[{"data":1,"prerenderedAt":177},["ShallowReactive",2],{"publication:en:P064":3},{"meta":4,"copy":18,"relatedArticles":136,"terms":169,"term":170,"resourceParent":171,"glossaryParent":174},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"P064","\u002Fblog\u002Fmicrosoft-365-account-compromise","article","Microsoft 365 account compromised what to do","Microsoft 365 account compromised: containment and recovery checks","Microsoft 365 account compromised? Response checklist","Contain a suspected Microsoft 365 account compromise with authorized access, evidence, rule and app review, and verified recovery beyond a password reset.",[13,14,15],"\u002Femergency","\u002Fservices\u002Fcorporate-email","\u002Fservices\u002Faccess-2fa-audit","2026-06-02","2026-10-30",{"intro":19,"sections":20,"checklistTitle":90,"checklist":91,"faq":99,"sources":109,"links":112,"cta":131},"If a Microsoft 365 account may be compromised, involve the authorized administrator through a trusted channel, contain the affected access and preserve available evidence while reviewing the account's mail and application paths. Password reset is only one action: sessions, recovery methods, forwarding, rules and app permissions can need separate attention. Recovery should be verified against the actual tenant, identity source and affected business services.",[21,26,38,70,77,85],{"title":22,"paragraphs":23},"Establish the trusted response route and affected identity",[24,25],"Record the account, first observed time with timezone, suspicious message or alert and the business systems involved. Contact the administrator through an existing trusted route. A potentially compromised mailbox should not be the only channel used to approve sensitive recovery actions or send new credentials. Keep the initial evidence specific without copying unnecessary private messages.","Identify whether the identity is cloud-managed, synchronized or federated and whether administrative roles are involved. The authoritative identity source affects recovery. A suspicious sign-in or message is a reason to investigate, not proof of the full incident scope. Record what is observed, what is suspected and who has authority to contain access.",{"title":27,"paragraphs":28,"sources":31},"Contain access using the appropriate administrator procedure",[29,30],"Follow the current provider process to restrict the affected account and address active sessions or access paths within the authorized scope. Consider the business effect and maintain a trusted recovery administrator, especially if a privileged identity is involved. Do not make a broad tenant change that locks out the responders while the affected route remains unexamined.","Resetting a password, revoking refresh\u002Fsession access and removing an app grant are different operations. Token lifetimes, resource behavior and independently managed application sessions can affect when restrictions take effect. Verify the result in the relevant systems; do not promise that one button instantly terminates every access route.",[32,35],{"label":33,"url":34},"Microsoft: respond to a compromised cloud email account","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fresponding-to-a-compromised-email-account",{"label":36,"url":37},"Microsoft Entra: access revocation and token\u002Fsession limits","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fusers\u002Fusers-revoke-access",{"title":39,"paragraphs":40,"table":43},"Preserve a timeline while remediation proceeds",[41,42],"Retain available sign-in, audit, mail-trace and relevant configuration evidence for the authorized investigation. Record collection times and the timezone used for comparison. Feature availability, roles and retention determine what can be examined; an empty or unavailable log does not establish that no earlier access occurred.","Record the containment actions and their timestamps as well as the suspicious activity. This helps distinguish an attacker change from a legitimate responder action. Do not delay necessary containment solely to collect every possible artifact, and do not delete the account or wipe evidence as a generic first step. Agree how sensitive records will be accessed and stored.",{"caption":44,"headers":45,"rows":49},"Incident actions, evidence and acceptance",[46,47,48],"Area","What the authorized owner reviews","What acceptance must distinguish",[50,54,58,62,66],[51,52,53],"Identity and sign-in","Source of authority, roles, recovery methods and relevant sign-ins","A changed password versus effective access restriction.",[55,56,57],"Sessions and applications","Sessions\u002Ftokens, grants and connected access in scope","One revoked route versus all affected services.",[59,60,61],"Mailbox behavior","Forwarding, inbox rules, delegates and relevant mail events","Removal of one rule versus the full observed persistence scope.",[63,64,65],"Files and business processes","Affected sharing or sensitive requests supported by evidence","Observed access versus assumed data extraction.",[67,68,69],"Recovery","Controlled sign-in, intended settings and service workflow","User access restored versus investigation complete.",{"title":71,"paragraphs":72,"sources":75},"Review persistence and business impact separately from the password",[73,74],"Inspect relevant forwarding settings, inbox rules, delegated access, authentication methods and application permissions through the appropriate administrator tools. Compare suspicious entries with the business's known configuration before removing them. Some legitimate processes use delegation or forwarding; retain the evidence and explain the targeted correction.","Determine whether unauthorized mail, file access or a sensitive business request needs further investigation. Do not infer data extraction from a login alone or infer no exposure from a missing log. If a payment change, customer communication or personal-data issue may be involved, engage the responsible business owners and the appropriate specialist process for the situation and jurisdiction.",[76],{"label":33,"url":34},{"title":78,"paragraphs":79,"example":82},"Restore access through explicit return-to-service checks",[80,81],"Use a trusted device and the provider-supported identity-recovery process. Confirm the intended authentication methods and recovery ownership, correct roles, relevant session\u002Fapp restrictions and removal of unauthorized configuration within scope. Do not send new secrets back through a mailbox while its control is still uncertain.","Verify the affected business workflow, such as receiving and sending controlled mail, and confirm the monitored behavior after restoration. Re-enabling a user is not equivalent to closing the incident. Keep unresolved evidence gaps and dependencies visible, with an owner and a plan for follow-up. Escalate when privileged access, multiple accounts or broader infrastructure may be involved.",{"title":83,"text":84},"Illustrative incomplete recovery","An employee changes the password, but an unauthorized forwarding rule still sends new business mail elsewhere. The password change is a real action; the return-to-service decision must also account for the mailbox configuration, access paths and evidence of earlier activity.",{"title":86,"paragraphs":87},"Document the conclusion and agree the next scope",[88,89],"Summarize the observed window, actions, confirmed findings, limits and outstanding decisions. Separate a technical account-recovery result from a complete forensic or legal conclusion. Review why the control failed where evidence supports it, then assign focused improvements rather than claiming that one configuration change makes recurrence impossible.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with business email, account-access and digital-infrastructure work. Our Israeli technical knowledge supports scoped technical review and recovery. More extensive forensic, legal or multi-system response needs its own agreed competence and scope; no round-the-clock response or universal recovery outcome is implied.","Account-compromise response and recovery record",[92,93,94,95,96,97,98],"Trusted administrator and communication route identified","Affected identity source, role and business systems mapped","Access containment actions and their effects verified","Available evidence and action timeline preserved","Rules, forwarding, recovery and app paths reviewed","Business impact distinguished from unsupported assumptions","Return-to-service checks and follow-up owner recorded",[100,103,106],{"question":101,"answer":102},"Is changing the password enough?","No complete conclusion follows from that action alone. Review the identity source, sessions, recovery methods, mailbox rules, forwarding and application permissions as applicable. Verify the containment and recovery result in the actual tenant rather than assuming every route changed with the password.",{"question":104,"answer":105},"Does a suspicious sign-in prove that data was stolen?","It supports an investigation of the observed access, not a complete extraction finding. Correlate available sign-in, audit, mail and application evidence with its retention limits. State uncertainty explicitly and involve the appropriate specialists when a wider incident assessment is required.",{"question":107,"answer":108},"When can the employee safely use the account again?","Use agreed return-to-service criteria: trusted recovery, intended authentication and roles, addressed unauthorized settings, relevant access restrictions and a tested business workflow. Restoration and incident closure are separate decisions. Assign owners to any remaining evidence gap or follow-up monitoring.",[110,111],{"label":33,"url":34},{"label":36,"url":37},[113,115,117,119,122,125,128],{"path":13,"label":114},"Request scoped technical assistance",{"path":14,"label":116},"Discuss business email recovery scope",{"path":15,"label":118},"Review account access and recovery controls",{"path":120,"label":121},"\u002Fblog\u002Fmicrosoft-365-security-checklist","Plan the wider Microsoft 365 review",{"path":123,"label":124},"\u002Fglossary\u002Fmfa","Understand enforcement and recovery paths",{"path":126,"label":127},"\u002Fblog\u002Femail-spoofing-domain","Separate domain impersonation from mailbox compromise",{"path":129,"label":130},"\u002Fblog\u002Fphishing-link-clicked","Triage the actual post-click exposure",{"title":132,"description":133,"button":134,"type":135},"Clarify the affected account and authorized response","Describe the tenant platform, symptom and business impact. Use a trusted contact route and keep passwords, codes and private message contents out of the form.","Discuss suspected account compromise","fix",[137,146,154,161],{"id":138,"path":139,"title":140,"description":141,"category":142,"artwork":143,"order":144,"publishedOn":145},"P183","\u002Fblog\u002Fgoogle-workspace-security-checklist","Google Workspace security checklist: accounts, mail and sharing","Review administrators, recovery, 2-Step Verification, Gmail, Drive and app access. Build an action register around the actual Workspace edition and evidence.","email","integrations",38,"2026-06-18",{"id":147,"path":148,"title":149,"description":150,"category":142,"artwork":151,"order":152,"publishedOn":153},"P189","\u002Fblog\u002Fbusiness-email-backup","Business email backup and recovery: check coverage before you need it","Review mailboxes, shared mail, recovery points and permissions. Distinguish sync, retention, export and backup, then verify a controlled business recovery.","backups",27,"2026-05-17",{"id":155,"path":120,"title":156,"description":157,"category":142,"artwork":158,"order":159,"publishedOn":160},"P182","Microsoft 365 security checklist for small businesses","Review tenant ownership, admin recovery, authentication, mail, sharing and apps. Match checks to licenses and record evidence before changing business access.","plan-business",44,"2026-07-04",{"id":162,"path":163,"title":164,"description":165,"category":142,"artwork":166,"order":167,"publishedOn":168},"P181","\u002Fblog\u002Fdmarc-report-reading","How to read DMARC reports and choose the next sender check","Read DMARC report windows, source counts, identities and alignment. Use a triage worksheet while keeping reported handling separate from inbox placement.","audit",51,"2026-07-20",[],null,{"path":172,"label":173},"\u002Fresources","Website security resources and templates",{"path":175,"label":176},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058225]