Compromised Microsoft 365 account response runbook

4slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

solvingmicrosoft365.com

1 / 4

Compromised Microsoft 365 account response runbook

Compromised Microsoft 365 account runbook: what to run in the first fifteen minutes, what to check in the first hour, and when it is safe to hand it back.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-compromised-account-runbook

Slide 1Download PNG

solvingmicrosoft365.com

2 / 4

What are the first steps when a Microsoft 365 account is compromised?

Revoke sessions, block sign-in, reset the password, and delete unrecognised MFA methods — in the first ten minutes, in roughly that order. Then remove inbox rules and forwarding, revoke suspicious app consents, mark the…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-compromised-account-runbook

Slide 2Download PNG

solvingmicrosoft365.com

3 / 4

How do I know what a compromised account accessed?

Unified audit log for actions (files opened, emails sent, rules created, sharing links), Entra sign-in logs (interactive and non-interactive) for sessions, Defender for Office 365 Explorer for mail sent, and Defender fo…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-compromised-account-runbook

Slide 3Download PNG

solvingmicrosoft365.com

4 / 4

When can a compromised account be handed back to the user?

After the investigation has established scope, the password and MFA are new and registered on a trusted device, persistence (rules, forwarding, consents, devices) is removed, the risk is dismissed or remediated in Ident…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-compromised-account-runbook

Slide 4Download PNG

Auto-generated from Compromised Microsoft 365 account response runbook. This page is not indexed and isn't part of the guide itself.