Suspect your Microsoft 365 account has been compromised?

Act now

1. Stop approving unexpected sign-in prompts and stop using suspicious links.
2. Contact your IT administrator by phone or another known channel. If email is compromised, do not rely on that mailbox to coordinate the response.
3. If payment details or bank instructions may have been altered, phone the relevant people using independently verified numbers. Contact your bank immediately if money has been sent.
4. Record what happened and when. Keep suspicious messages and error details available for investigation.

Call Bluewall: 02392 598002

What your administrator needs to do

Contain the incident, including blocking the affected account where appropriate, resetting its password at the correct identity source and revoking sign-in sessions. Review registered authentication methods and remove unauthorised methods as part of the investigation.

Review sign-ins, inbox rules, forwarding, sent mail, delegated access and application permissions. Check for access to other accounts or business data. Preserve relevant evidence while containing ongoing access. Session revocation may not immediately terminate every application session.

Check the impact before restoring normal use

Establish what the attacker could access and whether messages were sent to customers or colleagues. Warn affected contacts through a trusted channel if required. Review devices for compromise where indicated, and consider contractual and data-protection reporting obligations with appropriate advice.

Restore access once containment and recovery checks are complete. Monitor for renewed suspicious activity. Do not assume a clean-looking inbox means the incident is over.

Reduce the chance of another incident

Use MFA and review phishing-resistant sign-in options, separate administrator accounts and appropriate access policies with your IT provider. Review mail protection and staff reporting procedures for the business.

Business cybersecurity support · Recognise suspicious emails

Further guidance

Microsoft: responding to a compromised Microsoft 365 email account