Your Microsoft 365 account is sending phishing emails. What now?

From a trusted device and unaffected administrator account, block the affected user’s sign-in and revoke their sessions. Reset exposed credentials and check authentication methods as part of the full recovery process. Keep the mailbox available for investigation; do not delete the account as a shortcut.

An authorised Exchange administrator can add a mail flow rule to reject messages matching the affected sender. This is an additional containment measure. It does not remove an attacker’s access, recall delivered mail or cover every other identity they might control.

1. Open Exchange admin centre → Mail flow → Rules → Add a rule → Create a new rule.
2. Name it clearly, for example Incident TEMP - block affected sender - INC123.
3. Under Apply this rule if, choose The sender → is this person and select the affected mailbox. Verify the selected address. Do not choose “apply to all messages”.
4. Under Do the following, choose Block the message → reject the message and include an explanation. Use a neutral reason such as “Sending temporarily restricted. Contact IT through your usual support channel.”
5. Set the rule mode to Enforce. Review sender matching (Header, Envelope or both), aliases and any Send As identities with your Exchange administrator. Do not restrict recipients to external addresses if internal phishing must also be stopped.
6. Finish, then explicitly enable the rule. Review its priority against existing rules, especially earlier rules that stop further processing. Record the rule name, settings, operator and time.

This is not an instant stop button. Microsoft says a new or changed mail flow rule can take 30 minutes or more to apply. Keep identity containment in place and verify actual outcomes. Arrange trusted test messages once it is safe, covering relevant sender addresses and internal/external recipients. Do not reopen compromised access just to test.

The rule acts on messages passing through your Exchange Online organisation that meet its conditions. Sender-address matching is not a guarantee about the person controlling a session. Other compromised accounts, shared mailboxes with Send As access, third-party sending services or external spoofing may need separate investigation. Automatic forwarding can retain the original sender address, so this sender rule is not a universal forwarding block: inspect mailbox forwarding and inbox rules separately. Legitimate messages matching the rule will also be rejected; tell the business owner.

Use Exchange Mail flow → Message trace and review the incident window. Preserve the results and distinguish malicious messages from legitimate mail. Warn affected recipients through a trusted channel where appropriate; coordinate any message removal with your security team and available tooling. A new rule cannot retrieve email already delivered to another organisation.

Assign an owner to review the temporary rule. Disable it only after authorised recovery approval, record the change and test legitimate sending. Follow up on recipient exposure, fraud and the personal-data breach assessment.

• Create, enable and prioritise mail flow rules
• Message rejection actions
• Sender conditions and matching

Reviewed 18 October 2026. Portal wording and access vary by role, tenant and licensing. Follow your organisation’s incident procedure.

• Reset exposed passwords
• Check and reset MFA methods
• Find suspicious inbox rules
• Follow the complete account recovery checklist
• Record the incident with the free fillable report