It usually starts with a phone call. “My account is sending emails I didn’t write.” Or a supplier rings to ask about the strange invoice you just sent. Or Microsoft has already blocked the account from sending mail.
What you do in the next hour decides whether this stays one account or becomes a fraud loss. Business email compromise cost US businesses about $3 billion in reported losses in 2025, according to the FBI’s 2025 IC3 annual report. Most of that starts with exactly this: one Microsoft 365 mailbox in the wrong hands.
Here’s a first-hour checklist for MSPs and IT teams.
Minute 0–10: contain the account
1. Block sign-in. In the Microsoft 365 admin center or Entra admin center, block sign-in for the user. This stops new sign-ins while you work.
2. Revoke every session. A password reset alone doesn’t kick out an attacker who already has a signed-in session. In Entra, use Revoke sessions on the user (or Revoke-MgUserSignInSession in PowerShell). This forces every device, including the attacker’s, to sign in again. Our post on token theft in Microsoft 365 explains why this step matters.
3. Reset the password to a new, unique one, and give it to the user directly, not by email.
Minute 10–30: remove what the attacker left behind
Attackers rarely just read mail. They set things up so they keep access, or so the victim doesn’t notice.
4. Check MFA methods. Remove any phone number, authenticator app or key the user doesn’t recognise. A new MFA method is one of the most common ways attackers keep access after a reset.
5. Check inbox rules, including hidden ones. Look for rules that forward mail outside, move replies to RSS Feeds or Archive, or delete messages with words like “invoice”, “payment” or the boss’s name. In Exchange Online PowerShell, Get-InboxRule -Mailbox user@domain -IncludeHidden shows rules Outlook doesn’t.
6. Check mailbox forwarding (the SMTP forwarding setting on the mailbox), not just rules.
7. Check app consents. Remove any app the user granted access to that nobody recognises. A malicious app keeps reading mail even after a password reset. See account takeover for how these pieces fit together.
Minute 30–60: work out what happened
8. Read the sign-in logs. In Entra sign-in logs, look for successful sign-ins from unfamiliar countries, hosting providers or anonymising networks, and for the first one. That’s roughly when the compromise started.
9. Run a message trace for mail the account sent since then. This tells you who received the fake emails.
10. Warn the people who got them. Call, don’t email, anyone who received a payment or bank-detail request. If money was sent, the client should contact their bank immediately and report to the FBI at ic3.gov; speed matters for getting funds frozen.
11. If Microsoft blocked the account from sending, it will appear under Restricted entities in the Microsoft Defender portal. Release it only after the steps above are done.
Then: find out how they got in
Once the account is clean, find the way in, or it will happen again:
- Phished password plus a relayed MFA prompt? That’s an AiTM phishing attack.
- The user approved a prompt they didn’t start? That’s MFA fatigue.
- They typed a code on microsoft.com/devicelogin? That’s device code phishing.
For the people who handle money, the fix is usually stronger MFA plus something that watches sign-ins after they succeed.
The first-hour checklist
- Block sign-in
- Revoke all sessions
- Reset the password
- Remove unknown MFA methods
- Remove suspicious inbox rules (including hidden ones)
- Turn off unknown mailbox forwarding
- Remove unknown app consents
- Find the first bad sign-in
- Message trace from that point
- Call anyone who received a payment request
- Release the account from Restricted entities, if blocked
How Centeye Gatewatch helps
Most of this checklist is the same every time, which is why Centeye Gatewatch does it for you. It watches every sign-in across your clients’ Microsoft 365 and Google Workspace tenants and spots stolen sessions, impossible travel, new admins and sign-in methods, hidden inbox rules and risky app consent. When it finds a takeover, it ends every session, resets the password and sign-in methods, and removes what the attacker added, such as forwarding rules, at the setting you choose. Every fix is checked afterwards at Microsoft or Google.
Want to know what’s already wrong in a client tenant before the phone rings? Get started here.