Hacked or phished Microsoft 365 account? Start here.
A practical recovery checklist for business Microsoft 365 and Office 365 accounts. Contain access, check what changed and record what you know before returning the account to use.
For authorised administratorsReviewed 18 October 2026
Are you the account holder?
Contact your IT team through a trusted phone number. Do not approve more prompts. This guide is for authorised administrators; personal Outlook.com, Xbox and consumer Microsoft accounts use a different recovery process.
Use an unaffected administrator account and trusted device. Block the affected account and preserve available evidence alongside containment. Do not leave an attacker connected to complete a perfect evidence export. Use the least privileged administrative role that can perform each action; privileged accounts need appropriately privileged recovery support.
Block sign-inAt Microsoft Entra admin centre, open Entra ID → Users → All users → the affected user. Edit account properties and set Account enabled to No.
Revoke sessionsOpen the user’s Overview and select Revoke sessions. Refresh-token revocation does not guarantee every application session ends immediately; app-issued cookies can need application-specific action.
Reset the passwordFor a cloud-managed business user, open Microsoft 365 admin centre → Users → Active users → select user → Reset password. For synchronised or federated accounts, follow your identity-source process. Share replacement credentials through a verified secure channel.
NoteMicrosoft describes a double password reset for certain on-premises Active Directory recovery scenarios. That is not a universal instruction to reset every cloud account twice. Follow the relevant hybrid recovery procedure.
02
Remove untrusted authentication methods
In Entra ID → Users → the user → Authentication methods, review registered methods with the verified account owner. Remove unrecognised methods, inspect passkeys/security keys and Temporary Access Passes, and arrange trusted registration. “Require re-register MFA” does not mean every possible authentication method has been removed. Revoke legacy app passwords separately where present.
What if an unknown MFA method comes back?
Keep access blocked. Investigate other administrator access, sessions, applications, devices and changes to the identity source. Record when the method reappeared and escalate to qualified incident response support. A reset loop can miss the access that is adding it again.
03
Check mailbox changes and the wider account
Review inbox rules, including hidden rules; mailbox-level forwarding; delegation; unfamiliar app consent; and administrative roles. Preserve suspicious settings before removing them. Record names, destinations, permissions and evidence references. Use Microsoft’s response procedure for the detailed checks, including Exchange Online commands for hidden rules.
Use Entra sign-in logs and Microsoft Purview Audit to build a timeline. Search a wider window than the first alert and include related accounts and services where the evidence points. Log availability, permissions and licensing affect what you can establish. Missing events do not establish that nothing happened.
How many emails were sent from the compromised account?
Open Exchange admin centre → Mail flow → Message trace. Search the sender and investigation window, check the time zone and export the results. Record message identifiers, recipient outcomes and your counting method. Recipient rows and transport events are not unique messages; separate legitimate mail from confirmed malicious mail. Sent Items alone is not an investigation.
04
Restore access after the checks
Confirm the user’s identity, remediate affected devices where needed, test trusted authentication and verify unauthorised access and changes have been addressed. Follow Microsoft’s restoration steps, then monitor for recurrence. Escalate administrator compromise, uncertain scope or continuing activity. Contact the bank promptly through a verified number if payment fraud may be involved.