How to recover a hacked Microsoft 365 account, step by step

Step one: lock the attacker out

An administrator should reset the user's password in the Microsoft 365 admin centre and choose the option to revoke sessions, which signs the account out everywhere, including any sessions the attacker holds. If you can't do that quickly, temporarily block sign-in for the account while you work. Make the new password long and unique, and set it from a device you trust.

If the attacker may have admin rights, or the compromised account is itself an administrator, treat it as more serious. Check the list of admin accounts for any you don't recognise and get professional help, because an attacker with admin access can create new accounts and change security settings across the organisation.

Step two: reset multi-factor sign-in

Look at the authentication methods registered on the account. Attackers often add their own phone number or authenticator app so they can sign in again later. Remove anything unfamiliar, then have the user re-register their MFA method in person or after their identity has been confirmed properly. If the account didn't have MFA, this is the moment to turn it on, not next week. While you're there, check that older sign-in protocols that don't support MFA are blocked, because attackers sometimes use them to avoid the second factor entirely.

Step three: remove hidden back doors

Check the mailbox for inbox rules the user didn't create, particularly ones that move, delete or mark messages as read, or that target words like invoice, payment or bank. Remove any automatic forwarding to external addresses, and check whether forwarding has been set at the admin level as well as in the user's own settings.

Review the enterprise applications and app consents linked to the account. Attackers sometimes trick users into granting a malicious app permission to read their mail, which keeps working even after the password is changed. Remove any app that isn't recognised and needed. Check mailbox delegation too, in case the attacker gave another account access.

Step four: find out what happened

Use the sign-in logs to identify when the attacker first got in, from where, and how often they returned. The unified audit log, if it's turned on, shows activity such as emails read, files accessed in OneDrive or SharePoint, and settings changed. Note that what you can see, and for how long, depends on your licence and settings. Look at sent items and deleted items for messages the attacker sent. These tell you who else may have been targeted. Record your findings with dates and times, since you may need them for your bank, insurer, the police or the Privacy Commissioner.

Step five: warn the people who need to know

If the attacker sent emails from the account, contact the recipients promptly and plainly: the account was compromised, ignore any recent request involving payments, bank details or links, and call to check anything unusual. Speed matters, because they may be about to pay a fake invoice. If money has already been sent, call the bank first. Report the incident to the NCSC and, if fraud occurred, to the police. If personal information was likely accessed and the breach could cause serious harm, the Privacy Act 2020 requires you to notify the Privacy Commissioner and affected people as soon as practicable. If you hold cyber insurance, notify the insurer early, as policies often have conditions about timing.

Step six: check the device and the rest of the team

Find out how the password was stolen. If it was through a phishing page, others may have received the same email. Search the organisation's mail for the same message and remove it. If malware is suspected on the user's computer, have it scanned or rebuilt before they sign back in. Review sign-in logs for other users at the same time, since attackers often target several people. Check whether the same password was reused on other services and change those too.

Afterwards: close the gap that let them in

Every recovered account is a lesson. Common fixes include enforcing MFA for every user, enabling number matching, blocking legacy sign-in, turning on alerts for new forwarding rules and unusual sign-ins, and restricting which apps users can grant permissions to. Many of these are settings that already exist in your Microsoft 365 tenant but haven't been switched on. Share a short, blame-free summary with staff about what happened and what to look out for. People learn far more from a real incident close to home than from a generic training slide.