Responding to a Compromised Email Account - Microsoft Defender for Office 365 (2024)

Credentials control access to Microsoft 365 mailboxes, data, and other services. When someone steals those credentials, the associated account is considered to be compromised.

After an attacker steals the credentials and gains access to the account, they can access the associated Microsoft 365 mailbox, SharePoint folders, or files in the user's OneDrive. Attackers often use the compromised mailbox to send email as the original user to recipients inside and outside of the organization. Attackers using email to send data to external recipients is known as data exfiltration.

This article explains the symptoms of account compromise and how to regain control of the compromised account.

Symptoms of a compromised Microsoft email account

Users might notice and report unusual activity in their Microsoft 365 mailboxes. For example:

• Suspicious activity, such as missing or deleted email.
• Users receiving email from the compromised account without the corresponding email in the sender's Sent Items folder.
• Suspicious Inbox rules. These rules might automatically forward email to unknown addresses or move messages to the Notes, Junk Email, or RSS Subscriptions folders.
• The user's display name is changed in the Global Address List.
• The user's mailbox is blocked from sending email.
• The Sent Items or Deleted Items folders in Microsoft Outlook or Outlook on the web (formerly known as Outlook Web App) contain typical messages for compromised accounts (for example, "I'm stuck in London, send money.").
• Unusual profile changes. For example, name, telephone number, or postal code updates.
• Multiple and frequent password changes.
• Recently added external email forwarding.
• Unusual email message signatures. For example, a fake banking signature or a prescription drug signature.

You need to immediately investigate if a user reports these or other unusual symptoms. The Microsoft Defender portal and the Azure portal offer the following tools to help you investigate suspicious activity on a user account:

• Unified audit logs in the Microsoft Defender portal: Filter the logs for activity using a date range that starts immediately before the suspicious activity occurred to today. Don't filter on specific activities during the search. For more information, see Search the audit log.

• Microsoft Entra sign-in logs and other risk reports in the Microsoft Entra admin center: Examine the values in these columns:

  • Review IP address
  • sign-in locations
  • sign-in times
  • sign-in success or failure

Secure and restore email function to a compromised Microsoft 365 account and mailbox

Even after the user regains access to their account, the attacker might leave back-door entries that can regain control of the account.

Do all of the following steps to regain control of the account. Go through the steps as soon as you suspect a problem and as quickly as possible to make sure that the attacker doesn't regain control of the account. These steps also help you remove any back-door entries that the attacker added to the account. After you do these steps, we recommend that you run a virus scan to make sure that the client computer isn't compromised.

Step 1: Reset the user's password

Follow the procedures in Reset a business password for someone.

Step 2: Remove suspicious email forwarding addresses

1. In the Microsoft 365 admin center at https://admin.microsoft.com, go to Users > Active users. Or, to go directly to the Active users page, use https://admin.microsoft.com/Adminportal/Home#/users.

2. On the Active users page, find the user account, and select it by clicking anywhere in the row other than the check box next to the name.

3. In the details flyout that opens, select the Mail tab.

4. On the Mail tab, the value Applied in the Email forwarding section indicates that mail forwarding is configured on the account. To remove it, do the following steps:

   • Select Manage email forwarding.
   • In the Manage email forwarding flyout that opens, clear the Forward all email sent to this mailbox check box, and then select Save changes.

Step 3: Disable suspicious Inbox rules

1. Sign in to the user's mailbox using Outlook on the web.

2. Select Settings (gear icon), enter 'rules' in the Search settings box, and then select Inbox rules in the results.

   See Also

   Can Your Employer Spy on You at Home

3. On the Rules flyout that opens, review the existing rules, and turn off or delete any suspicious rules.

Step 4: Unblock the user from sending mail

If the account was used to send spam or a high volume of email, it's likely that the mailbox is blocked from sending mail.

To unblock a mailbox from sending email, follow the procedures in Remove blocked users from the Restricted entities page.

Step 5 Optional: Block the user account from signing-in

1. Do the following steps in the Microsoft 365 admin center at https://admin.microsoft.com:

   1. Go to Users > Active users. Or, to go directly to the Active users page, use https://admin.microsoft.com/Adminportal/Home#/users.
   2. On the Active users page, find and select the user account from the list by doing one of the following steps:
      • Select the user by clicking anywhere in the row other than the check box next to the name. In the details flyout that opens, select Block sign-in at the top of the flyout.
      • Select the user by selecting the check box next to the name. Select More actions > Edit sign-in status.
   3. In the Block sign-in flyout that opens, read the information, select Block this user from signing in, select Save changes, and then select Close at the top of the flyout.

2. Do the following steps in the Exchange admin center (EAC) at https://admin.exchange.microsoft.com:

   1. Go to Recipients > Mailboxes. Or, to go directly to the Mailboxes page, use https://admin.exchange.microsoft.com/#/mailboxes.

   2. On the Manage mailboxes page, find and select the user from the list by clicking anywhere in the row other than the round check box that appears next to the name.

   3. In the details flyout that opens, do the following steps:

      1. Verify the General tab is selected, and then select Manage email apps settings in the Email apps & mobile devices section.
      2. In the Manage settings for email apps flyout that opens, disable all of the available settings by changing the toggles to Disabled:
         • Outlook desktop (MAPI)
         • Exchange Web Services
         • Mobile (Exchange ActiveSync)
         • IMAP
         • POP3
         • Outlook on the web

      When you're finished in the Manage settings for email apps flyout, select Save, and then select Close at the top of the flyout.

Step 6 Optional: Remove the suspected compromised account from all administrative roles

1. In the Microsoft 365 admin center at https://admin.microsoft.com, do the following steps:

   1. Go to Users > Active users. Or, to go directly to the Active users page, use https://admin.microsoft.com/Adminportal/Home#/users.

   2. On the Active users page, find and select the user account from the list by doing one of the following steps:

      • Select the user by clicking anywhere in the row other than the check box next to the name. In the details flyout that opens, verify the Account tab is selected, and then select Manage roles in the Roles section.
      • Select the user by selecting the check box next to the name. Select More actions > Manage roles.

   3. In the Manage admin roles flyout that opens, do the following steps:

      • Record any information that you want to restore later.
      • Remove administrative role membership by selecting User (no admin center access).

      When you're finished in the Manage admin roles flyout, select Save changes.

2. In the Microsoft Defender portal at https://security.microsoft.com, do the following steps:

   1. Go to Permissions > Email & collaboration roles > Roles. Or, to go directly to the Permissions page, use https://security.microsoft.com/emailandcollabpermissions.

   2. On the Permissions page, select a role group from the list by selecting the check box next to the name (for example, Organization Management), and then selecting Edit action that appears.

   3. In the Edit members of the role group page that opens, review the list of members. If the role group contains the user account, remove the user by selecting the check box next to the name, and then selecting Remove members.

      When you're finished on the Edit members of the role group page, select Next

   4. On the Review the role group and finish page, review the information, and then select Save.

   5. Repeat the previous steps for each role group in the list.

3. In the Exchange admin center at https://admin.exchange.microsoft.com/, do the following steps:

   1. Go to Roles > Admin roles. Or to go directly to the Admin roles page, use https://admin.exchange.microsoft.com/#/adminRoles.

   2. On the Admin roles page, select a role group from the list by clicking anywhere in the row other than the round check box that appears next to the name.

   3. In the details flyout that opens, select the Assigned tab, and then look for the user account. If the role group contains the user account, do the following steps:

      1. Select the user account by selecting the round check box that appears next to the name.
      2. Select the Delete action that appears, select Yes, remove in the warning dialog, and then select Close at the top of the flyout.

   4. Repeat the previous steps for each role group in the list.

Step 7 Optional: Additional precautionary steps

1. Verify the contents of the Sent items folder of the account in Outlook or Outlook on the web.

   You might need to inform the user's contacts that the account was compromised. For example, the attacker might have sent messages asking contacts for money, or the attacker might have sent a virus to hijack their computers.

2. Other services that use this account as an alternative email address might also be compromised. After you do the steps in this article for the account in this Microsoft 365 organization, do the corresponding steps in the other services.

3. Verify the contact information (for example, telephone numbers and addresses) of the account.

See also

• Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Microsoft 365
• Detect and Remediate Illicit Consent Grants
• Internet Crime Complaint Center
• Securities and Exchange Commission - "Phishing" Fraud
• Use the Report Message add-in to report spam email directly to Microsoft and/or admins (depending on how User reported settings are configured).