# Suspected Microsoft 365 account compromise: a business response plan Published by Britixo | 2026-10-29 | Security & Microsoft 365 Canonical page: https://britixo.com/business-guides/microsoft-365-account-compromise-response/ Treat an unexpected sign-in, payment-change email or suspicious mailbox rule as an incident to assess promptly. Use a trusted communication channel, involve the authorised administrator and preserve relevant evidence while access is contained. Recovery must address the ways an attacker could retain access, not just the password. If money, sensitive information or multiple accounts may be involved, bring the appropriate banking, legal, privacy and incident-response contacts into the decision. ## When this guide is useful Business owners, IT administrators and incident coordinators investigating suspicious account activity - A customer receives a payment instruction that your team did not send. - Unfamiliar forwarding rules or authentication methods appear on an account. - Staff report messages marked as read, missing correspondence or unusual sign-ins. - A user is unexpectedly blocked from sending, or an application has unexplained consent. ## Establish an incident owner and a trusted channel Record who reported the issue, when it was observed, which account is involved and the business processes it can reach. Preserve original messages, relevant headers, alert identifiers and available audit records in an access-controlled case record. Do not circulate potentially malicious attachments or ask staff to reproduce the attack on a normal workstation. Contact the affected person through a known telephone number or another trusted route. If invoice fraud is suspected, verify payment instructions independently and contact the bank using an established contact. The incident coordinator should determine who can authorise containment and who will make decisions about notifications and business continuity. ## Contain access without losing the investigation trail Microsoft's account-compromise guidance includes disabling the affected account, revoking sessions and reviewing authentication methods, application consent and administrative roles. These are administrator actions to apply within the incident plan. Their effect can vary across connected applications, so confirm the relevant access paths rather than assuming one action terminates everything. Preservation and containment must proceed together under the incident lead. Avoid deleting the mailbox or wiping devices simply to make the symptoms disappear. Record each action and its time, use a known-clean administration session and retain the evidence needed to understand the incident. Specialist support is appropriate when scope or containment confidence is uncertain. ## Determine what the account could access and change Build a timeline spanning sign-ins, mailbox activity, sharing changes, consent grants and sensitive business events. Compare unusual activity with the user's legitimate travel, devices and working hours; a surprising location alone is not proof. Investigate forwarding, delegates, rules and linked systems using the current platform guidance and your available logs. Follow the business impact beyond email. A compromised mailbox may support password resets elsewhere, expose contract discussions or enable believable requests to suppliers. Create a list of potentially affected services and counterparties, prioritised by consequence. A privacy or legal lead should assess applicable reporting duties against the facts and jurisdiction, rather than relying on a generic deadline checklist. ## Restore service with explicit release criteria Agree the conditions for reopening the account: the access route has been addressed, unauthorised persistence has been reviewed, the device is trusted, approved credentials are in place and monitoring is assigned. Test ordinary work with the user, including sent and received mail and necessary application access. Do not restore suspect configurations merely because a familiar workflow stops working. Hold a short review once immediate operations are stable. Separate the initial entry point from the controls that allowed the incident to spread. Improvements might include stronger authentication, approval checks for bank-detail changes, restricted application consent or better log retention. Each improvement should have an owner and a verification task, not only a recommendation in a report. ## Prepare for a useful conversation - Affected accounts, alert identifiers and a timeline with a stated time zone. - Preserved original email evidence and relevant audit exports, handled securely. - An authorised containment owner and trusted out-of-band contacts. - A list of payment, customer-data and connected-application impacts to investigate. - Written recovery criteria, monitoring ownership and an action log. ## How Britixo can help Britixo can help your organisation assess Microsoft 365 access controls, investigate configuration issues and coordinate agreed remediation with your existing administrators or incident-response specialists. Scope can include an access-path review, mailbox configuration assessment, identity hardening and a documented recovery handover. Contact Britixo through a trusted route with a concise description of the symptoms; do not include passwords, recovery codes or sensitive evidence in an ordinary enquiry. Emergency availability, forensic work, legal advice and notification responsibilities must be confirmed separately. An enquiry is not a substitute for activating an existing incident plan. [Contact Britixo](https://britixo.com/contact/?enquiry_type=contact_consultation#contact-form) ## Common questions ### Is resetting the password enough? Not necessarily. Sessions, authentication methods, application permissions and mailbox settings may require investigation. Follow the current Microsoft guidance and validate the account's connected access paths. ### Should the account be deleted immediately? Deletion can disrupt recovery and evidence collection. An authorised incident lead should choose containment measures that restrict access while preserving the records needed for investigation. ### Can an unfamiliar sign-in location be legitimate? Yes. VPNs, mobile networks and service routing can affect location signals. Correlate the event with device, time, authentication and activity evidence before drawing conclusions. ## Related guides - [How to roll out phishing-resistant MFA without locking out your team](https://britixo.com/business-guides/phishing-resistant-mfa-rollout/) - [Create a security logging plan that produces useful alerts](https://britixo.com/business-guides/security-logging-monitoring-plan/) - [Business emails going to spam? Diagnose SPF, DKIM and DMARC](https://britixo.com/business-guides/business-email-deliverability-spf-dkim-dmarc/) ## Sources and further reading - [Microsoft: Respond to a compromised email account](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account) - [Microsoft: Audit logs in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs) Prepared with AI assistance and checked against linked primary documentation. [Editorial approach](https://britixo.com/business-guides/#editorial-approach). Product availability and delivery scope are confirmed for your requirements.