How to check and reset MFA on a compromised Microsoft 365 account.
An unfamiliar authenticator or security key needs investigation. Resetting a password alone does not establish that the account’s authentication methods are trustworthy.
Keep the account contained
Start by blocking the account and revoking sessions from a trusted admin session. Verify the account owner through a known independent channel. Do not trust a request just because it came from their email address.
Where to review authentication methods
- Open Microsoft Entra admin centre → Entra ID → Users → select the affected user → Authentication methods.
- Record the methods present and compare them with the verified user’s registrations. Preserve relevant details in the incident record without collecting secrets.
- Remove unrecognised methods. Review passkeys/security keys and Temporary Access Passes as well as phone and Authenticator entries.
- Use Require re-register MFA where appropriate and arrange trusted enrolment. Check the methods remaining afterwards; this button does not remove every method type.
Authentication Administrator can manage methods for permitted users; administrator accounts require suitable elevated roles, such as Privileged Authentication Administrator. If the controls are unavailable, check your permissions rather than using the compromised account.
What about app passwords?
Legacy app passwords need separate review and revocation where used. Do not assume the normal password reset or MFA re-registration removed them. Follow Microsoft’s linked user-settings procedure for the applicable tenant controls.
Unknown MFA methods keep coming back
Keep the user blocked and record the new method and timestamp. Escalate the investigation into other privileged access, applications, devices and the identity source. Repeating password and MFA resets without finding that path can leave the incident unresolved.
Help the user return safely
Use a trusted device and verified handover process. Test the intended method and confirm the account has no unapproved registrations. Consider phishing-resistant authentication as part of the follow-up; ordinary MFA remains valuable, but session theft can follow an approved prompt.
Microsoft references
- Manage individual users’ MFA and authentication settings
- Roles and management of authentication methods
Reviewed 18 October 2026. Portal wording and access vary by role, tenant and licensing. Follow your organisation’s incident procedure.