Reset a hacked Microsoft 365 password without missing the next steps.
If you are dealing with a phished business account, a new password is one part of the response. First make sure the attacker cannot simply keep using another route into the account.
For the account holder
Contact your IT team through a trusted number. Tell them when you entered a password or approved an unexpected prompt, and which device you used. Do not send the suspected phishing link around as an ordinary clickable message. If the password was reused elsewhere, tell IT so the wider exposure can be addressed.
For an authorised administrator
- Use an unaffected admin account and trusted device. Confirm the user and tenant, then block sign-in and revoke sessions.
- Check where the password is managed: directly in Microsoft 365, synchronised from Active Directory, or a federated identity provider.
- For a cloud-managed user, open Microsoft 365 admin centre → Users → Active users → select the user → Reset password.
- Generate a replacement following your policy. Keep it out of incident notes and ordinary email. Hand it over through a verified secure process when recovery is approved.
- For a synchronised or federated identity, follow the correct source-system recovery procedure; do not assume a cloud-only reset fixes the source credential.
Should I reset the password twice?
Not as a universal cloud-account recipe. Microsoft’s hybrid emergency guidance includes two Active Directory password resets in specific recovery circumstances. Use that procedure when it applies. A second reset does not substitute for investigating sessions, unknown authentication methods or other access.
The account still looks compromised after a reset
Keep it blocked and use the full recovery checklist. Review MFA methods, app passwords, application consent, roles and mailbox changes. If a registration or rule returns, investigate who or what is creating it. Ask for incident response support if you cannot establish the scope.
Before returning the account
Verify the person, device and authentication method. Record the remediation and approval, then monitor for recurrence. This page concerns business Microsoft 365 accounts; personal Microsoft account recovery uses a different support process.
Microsoft references
- Reset business passwords in Microsoft 365
- Microsoft emergency access revocation, including hybrid identities
Reviewed 18 October 2026. Portal wording and access vary by role, tenant and licensing. Follow your organisation’s incident procedure.