Microsoft 365 account takeover: warning signs and response steps

How do I know if a Microsoft 365 account has been compromised?

A compromised mailbox usually shows a sign-in from an unfamiliar place, a rule the real user never created, or odd behavior in the Sent and Deleted Items folders. The account may also get blocked from sending mail, or the address book may show contact details nobody recognizes.

Microsoft describes several of these patterns as common markers of a compromised account: inbox rules that forward mail to unknown addresses or move messages into the Notes, Junk Email or RSS Subscriptions folder, strange messages sitting in Sent Items or Deleted Items, frequent password changes or lockouts the user did not request, and a mailbox that suddenly cannot send mail (Microsoft Learn, Respond to a compromised email account in Microsoft 365, 2026). None of these signs on their own prove an attack, but two or three together are worth a closer look.

Why do attackers create inbox rules in a hacked mailbox?

An inbox rule lets an attacker read or redirect mail without logging in again after the first break-in. A rule that forwards invoices, payment requests or legal correspondence to an outside address can run quietly for weeks before anyone notices.

Automatic external forwarding is a known exposure point, and Microsoft recommends setting outbound spam filter policies to turn forwarding on or off explicitly, since the default can differ between organizations (Microsoft Learn, Control external email forwarding, 2026). CISA's baseline for Exchange Online goes further, calling for automatic forwarding to external domains to stay disabled and for mailbox auditing to stay enabled, noting that forwarding is a common way attackers keep access to a mailbox after the original compromise (CISA, M365 Secure Configuration Baseline for Exchange Online, 2025). A finance team that spots a forwarding rule it did not set up should treat it as an active incident, not a setting to quietly delete.

What is an app consent attack in Microsoft 365?

An app consent attack starts when a user approves a request from a malicious app registered in Microsoft Entra ID, often after a phishing message that looks like a normal sign-in or document-sharing prompt. Once approved, the app can read mail, contacts or documents under that account without ever needing the password.

This matters because a password reset alone will not remove the access. Microsoft's guidance notes that illicit consent grants give attackers account-level access that survives a password change, and recommends that large organizations review consent grants on a weekly basis (Microsoft Learn, Detect and remediate illicit consent grants, 2026). A finance leader who approved a request that looked like a routine document link may be the entry point for an attack that has nothing to do with a stolen password.

Which Microsoft 365 settings help prevent account takeover?

A handful of settings reduce the chance an attacker gets in, or limit the damage if they do. Phishing-resistant sign-in methods and less reliance on long-lived credentials both cut down on the stolen-password problem, and ongoing monitoring for unusual access patterns, new permissions and new application activity catches what slips through (Microsoft, Digital Defense Report 2026, 2026).

Microsoft Entra ID Protection includes automatic risk detections for suspicious inbox forwarding, suspicious inbox manipulation rules, atypical travel, unfamiliar sign-in properties, password spray, leaked credentials, and attacker-in-the-middle activity, along with flags when users report an MFA prompt as suspicious (Microsoft Learn, What are risk detections? Microsoft Entra ID Protection, 2026). Combined with the forwarding and auditing settings described above, these detections give an organization a way to catch most takeover attempts before money or data leaves the building.

What should we do first when a Microsoft 365 account is compromised?

The first move is to cut off access, not to investigate. Microsoft lays out a specific order for responding to a compromised mailbox:

1. Disable the account, or reset the password if disabling is not possible.
2. Revoke active sessions so existing sign-ins stop working.
3. Review registered MFA devices and methods for anything the user did not add.
4. Review apps with user consent and remove anything unfamiliar.
5. Review admin roles for unexpected changes.
6. Remove mailbox forwarding and inbox rules, including hidden rules.
7. Check sign-in logs for IP address, location, time and success or failure.

(Microsoft Learn, Respond to a compromised email account in Microsoft 365, 2026)

As an illustrative example only, a typical overnight sequence under a client's agreed response rules might run like this: 02:14, a sign-in to a finance manager's email from an unfamiliar country; 02:15, a new rule forwarding the mailbox to an outside address; 02:17, the account disabled under the client's approved rules; 02:41, an analyst confirming a phishing email as the source of the stolen password; 07:30, the IT lead receiving findings, actions taken and next steps; 09:05, the password reset with multifactor sign-in required, the rule removed, the account back in use, and staff warned. Steps and timing vary by organization and by the rules each client approves in advance.

Does resetting the password remove the attacker?

A password reset alone does not remove an attacker who has set up other forms of access. App passwords, for example, are not revoked by a password reset and keep working until someone removes them directly (Microsoft Learn, Respond to a compromised email account in Microsoft 365, 2026).

This is why the response order above puts session revocation, MFA review and consent review alongside the password reset rather than treating the reset as the final step. A reset without the other checks can leave a forwarding rule, a consented app or an active session in place.

How does a hacked email account lead to payment fraud?

A compromised mailbox gives an attacker everything needed to intercept or redirect a payment: visibility into invoices, vendor names, approval chains and the writing style of the real account owner. Business email compromise reached USD 3,046,598,558 in reported losses to the FBI in 2025 across 24,768 complaints, making it the second-largest loss type after investment fraud, up from USD 2,770,151,146 in 2024 (FBI IC3, 2025 Internet Crime Report, 2026).

Most of these attacks start with something ordinary. User execution, valid account abuse, social engineering and phishing account for 73.3 percent of initial access attempts, and adversary-in-the-middle phishing kits, OAuth app abuse and password spray are now standard attacker tools (Microsoft, Digital Defense Report 2026, 2026). Microsoft also tracked more than 46 million business email impersonation attempts in a single year, with 52.2 percent of valid account intrusions leading to further credential theft, and 89 to 95 percent of phishing attachments tied to an attempt to steal credentials (Microsoft, Digital Defense Report 2026, 2026). A single stolen password, left unchecked, can turn into a redirected wire transfer.