How to Tell If a Hacker Is Still Inside Your Microsoft 365 Account

After an email compromise, it is natural to feel a sense of unease. You may have changed the user’s password and forced a sign-out, but a critical question remains: is the attacker still in your Microsoft 365 environment? Removing initial access is only one part of the solution. Attackers often create secondary backdoors to maintain persistence long after the initial point of entry is closed.

This article provides the specific signs and investigative steps to determine if a hacker has established persistence in your Microsoft 365 or Entra ID (formerly Azure Active Directory) tenant. These are the digital footprints attackers leave when they plan to return. Finding and removing them is the only way to be certain your environment is secure.

If you are dealing with an active email compromise, contact our 24/7 incident response team for immediate assistance at our business email compromise response page.

How Can You Tell If a Hacker Is Still in Your Account?

Determining if a threat actor still has access requires a methodical investigation of specific logs, settings, and configurations within your Microsoft 365 environment. Simply changing a password is not enough. Sophisticated attackers anticipate this and build other ways to get back in or maintain access without needing the password again. You must actively hunt for these persistence mechanisms.

The most common signs of ongoing access include suspicious sign-in activity, newly registered applications, unexpected forwarding rules, and changes to mailbox permissions. Each of these can act as a backdoor, allowing an attacker to read emails, access files, and re-establish control.

1. Check for New, Unexpected Multi-Factor Authentication (MFA) Devices

Attackers who gain access to an account will often enroll their own device for MFA. This allows them to approve future sign-in prompts, giving them persistent access even if you reset the account's password.

• Where to Look: Microsoft Entra ID > Users > [Compromised User] > Authentication Methods.
• What to Look For: Examine the list of registered MFA devices. Look for phone numbers, authenticator app instances, or security keys that do not belong to the legitimate user. Pay close attention to the date they were added. An authentication method added around the time of the suspected compromise is highly suspicious.

2. Review Sign-In Logs for Impossible Travel and Unusual Locations

Sign-in logs are a primary source of truth for account activity. Microsoft Entra ID provides detailed logs that can help you trace the attacker's footsteps. The availability and retention of these logs depend on your Microsoft 365 licensing.

• Where to Look: Microsoft Entra ID > Users > [Compromised User] > Sign-in logs.
• What to Look For:
  • Impossible Travel: Look for alerts flagged by Microsoft for sign-ins from geographically distant locations in a short period.
  • Unusual Locations: Are there successful sign-ins from countries or regions where you do not operate? Note the IP addresses associated with these logins for further investigation.
  • Suspicious User Agents: The user agent string shows the browser and operating system used. Look for outdated browsers or unusual values, which can indicate automated access.

3. Audit for New Email Forwarding or Deletion Rules

This is one of the most common persistence tactics. An attacker sets up an inbox rule to automatically forward a copy of incoming (and sometimes outgoing) emails to an external email address they control. They may also create rules to delete notifications or warnings from Microsoft to hide their tracks.

• Where to Look: Use the Microsoft 365 Purview portal or run a PowerShell command (Get-InboxRule) to audit rules for all mailboxes. Looking through the Outlook Web App (OWA) interface for the user is not sufficient, as attackers can create hidden rules.
• What to Look For: Any rule that forwards messages to an external domain (e.g., gmail.com, outlook.com, or a domain you don't recognize). Also, look for rules that move messages containing keywords like "invoice," "fraud," "hacked," or "password" to obscure folders like RSS Feeds or Junk, or mark them as read. Learn more about how to stop unauthorized email forwarding rules.

4. Search the Unified Audit Log for Suspicious Activity

The Unified Audit Log (UAL) in Microsoft Purview is your most comprehensive resource for investigating user and admin activity. You must have auditing enabled to use it, and log retention varies by license.

• Where to Look: Microsoft Purview > Audit.
• What to Look For: Filter for the compromised user and look for activities such as:
  • Add-MailboxPermission or Add-MailboxFolderPermission: Granting another user (often one the attacker created) access to the mailbox.
  • Set-Mailbox with ForwardingSmtpAddress or ForwardingAddress: Another method of setting up email forwarding.
  • New-InboxRule: Creation of the inbox rules mentioned above.
  • MailItemsAccessed: Indicates that someone or something accessed email data. Correlate the IP addresses for this activity with known good locations.
  • Add owner to application or Add service principal: Signs of application-based persistence.

5. Look for Malicious or Unrecognized Enterprise Applications

Attackers can trick users into granting consent to a malicious "Enterprise Application." This is known as consent phishing. Once granted, the application has permissions to access data (like email and files) on the user's behalf via API, completely bypassing MFA and password resets. The application retains this access until its permissions are revoked.

• Where to Look: Microsoft Entra ID > Enterprise applications > All applications. Also check User settings > Enterprise applications to see which permissions users can grant.
• What to Look For: Review the list for any applications you don't recognize. Pay close attention to the permissions they have been granted. An application with high-level permissions like Mail.ReadWrite, Mail.Read, or Files.ReadWrite.All that is not part of a known, trusted vendor solution is a major red flag. Check the "Granted by" column to see which user approved it and when.

Next Steps to Remove a Hacker from Microsoft 365

If you find evidence of persistence, you must act methodically to eradicate the threat actor completely. The order of operations is critical.

1. Do Not Tip Off the Attacker: Avoid making obvious changes one-by-one, such as deleting a single inbox rule. This can alert the attacker, who may escalate their activity or use another backdoor you haven't found yet. Have a full remediation plan ready before you act.

2. Preserve Logs: Before you make any changes, ensure you have exported and saved all relevant sign-in and audit logs. These are critical evidence for your investigation and for any potential legal or regulatory follow-up. If you're not sure how long your license retains logs, export the last 90 days.

3. Execute a Coordinated Remediation: Perform these steps in rapid succession:

   • Revoke All Active Sessions: For the compromised account, use the "Revoke sessions" feature in the Entra ID user blade. This invalidates all current login tokens on all devices.
   • Reset the Password: Immediately create a new, strong, unique password for the account.
   • Remove Malicious Persistence: Delete the unauthorized MFA devices, inbox rules, and Enterprise App permissions you identified. Disable any suspicious accounts.
   • Review All recent actions taken by the compromised user: Search the audit log for all activities performed by the compromised user since the incident began. You must identify every action they took to understand the full scope of the breach.

4. Report Financial Fraud Immediately: If the compromise resulted in wire fraud or other financial loss, the single most important step is to contact your financial institution immediately. Ask them to initiate a SWIFT recall or other fraud reversal process. You should also report the incident to the FBI via the Internet Crime Complaint Center at ic3.gov. Time is critical. For more information read, We Sent Money to a Fraudulent Bank Account: Can We Get It Back?

When Do You Need an Outside Incident Response Firm?

While some organizations can handle initial containment, persistence hunting often requires specialized expertise. You should call for professional help if:

• You Are Unsure How to Perform the Checks: If you lack the IT resources or familiarity with Entra ID and Purview, an incident response firm can conduct a thorough investigation much faster.
• You Find Evidence of Persistence: The discovery of a backdoor like a malicious Enterprise App means the incident is more complex than a simple password compromise. Experts are needed to trace the attacker's activity and ensure complete removal.
• The Incident Involves Multiple Accounts or Data Exfiltration: A widespread or deep compromise requires a formal incident response process to contain the threat, determine the scope of data loss, and meet any notification requirements.
• The Incident Involves Financial Fraud: A firm like Lyra Recovery can manage the technical investigation while you focus on the financial recovery and legal aspects. We provide the clear, actionable intelligence your bank, law enforcement, and cyber insurer will need.

Frequently Asked Questions

If I reset the password and turn on MFA, am I safe?

Not necessarily. If the attacker already registered their own MFA device or granted consent to a malicious application, they can bypass the new password. You must perform all the checks described above to be sure they are gone.

How long does an attacker stay in an account?

This varies widely. Some attackers strike quickly to execute a financial fraud scheme and move on. Others, particularly in cases of espionage or more sophisticated financial attacks, may dwell for weeks or months, silently observing and gathering information before they act.

Can a hacker access my files in SharePoint or OneDrive?

Yes. A compromised Microsoft 365 account has the same permissions as the legitimate user. This includes access to that user's OneDrive and any SharePoint sites, Teams, and Groups they are a member of. This is a primary reason a hacked email can lead to a data breach.

Microsoft sent a "suspicious activity" alert. Does that mean a hacker is still in there?

It means you need to investigate immediately. These alerts are a good starting point, but they are not foolproof. You must correlate the alert with sign-in and audit log data to confirm if the activity was malicious and then hunt for the persistence mechanisms outlined in this guide.

Discovering signs of hacker persistence requires a calm, methodical, and expert-led approach. If you've performed these checks and are still unsure, or if you've confirmed that the attacker has created backdoors in your environment, it is time to engage professional help. Lyra Recovery’s incident response team specializes in Microsoft 365 compromises, helping businesses quickly identify and eradicate threat actors. Contact us for a confidential consultation through our incident intake form.

For the full recovery roadmap, see our guide to business email compromise recovery.