If a Microsoft 365 mailbox starts sending messages the owner did not write, a password change alone is not enough. An intruder may still have a live session, a newly registered sign-in method, a malicious application grant, or a hidden forwarding rule. The first hour matters because a trusted business mailbox can be used to redirect invoices, request gift cards, steal files, and deceive customers.
Money already sent?
Call the bank or originating financial institution immediately using a known, independently verified number. Ask about a recall or reversal. The FBI’s Internet Crime Complaint Center says speed can reduce or eliminate losses; file a report at IC3.gov. Do not wait for the technical investigation to finish.
What counts as a likely compromise?
- Messages appear in Sent Items or Deleted Items that the user did not send.
- Customers report strange invoices, payment changes, document links, or urgent requests.
- Expected mail disappears, lands in unusual folders, or is silently forwarded.
- A new MFA method, phone number, device, application, or admin role appears.
- Microsoft blocks outbound mail, or sign-in records show unfamiliar locations, devices, or IP addresses.
- The user experiences repeated lockouts or unexplained password changes.
Microsoft lists suspicious Inbox rules, external forwarding, deleted mail, changed directory details, unexplained lockouts, and a blocked mailbox among common warning signs. One clue is enough to investigate; it is not necessary to prove exactly how the attacker entered before containing the account.
Who is affected—and who is not?
Treat as affected
- The named mailbox and every device that used it
- Shared mailboxes it could access
- Files, Teams chats, contacts, and cloud apps available to that identity
- Customers or vendors who received suspicious messages
- Any payment process touched by the mailbox
Not automatically compromised
- Every employee in the company
- Every recipient of a suspicious message
- The entire Microsoft 365 tenant
- A computer that merely received the email
However, check for shared access, reused passwords, delegated permissions, and users who clicked the attacker’s links before clearing them.
The ordered containment plan
Use a clean administrator session on a trusted device. If the only administrator account may also be compromised, stop and get qualified help rather than locking out the tenant. Record the time, symptoms, affected address, suspicious messages, and any payment activity as you work.
1. Preserve the basic evidence
- Photograph or screenshot suspicious messages, rules, forwarding addresses, alerts, and sign-in entries.
- Write down when the last known-good use occurred and when the first suspicious event appeared.
- Keep the original message headers when possible; forwarded screenshots alone may lose useful routing details.
- Do not erase the mailbox, wipe a computer, or mass-delete messages before logs and evidence are preserved.
Exception: if money is moving, contact the bank first. Evidence preservation must not delay a recall request.
2. Disable or block the affected account
Microsoft’s current response guidance prefers disabling the affected account during the investigation. This limits new activity while you work through persistence mechanisms. If the account cannot be disabled, reset it to a strong, unique password and deliver the new password through a different trusted channel—not through the potentially compromised mailbox.
3. Revoke active sessions
A password reset does not make every already-issued access token disappear instantly. Revoke the user’s sessions from Microsoft Entra so stolen refresh tokens can no longer keep generating access. Microsoft notes that application behavior and token lifetimes can affect how quickly access ends, so disabling the account remains the stronger containment step while investigating.
4. Inspect authentication methods and devices
- Remove unknown phone numbers, authenticator registrations, security keys, and devices.
- Require the legitimate user to register MFA again when ownership is uncertain.
- Replace old app passwords; Microsoft warns that resetting the normal password does not automatically revoke them.
- Prefer phishing-resistant authentication for administrators when the licensing and environment support it.
5. Remove hidden ways back in
- Inbox rules: look for rules that forward, redirect, delete, hide, or move messages to RSS, Notes, Junk, or another rarely checked folder.
- Mailbox forwarding: check both user-visible settings and administrator-level forwarding.
- Delegates and shared access: remove unfamiliar Send As, Send on Behalf, or mailbox permissions.
- Application consent: revoke unknown apps with access to mail, files, contacts, or the user profile.
- Administrative roles: remove privileges the user should not have.
- Tenant mail flow: an administrator should inspect suspicious connectors and transport rules when the evidence suggests wider impact.
Deleting only the visible Outlook rule is a bad shortcut. Microsoft specifically recommends reviewing hidden Inbox rules, forwarding, user-consented applications, MFA registrations, and administrative roles because each can provide a separate persistence path.
6. Review logs across the full suspicious window
Begin slightly before the first suspicious event and continue through remediation. Review Entra sign-ins, audit activity, mailbox operations, application-consent changes, authentication-method changes, and admin-role assignments. Microsoft recommends starting broadly rather than filtering to one expected action; attackers often use more than one technique.
7. Check messages, files, people, and payments touched by the account
- Review Sent, Deleted, Recoverable Items, and unusual mailbox folders.
- Identify external recipients of fraudulent or phishing messages.
- Check whether sensitive OneDrive or SharePoint files were opened, downloaded, shared, or deleted.
- Verify vendor payment changes by calling a known number from an existing record—not a number in the suspicious email.
- Warn affected customers or vendors with specific, calm instructions. Do not send a vague “ignore my last email” if invoices or credentials were involved.
8. Clean the endpoint, then restore access carefully
Update and scan computers and phones used by the account, review browser extensions and remote-access software, and remove anything unapproved. Restore the user only after the password, sessions, authentication methods, app grants, rules, forwarding, delegates, and roles have been checked. Monitor sign-ins, outbound mail, rules, and customer reports afterward.
Good response versus costly shortcuts
Phone readers: swipe the table left to compare both columns.
| Good response | Risky shortcut |
|---|---|
| Use a clean admin session and temporarily disable the account | Keep using the suspect device while changing the password |
| Revoke sessions and inspect every MFA method | Assume a password reset ejects every attacker |
| Check hidden rules, forwarding, delegates, apps, and roles | Delete one visible rule and declare victory |
| Call the bank using a known number immediately | Reply to the suspicious email to “confirm” payment details |
| Preserve logs and original message evidence | Wipe devices and empty folders before investigating |
| Notify the specific recipients at risk | Send a generic warning that gives no action to take |
Two realistic examples
Harmless-looking symptom, real persistence
An office manager notices that vendor replies have stopped. The password was already changed, so the team assumes the problem is fixed. A hidden rule is still moving vendor mail to RSS Subscriptions while forwarding copies outside the company. Reviewing hidden rules and mailbox-level forwarding exposes the persistence before payment details are changed.
The expensive wrong turn
A vendor sends “updated” bank instructions from a real, compromised mailbox. The recipient replies to the same thread for confirmation and wires the money. Because the attacker controls the conversation, the reply proves nothing. A known-number callback to the vendor and immediate bank recall request are the safer moves.
Frequently asked questions
Is changing the password enough?
No. You must also revoke sessions and inspect MFA methods, app passwords, connected applications, rules, forwarding, delegates, and roles.
Should we delete the suspicious messages?
Preserve originals and headers first. They may identify recipients, payment requests, malicious links, and the time window. After evidence is retained, remove or quarantine harmful messages according to your incident plan.
Does MFA prove the account was not hacked?
No. A user can approve a fraudulent prompt, a session token can be stolen, an attacker can register another method, or a malicious app can receive consent. MFA is essential, but it is not a substitute for investigation.
Should we email customers from the same mailbox?
Not until control is restored. Use a verified alternate channel where practical, explain exactly which message or payment request is fraudulent, and provide a known callback number.
When should a small business call for help?
Immediately if an administrator account is involved, money moved, sensitive files may have been accessed, multiple users show signs of compromise, logs are unavailable, or the business cannot safely disable and restore the account.
Related practical guides
- Check email forwarding rules before they leak your messages
- Verify urgent requests with a known-number callback
- Build a backup sign-in plan before MFA locks you out
Official sources
- Microsoft: Respond to a compromised email account in Microsoft 365
- Microsoft: Revoke user access in an emergency in Microsoft Entra ID
- FBI IC3: Business Email Compromise
- CISA: Business Email Compromise warning
Your next action
If you see even one unexplained rule, login, MFA method, message, or payment request, stop using the affected account and begin containment now. The IT Guys can help Port Saint Lucie, Jensen Beach, Fort Pierce, and Vero Beach homes and small businesses investigate Microsoft 365 account compromise, secure devices, and build a safer recovery plan.