Microsoft 365 Account Takeover: A Recovery Runbook
September 16, 2026
How to remove an attacker from a Microsoft 365 account and prove it: session revocation, Entra ID sign-in analysis, audit log export, and conditional access hardening.
Microsoft 365 is the most common place we meet business email compromise, mostly because it is where the mail is. The good news is that the platform records a great deal. The bad news is that much of it ages out, and default settings make some of it optional.
Contain
Reset the password, then revoke sessions and refresh tokens for the user in Entra ID. Block sign-in temporarily if the user does not need mail for the next hour — it is the cleanest way to stop mid-recovery re-entry. Remove app passwords and disable legacy authentication protocols if they are still enabled anywhere in the tenant.
Look for persistence
Work through, in order: inbox rules, external forwarding and mail flow rules, mailbox delegation and "send as" rights, enterprise application consent grants with Mail scopes, MFA methods registered on the account, and any newly enrolled device.
Investigate
Pull Entra ID sign-in logs for the whole compromise window, filtered on the account and on the attacker's IP ranges and user agents. Then export the unified audit log for mailbox activity — MailItemsAccessed events are what let you say which messages were actually read rather than which could have been. If auditing was not on before the incident, that visibility does not exist retroactively, which is precisely why we turn it on during onboarding.
Scope the data
Search the mailbox for the categories that carry obligations: personal identifiers, health information, payment data, and credentials. This is the input to your notification decision, not an afterthought.
Harden
Conditional access that requires MFA for all users and blocks legacy authentication. Phishing-resistant MFA for finance and executives. Anti-phishing and impersonation protection in Defender for Office 365. Alerts on new forwarding rules and on consent grants. External sender tagging so a lookalike domain gets noticed.
Our Microsoft 365 administration and security practice does this work as a standing engagement, and our SOC watches the identity telemetry afterwards through managed detection and response.
Business email compromised right now? Call 1-844-LYRA-REC — our incident commanders answer live 24/7 and start containment on the first call. See our business email compromise response page for the first-hour checklist.