A Microsoft 365 incident report you can fill in.
Keep the account recovery, mailbox findings and breach decision together. A practical working template for small MSPs and internal IT teams investigating a business email account compromise.
No registration required. Download it, fill it in using a PDF reader that supports forms and save your own copy. Check that your entries have saved before closing the reader. The document is blank; it is not a claim about a customer incident.
What the report records
- Discovery, awareness, investigation window and evidence references.
- Containment actions, password source, sessions and authentication methods.
- Inbox rules, forwarding, delegation and other persistent access.
- Email counts, recipient outcomes, counting method and uncertainty.
- Personal-data impact, notification decisions and follow-up ownership.
Keep counts meaningful
Write down what was counted, over which time window and from which export. For example, 10 distinct messages sent to two recipients each can produce 20 recipient rows. That is an illustration, not a rule for every trace: expansion, retries and forwarding can add records. Keep the raw export and explain your method. Use “unknown” when the evidence does not establish a count.
Use the report alongside the recovery guides
Start with recovering a hacked or phished Microsoft 365 account. Read how MFA session hijacking works if relevant, then make a documented UK GDPR breach assessment.
Handle the completed report as sensitive information
Store it in your approved incident record system with controlled access. Reference protected evidence rather than embedding unnecessary personal data. Never put passwords, recovery codes, session cookies or access tokens in the form. Add an access-controlled continuation record if a field is too small. The PDF has no submit button and sends nothing to Vigil Alerts.