Skip to content
← Back to the guide

How to block a compromised account in Microsoft 365

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

How to block a compromised account in Microsoft 365

How to block a compromised Microsoft 365 account in ten minutes: disable sign-in, revoke sessions, reset password and MFA, kill inbox rules and forwarding.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

Is disabling the account enough to stop an attacker in Microsoft 365?

No. Blocking sign-in stops new sign-ins, but access tokens already issued keep working until they expire (up to an hour for most apps), and refresh tokens keep minting new ones unless you revoke sessions. Block sign-in…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

Should I reset the password before or after revoking sessions?

Order matters less than doing all three within minutes: block sign-in, revoke sessions, reset the password. If you can only do one thing immediately, revoke sessions — it is the action that actually cuts an active attac…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

What do attackers leave behind in a compromised Microsoft 365 mailbox?

Inbox rules that delete or move replies, mailbox forwarding to an external address, OAuth app consents that keep access after the password changes, and sometimes a second registered MFA method or a registered device. Ch…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Step 1: Block sign-in

Microsoft 365 admin center → Users → Active users → the user → Block sign-in, or in Entra: Users → the user → Edit properties → Account enabled: No.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Step 2: Revoke sessions

This is the action that ends an active session. In Entra on the user's Overview choose Revoke sessions, or:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Step 3: Reset the password

Reset to a long random value; do not hand it to the user yet. If the account is synced from on-premises AD, reset it in AD and force a sync (Start-ADSyncSyncCycle -PolicyType Delta) or the cloud value will be overwritte…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

Step 4: Reset MFA and check registered methods

Open Authentication methods for the user. Delete any method you do not recognise — attackers routinely register their own Authenticator app so they survive a password reset — then Require re-register MFA. The step-by-st…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365

Slide 8Download PNG

Auto-generated from How to block a compromised account in Microsoft 365. This page is not indexed and isn't part of the guide itself.