When this guide is useful
Business owners, IT administrators and incident coordinators investigating suspicious account activity
- A customer receives a payment instruction that your team did not send.
- Unfamiliar forwarding rules or authentication methods appear on an account.
- Staff report messages marked as read, missing correspondence or unusual sign-ins.
- A user is unexpectedly blocked from sending, or an application has unexplained consent.
Establish an incident owner and a trusted channel
Record who reported the issue, when it was observed, which account is involved and the business processes it can reach. Preserve original messages, relevant headers, alert identifiers and available audit records in an access-controlled case record. Do not circulate potentially malicious attachments or ask staff to reproduce the attack on a normal workstation.
Contact the affected person through a known telephone number or another trusted route. If invoice fraud is suspected, verify payment instructions independently and contact the bank using an established contact. The incident coordinator should determine who can authorise containment and who will make decisions about notifications and business continuity.
Contain access without losing the investigation trail
Microsoft's account-compromise guidance includes disabling the affected account, revoking sessions and reviewing authentication methods, application consent and administrative roles. These are administrator actions to apply within the incident plan. Their effect can vary across connected applications, so confirm the relevant access paths rather than assuming one action terminates everything.
Preservation and containment must proceed together under the incident lead. Avoid deleting the mailbox or wiping devices simply to make the symptoms disappear. Record each action and its time, use a known-clean administration session and retain the evidence needed to understand the incident. Specialist support is appropriate when scope or containment confidence is uncertain.
Determine what the account could access and change
Build a timeline spanning sign-ins, mailbox activity, sharing changes, consent grants and sensitive business events. Compare unusual activity with the user's legitimate travel, devices and working hours; a surprising location alone is not proof. Investigate forwarding, delegates, rules and linked systems using the current platform guidance and your available logs.
Follow the business impact beyond email. A compromised mailbox may support password resets elsewhere, expose contract discussions or enable believable requests to suppliers. Create a list of potentially affected services and counterparties, prioritised by consequence. A privacy or legal lead should assess applicable reporting duties against the facts and jurisdiction, rather than relying on a generic deadline checklist.
Restore service with explicit release criteria
Agree the conditions for reopening the account: the access route has been addressed, unauthorised persistence has been reviewed, the device is trusted, approved credentials are in place and monitoring is assigned. Test ordinary work with the user, including sent and received mail and necessary application access. Do not restore suspect configurations merely because a familiar workflow stops working.
Hold a short review once immediate operations are stable. Separate the initial entry point from the controls that allowed the incident to spread. Improvements might include stronger authentication, approval checks for bank-detail changes, restricted application consent or better log retention. Each improvement should have an owner and a verification task, not only a recommendation in a report.
From diagnosis to delivery
How Britixo can help
Britixo can help your organisation assess Microsoft 365 access controls, investigate configuration issues and coordinate agreed remediation with your existing administrators or incident-response specialists. Scope can include an access-path review, mailbox configuration assessment, identity hardening and a documented recovery handover. Contact Britixo through a trusted route with a concise description of the symptoms; do not include passwords, recovery codes or sensitive evidence in an ordinary enquiry. Emergency availability, forensic work, legal advice and notification responsibilities must be confirmed separately. An enquiry is not a substitute for activating an existing incident plan.
Talk through your requirementsCommon questions
Is resetting the password enough?
Not necessarily. Sessions, authentication methods, application permissions and mailbox settings may require investigation. Follow the current Microsoft guidance and validate the account's connected access paths.
Should the account be deleted immediately?
Deletion can disrupt recovery and evidence collection. An authorised incident lead should choose containment measures that restrict access while preserving the records needed for investigation.
Can an unfamiliar sign-in location be legitimate?
Yes. VPNs, mobile networks and service routing can affect location signals. Correlate the event with device, time, authentication and activity evidence before drawing conclusions.
Sources and further reading
Use the original documentation to check current product terms, eligibility and technical details.
Published by Britixo on 29 October 2026. How these guides are prepared. Product availability and delivery scope are confirmed for your requirements.