoft Entra or Defender portal | PowerShell |
|---|---|---|
| Disable account | **Entra ID** > **Users** > **All users** > user > **Account status** > **Edit**, clear **Account enabled** | `Update-MgUser -UserId $user.Id -AccountEnabled:$false` |
| Revoke sessions | User **Overview** page > **Revoke sessions** | `Revoke-MgUserSignInSession -UserId <UPN>` |
| Remove MFA methods | User > **Authentication methods** | Graph authentication method cmdlets |
| Check forwarding | Exchange admin center **Auto forwarded messages report** (tenant-wide) | `Get-Mailbox -Identity <UPN> \| Format-List Forwarding*Address,DeliverTo*` |
| Check inbox rules | Outlook on the web (visible rules only) | `Get-InboxRule -Mailbox <UPN> -IncludeHidden` |
| Unblock sending | **Email & collaboration** > **Review** > **Restricted entities** | `Remove-BlockedSenderAddress -SenderAddress <UPN>` |

## How do you block sign-in and revoke sessions?

Disabling the account stops new sign-ins. Revoking sessions invalidates the refresh tokens the attacker already holds. You need both, because Microsoft Entra access tokens "last for 1 hour" by default and stay usable until they expire ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)).

In the [Microsoft Entra admin center](https://entra.microsoft.com):

1. Go to **Entra ID** > **Users** > **All users** and select the user.
2. Under **Account status**, select **Edit**, clear **Account enabled**, and select **Save**.
3. On the user's **Overview** page, select **Revoke sessions**.

You need at least the User Administrator role for regular users, or Privileged Authentication Administrator if the compromised account is an admin.

The same steps in Microsoft Graph PowerShell:

```powershell
Connect-MgGraph -Scopes "User.ReadWrite.All","User.RevokeSessions.All"
$user = Get-MgUser -Search UserPrincipalName:'jason@contoso.com' -ConsistencyLevel eventual
Update-MgUser -UserId $user.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user.Id
```

If you only have the Microsoft 365 admin center open, **Users** > **Active users** > user > **Block sign-in** works too, but Microsoft warns that blocking "can take up to 24 hours to take effect." The faster route there is **Reset password**, then **Sign out of all sessions** on the user's **Account** tab, which prompts the user to sign in again "within an hour" ([Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-1)). Outlook on the web may stay open until the user refreshes or opens another app.

For synced accounts, disable the user and reset the password in on-premises Active Directory. Microsoft recommends resetting it **twice** to reduce the risk of pass-the-hash attacks. For federated accounts, change the password in the on-premises environment.

## How do you remove attacker MFA methods and app passwords?

Attackers who get past MFA often register their own authenticator app or phone number, so they can sign in again after you reset the password. Remove anything the user can't vouch for.

1. In the Microsoft Entra admin center, go to **Entra ID** > **Users**, select the user, and select **Authentication methods**.
2. Review every method with the user over a phone call or in person, not by email. Delete any phone number, authenticator app, passkey or security key they don't recognize.
3. If you're unsure, select **Require re-register MFA**. Microsoft says this deletes the user's phone numbers, Microsoft Authenticator apps and software OATH tokens, and deactivates hardware OATH tokens, so the user sets up MFA again at next sign-in ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userdevicesettings)).
4. Delete app passwords: **Entra ID** > **Users** > **Multifactor authentication**, select the user, **Manage user settings**, then **Delete all existing app passwords generated by the selected users**. Microsoft notes that app passwords "aren't automatically revoked when you reset the password."

These actions need at least the Authentication Administrator role. If the account isn't covered by MFA at all, fix that before you re-enable it; see [Microsoft 365 security defaults and MFA](https://iblockspam.com/blog/microsoft-365-security-defaults-mfa).

## How do you find and remove forwarding, inbox rules and delegates?

The mailbox is where attackers hide. Microsoft lists rules that forward mail to unknown addresses and rules that move messages to **Notes**, **Junk Email** or **RSS Subscriptions** as common symptoms. Check three places in Exchange Online PowerShell.

**1. Mailbox forwarding.**

```powershell
Get-Mailbox -Identity jason@contoso.com | Format-List Forwarding*Address,DeliverTo*
```

A value in `ForwardingSmtpAddress` means mail is forwarded to an external address. Clear it with:

```powershell
Set-Mailbox -Identity jason@contoso.com -ForwardingSmtpAddress $null -ForwardingAddress $null
```

**2. Inbox rules, including hidden ones.**

```powershell
Get-InboxRule -Mailbox jason@contoso.com -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,Identity
```

Here's an illustrative example of a suspicious rule in the output (the values are invented):

```
Name                  : ..
Enabled               : True
RedirectTo            :
ForwardTo             : "acct.review@outlook.example" [SMTP:acct.review@outlook.example]
ForwardAsAttachmentTo :
Identity              : jason\10210541742734704641
```

A rule named with a single character or punctuation, forwarding externally or deleting messages containing words like "invoice" or "hacked," is a red flag. Export the details with `Get-InboxRule -Identity "<Identity>" -IncludeHidden | Format-List` for your incident notes, then remove the rule with `Remove-InboxRule -Identity "<Identity>"`. Microsoft notes that changing Inbox rules in PowerShell removes any client-side rules created in Outlook, so record the user's legitimate rules first. Our guide to [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) covers tenant-wide hunting and how to check when each rule was created.

**3. Mailbox delegates.**

```powershell
Get-MailboxPermission -Identity jason@contoso.com | Where-Object { $_.IsInherited -eq $false }
```

Look for accounts with `FullAccess` that shouldn't have it. By default, only `NT AUTHORITY\SELF` is directly assigned to a user's own mailbox ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-mailboxpermission)), so any other direct entry needs an explanation. In Exchange Online PowerShell, Microsoft recommends the `Get-EXOMailboxPermission` version of this cmdlet.

Also check the user's Outlook signature and automatic replies. Attackers sometimes change them to support a payment fraud.

## How do you check app consents and admin roles?

A consent grant isn't removed by a password reset or session revocation, so a malicious app can keep or regain access to the mailbox until you revoke it. In the Microsoft Entra admin center, review the user's application consents and revoke anything they didn't knowingly approve, especially apps with mail permissions such as `Mail.Read` or `Mail.ReadWrite`. Our guide to [OAuth consent phishing](https://iblockspam.com/blog/oauth-consent-phishing-microsoft-365) shows how to find and revoke grants.

Then review the user's admin roles in Entra, Purview and Defender and remove any that shouldn't be there. If the compromised account is a Global Administrator, also review recent changes to other admin accounts, Conditional Access policies and mail flow rules.

## How do you find out what the attacker did?

Use the sign-in logs to fix the time window, then review everything the account did inside it.

- **Microsoft Entra sign-in logs:** note the IP addresses, locations, times and whether each sign-in succeeded.
- **Audit log (Defender or Purview portal):** search from just before the first suspicious activity, without activity filters at first, as Microsoft advises. Then look for `New-InboxRule`, `Set-Mailbox`, `Send` and `MailItemsAccessed`. The [audit log investigation guide](https://iblockspam.com/blog/microsoft-365-audit-log-email-investigation) explains each event.
- **Message trace and Sent Items:** list every message the account sent in the window. Payment requests, replies inserted into invoice threads and mass mailings are the most urgent.
- **Device code and session attacks:** if the user approved an MFA prompt or typed a code, read [adversary-in-the-middle phishing](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) and [device code phishing](https://iblockspam.com/blog/device-code-phishing-microsoft-365), because these attacks steal tokens rather than passwords.

If the attacker sent phishing to other people in your tenant, remove those messages too, using the steps in [how to remove a phishing email from all mailboxes](https://iblockspam.com/blog/remove-phishing-email-from-all-mailboxes-microsoft-365).

## How do you restore the account and unblock sending?

Once the investigation is done:

1. **Set a new password** and **re-enable the account**. Give the password to the user by phone or in person.
2. **Confirm MFA** is registered with methods the user controls.
3. **Unblock sending if needed.** If the account sent spam, Microsoft may have blocked it, and the user's mail bounces with [550 5.1.8 Access denied, bad outbound sender](https://iblockspam.com/blog/microsoft-365-user-blocked-from-sending). In the Microsoft Defender portal, go to **Email & collaboration** > **Review** > **Restricted entities**, select the mailbox, and choose **Unblock**. Or run `Remove-BlockedSenderAddress -SenderAddress jason@contoso.com`.

Microsoft says restrictions should normally lift "within one hour," and the total wait "should be no longer than 24 hours" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)). Before you unblock, Microsoft suggests running the **Blocked Sender History** diagnostic (`https://aka.ms/senderhistory`) to see the account's listing history and MFA status.

## Who do you need to tell?

Tell the people who received mail from the account during the window, by phone for anyone who got a payment request. If money moved, call the bank immediately and report it to the FBI's Internet Crime Complaint Center at ic3.gov. Our guide to [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) covers the payment side. If the mailbox held regulated data, involve whoever handles your legal and notification obligations.

## How do you stop it happening again?

| Control | Where | Why it helps |
|---|---|---|
| MFA for every user | Security defaults or Conditional Access | Stops most password-only takeovers |
| Phishing-resistant MFA for admins and finance | Conditional Access authentication strength | Defeats proxy phishing that steals sessions |
| Block external auto-forwarding | [Outbound spam policy](https://iblockspam.com/blog/microsoft-365-outbound-spam-policy) | Stops silent mail theft through rules |
| Alert on restricted senders | **User restricted from sending email** alert policy | Tells you when an account starts spamming |
| Restrict user consent | Entra ID consent settings | Stops malicious apps getting mailbox access |

Check that the **User restricted from sending email** alert goes to someone who reads it. By default it notifies the **TenantAdmins** group.

## Next steps

- Write these steps into your [email security incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan), with the names of the people who hold each admin role.
- Keep the original phishing email that started the incident, with headers. The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) shows where it really came from.
- Run a tenant-wide check for hidden inbox rules and external forwarding after every compromise, not just on the affected mailbox.
- Fewer phishing emails reaching inboxes means fewer stolen passwords. iBlockSpam filters inbound mail at the MX for [Microsoft 365](https://iblockspam.com/platforms/microsoft-365) with per-domain [pricing](https://iblockspam.com/pricing).

Browse our other [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Does resetting the password kick an attacker out of Microsoft 365?

Not on its own. Existing access tokens stay valid for up to an hour by default, and app passwords aren't revoked by a password reset. Disable the account, revoke sessions with Revoke sessions in Entra or Revoke-MgUserSignInSession, delete app passwords, and remove any MFA method the attacker registered.

### How long does Block sign-in take in the Microsoft 365 admin center?

Microsoft says blocking an account can take up to 24 hours to take effect. To cut access faster, reset the password and select Sign out of all sessions, or disable the account and select Revoke sessions in the Microsoft Entra admin center. Users are prompted to sign in again within about an hour.

### Should I disable a compromised Microsoft 365 account or just reset the password?

Microsoft prefers disabling the account until your investigation is complete, and recommends a password reset only if you can't disable it. Disabling stops new sign-ins while you check rules, MFA methods, consents and logs. Re-enable it with a fresh password once you're sure the attacker has no other way back in.

### When can I remove a user from the Restricted entities page?

Only after the account is secured. Microsoft treats exceeding outbound limits as an indicator of compromise and tells admins to regain control of the account before unblocking it. After you select Unblock, restrictions are usually removed within one hour and no longer than 24 hours.

### Which PowerShell modules do I need to clean up a hacked Microsoft 365 mailbox?

Two. Microsoft Graph PowerShell handles the identity side: Update-MgUser to disable the account and Revoke-MgUserSignInSession to revoke sessions. Exchange Online PowerShell handles the mailbox: Get-Mailbox for forwarding, Get-InboxRule -IncludeHidden for rules, Get-MailboxPermission for delegates and Remove-BlockedSenderAddress to unblock sending.

## Sources

- [Microsoft Learn: Respond to a compromised email account in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)
- [Microsoft Learn: Revoke user access in an emergency in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)
- [Microsoft Learn: Manage authentication methods for Microsoft Entra multifactor authentication](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userdevicesettings)
- [Microsoft Learn: Step 1 - Prevent user sign-in and block access to Microsoft 365](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-1)
- [Microsoft Learn: Remove blocked users from the Restricted entities page](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)
- [Microsoft Learn: Get-MailboxPermission](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-mailboxpermission)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Microsoft 365 Spam Header Decoder](https://iblockspam.com/tools/microsoft-365-header-analyzer): Paste Microsoft 365 headers to decode SFV, CAT, SCL, BCL and compauth reason codes in plain English — runs in your browser.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-compromised-account-remediation (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt