Microsoft 365 Account Hacked? The Signs and First Steps

A hacked Microsoft 365 account usually shows itself in the mailbox before anywhere else: an inbox rule you didn't make, mail forwarding to a stranger, or replies to messages you never sent. If you see any of those, assume the account is compromised and lock it down now. Investigating comes second.

Speed matters because the attacker is rarely after the mailbox itself. They want what they can do from it: invoices, wire instructions, payroll changes.

What are the signs a Microsoft 365 account is compromised?

Microsoft's own troubleshooting guide lists the symptoms. The ones small businesses see most:

• Inbox rules nobody created. Microsoft calls out "rules that automatically forward email to unknown addresses" and rules that move messages to the Notes, Junk Email or RSS Subscriptions folders.
• New external forwarding on the mailbox itself, separate from any rule.
• Strange messages in Sent Items or Deleted Items. Microsoft's example: "I'm stuck in London, send money."
• Missing or deleted email, especially replies from a client or vendor about payments.
• The mailbox can't send email. Microsoft blocks accounts that suddenly blast out spam.
• Frequent password changes or unexplained lockouts.
• A changed email signature, or edits to the user's name, phone or address in the company directory.

Outside the mailbox, watch for MFA prompts the user didn't trigger, sign-ins from another country, and an MFA method or phone number the user never added.

Why do attackers create inbox rules?

To hide. A rule that sends any message containing "invoice," "wire" or "payment" to RSS Subscriptions means the real user never sees the vendor asking why the bank details changed.

That's the setup for business email compromise. The FBI logged $3,046,598,558 in business email compromise losses in 2025, more than any cyber-enabled fraud type except investment scams, according to the IC3 2025 Internet Crime Report.

The rule is the part you can catch. The wire transfer usually isn't. Our guide to business email compromise walks through the full scheme.

What do you do in the first hour?

Cut off access first, then clean up. This follows the order in Microsoft's guidance.

1. Disable the account. Microsoft says disabling it is "preferred and highly recommended until you complete the investigation." If you can't, reset the password, and don't email the new password to the user. The attacker may be reading that inbox.
2. Sign out every session. A password reset alone won't kick out an attacker holding a stolen session token. Revoke sessions in the Entra admin center so every device has to sign in again.
3. Remove MFA methods you don't recognize. Attackers often register their own phone or authenticator app so they can get back in after the reset.
4. Check app consents. Remove any app the user granted access to that you don't recognize. A malicious app keeps its access after a password change.
5. Check admin roles. Remove any role the account shouldn't have.
6. Delete the bad rules and forwarding. Look for hidden inbox rules too. They don't always show up in Outlook, and Microsoft's compromised account response guide shows how to list them.
7. Revoke app passwords. Microsoft notes they "aren't automatically revoked when you reset the password."

Then warn the people who matter. Call your bank, your finance team and any vendor or client who got email from that account in the last few weeks. Use a phone number you already have, not one from an email.

How do you find out what the attacker did?

Pull the logs before you close the ticket. You need to know what they read and who they wrote to.

• Sign-in logs in Entra ID show where and when the account was used.
• The unified audit log in Microsoft Purview shows rule changes, forwarding changes and mailbox access, if auditing is on.
• Message trace shows what the account sent, and to whom.

If the mailbox held client financial records or health information, you may have notification duties. That's a call for your attorney and your cyber insurer, and many policies require prompt notice. See our cyber insurance claim FAQ.

How do you stop it happening again?

The fixes are well known. Most small businesses just haven't turned them on.

• Phishing-resistant MFA. Text-message codes and push prompts can be phished. Passkeys can't. Here's how passkeys compare with standard MFA.
• Block automatic external forwarding in Exchange Online, with exceptions only for accounts that need it.
• Alert on new inbox rules. Microsoft Defender can flag suspicious rules. Someone has to be watching the alerts.
• Lock down app consent so users can't grant third-party apps access to company mail on their own.
• Use Conditional Access to block sign-ins from places and devices you don't expect. Start with our guide to Conditional Access for small business.

Attackers also steal sign-in sessions outright, which gets around MFA. We covered that in session hijacking.

Frequently asked questions

Will changing my password kick the hacker out?

Not on its own. An attacker with a stolen session token stays signed in until you revoke sessions.

App passwords and malicious app consents also survive a reset. Change the password, revoke all sessions, remove unknown MFA methods and check app permissions, in that order.

How do I find hidden inbox rules?

Some rules don't appear in Outlook's rules list. An admin can list every rule, including hidden ones, with Exchange Online PowerShell, using Get-InboxRule with the IncludeHidden switch. Look for rules that forward, delete, or move mail to Notes, Junk Email or RSS Subscriptions.

How did they get in if we have MFA?

Usually through a fake sign-in page that captures the password and the MFA code at the same time, or through a stolen session cookie.

Standard MFA stops password-only attacks. It doesn't stop those. Passkeys shut down the fake page, and Conditional Access with device controls makes a stolen cookie much harder to use.

Do we have to report a hacked email account?

It depends on what was in the mailbox and where you operate. Exposed personal, financial or health data can trigger state, HIPAA or SEC notification rules.

Talk to your attorney and cyber insurer quickly. We're not lawyers, and this isn't legal advice.

Should we report it to the FBI?

If money moved, yes, at ic3.gov, and call your bank first. Speed matters for any chance of recovering a wire. Even if nothing was stolen, a report helps if the same attacker hits your clients or vendors next.