Responding to an Office 365 Compromised Account

When an Office 365 email account is compromised, it means someone has stolen the account credentials. This theft grants attackers unauthorized access to sensitive data, such as emails, SharePoint files, and OneDrive documents. Attackers often misuse compromised accounts to send spam, spread malware, or exfiltrate sensitive information.
This guide will explain how to recognize the signs of a compromised Office 365 account, recover it, and secure it to prevent future breaches.

Symptoms of a Compromised Office 365 Account

Users might notice unusual activity in their email or account settings, which could indicate a breach. Common signs include:

• Missing or Deleted Emails: Emails disappear unexpectedly.
• Emails Sent Without User Knowledge: Recipients report receiving suspicious emails from the account, but there are no records in the Sent Items folder.
• Unusual Inbox Rules: New rules may forward emails to unknown addresses or move messages to unusual folders like Notes or Junk.
• Display Name Changes: The user’s display name in the Global Address List is altered.
• Email Sending Blocked: The account is restricted from sending emails.
• Spam-like Sent Emails: The Sent Items folder contains phishing emails, such as “Send money, I’m stuck abroad.”
• Profile Changes: Unexpected changes to name, phone number, or address.
• Frequent Password Changes: Multiple password resets without the user’s knowledge.
• External Forwarding Added: Emails are forwarded to unknown external addresses.
• New Email Signatures: Suspicious signatures, such as those imitating banks or advertisements.

Tools to Investigate Suspicious Activity

• Microsoft Defender Audit Logs: Search audit logs for unusual activities using a date range starting before the breach.
• Entra ID (Azure AD) Sign-In Logs: Check for unusual IP addresses, sign-in locations, and failed login attempts.
• Microsoft 365 Admin Center Test: Run tests to detect compromised accounts.

How to Secure and Restore a Compromised Office 365 Account

Even after regaining account access, attackers may have left backdoors. Follow these steps to secure the account and prevent further unauthorized access:

Step 1: Reset the User’s Password

• Create a strong password (uppercase, lowercase, numbers, and special characters).
• Don’t email the new password since attackers may still have mailbox access.
• If the account uses federated identities, reset the password in the on-premises system as well.
• Delete and recreate app passwords. Learn how to manage app passwords.
• Enable Multi-Factor Authentication (MFA) for enhanced security. Set up MFA now.

Step 2: Remove Suspicious Forwarding Addresses

1. Go to Microsoft 365 Admin Center.
2. Navigate to Users > Active Users.
3. Select the affected user account and click the Mail tab.
4. Under Email Forwarding, check and remove any unknown forwarding addresses.

Step 3: Disable Suspicious Inbox Rules

1. Sign in to Outlook Web.
2. Go to Settings (gear icon) and search for “Inbox rules.”
3. Review and delete any suspicious rules redirecting or hiding emails.

Step 4: Unblock the User’s Account

If the account is flagged for sending spam, unblock it using these steps to remove restricted accounts.

Step 5 (Optional): Block the User from Signing In

• Temporarily disable the user’s account to prevent further misuse.
• Use the Microsoft 365 Admin Center or Exchange Admin Center to block sign-ins.

Step 6 (Optional): Remove Administrative Roles

If the compromised account has admin privileges, remove them temporarily.

• Go to Microsoft Defender Permissions to review and edit roles.
• Remove the user from all administrative role groups.

Step 7 (Optional): Additional Precautions

• Review the Sent Items folder for phishing emails sent during the breach.
• Notify contacts about the breach if fraudulent emails were sent.
• Check for external services linked to the compromised account, such as third-party apps or alternative email addresses.

Best Practices to Prevent Office 365 Compromises

1. Use Strong Passwords: Avoid reusing passwords and make them difficult to guess.
2. Enable MFA for All Accounts: This adds an extra layer of protection. Learn more about MFA.
3. Monitor Account Activity: Regularly review audit and sign-in logs for unusual activities.
4. Educate Users: Train employees to recognize phishing scams and avoid sharing credentials.
5. Set Up Alerts: Use tools like Microsoft Defender to receive notifications about suspicious activities.

Conclusion

Recovering from an Office 365 compromised account requires immediate action to secure data and prevent further damage. Recognizing the signs, using Microsoft’s investigation tools, and following recovery steps can help regain control quickly. Proactive measures, like MFA and employee training, are essential for reducing the risk of future compromises.

FAQs

1. What is the first step I should do if my Office 365 account is compromised?

If you suspect your account is compromised:

• Inform the system admin and ask him to reset the password and enforce the MFA.
• Check and remove any suspicious inbox rules or email forwarding settings.
• Review your account activity in the Microsoft 365 Admin Center for unauthorized access.

2. How can I tell if my Office 365 account is hacked?

Signs of a compromised account include:

• Missing emails or suspicious email forwarding rules.
• Spam emails sent from your account that you didn’t authorize.
• Not able to send emails because your account is blocked.
• Notifications about unusual login activity from unfamiliar locations or IP addresses.

3. Can enabling MFA prevent my Office 365 account from being hacked?

Yes, enabling Multi-Factor Authentication (MFA) significantly reduces the chances of an account being compromised. MFA requires an additional verification step, such as a code sent to your phone, making it much harder for attackers to access your account even if they have your password.

4. What is the best way to investigate suspicious activity on Office 365 account?

Microsoft provides several tools to investigate account activity:

• Unified Audit Logs: Tracks all user activities across Office 365 services.
• Entra ID (Azure AD) Sign-In Logs: Provides information on sign-in attempts, locations, and IP addresses.
• Microsoft 365 Admin Center Test: Runs a dedicated test to identify compromised accounts.

5. How can I prevent Office 365 accounts in my organization from being compromised?

To enhance account security:

• Enforce the use of strong passwords and regular updates.
• Create a Conditional Access Policy or Enable Mutli-factor authentication for all M365 Accounts.
• Train employees to recognize phishing emails and avoid sharing credentials.
• Regularly Monitor sign-in logs in Entra ID Portal.
• Set up alerts for suspicious activity, such as login attempts from unusual locations.

For further assistance, explore Microsoft’s official security resources or consult your IT administrator