If your business discovers a Microsoft 365 mailbox compromised, act quickly but methodically. The immediate priorities are to stop unauthorized access, understand what changed, and limit harm to employees, customers, or suppliers. Containment and investigation can happen in parallel, but preserve useful evidence before removing suspicious settings when it is safe to do so.
This checklist is for business owners and administrators. If your team does not manage Microsoft 365 internally, contact your IT provider or a security professional immediately. Microsoft’s guidance for responding to a compromised email account can help administrators coordinate the response.
First ten minutes: contain access
- Confirm the incident and assign a lead. Verify the report through a trusted channel, such as a phone call or in-person confirmation. Don’t use the potentially compromised mailbox to coordinate the response. Identify who will manage containment and record decisions.
- Secure the account. An administrator should reset the user’s password and revoke active sign-in sessions. If the attacker may still be active, temporarily block the account from signing in while access is secured. A password change alone may not end existing sessions.
- Check multifactor authentication methods. Look for unfamiliar or recently added methods, devices, or authentication details. Remove unauthorized entries and confirm the employee can still access the account safely.
- Protect related access. Check whether the same credentials were used for other work accounts, and secure those accounts as appropriate. Consider connected Microsoft 365 services, such as file storage and collaboration tools, rather than treating this as an Outlook-only issue.
- Preserve the basics. Note when the incident was discovered, who reported it, and any relevant messages or alerts. Save screenshots or records of suspicious changes before removing them if doing so won’t delay urgent containment.
If there is an immediate risk of continued access or fraudulent messages, prioritize stopping that activity. An administrator can document the relevant details as soon as it is practical.
Next twenty minutes: inspect mailbox changes
After access is secured, review the mailbox for settings an intruder may have added or altered. Record suspicious items before changing them, including their names, destinations, and when they appear to have been created or modified.
- Forwarding: Check mailbox forwarding settings for an unfamiliar external address or other unexpected destination.
- Inbox rules: Look for unusual rules that automatically forward, redirect, delete, mark as read, or move messages. Hidden or unfamiliar rules can make it harder for the employee to notice replies or security alerts.
- Sent and deleted items: Review sent messages, drafts, and deleted items for unexpected activity. Check for messages that may have been removed to conceal the intrusion.
- Sign-in activity: Review available sign-in records for activity the employee cannot explain, such as unfamiliar devices, locations, or access patterns. Treat these as leads to investigate, not as proof on their own.
- Applications and permissions: Check for unfamiliar app consent or connected applications that may have access to mailbox data. Remove unauthorized access through the appropriate administrative process.
Once suspicious forwarding or rules have been documented, remove them and confirm the mailbox no longer redirects messages. For more context on managing a Microsoft 365 environment, see Zevonix’s guide to Microsoft 365 management for Atlanta businesses.
Rest of the first hour: trace activity and limit impact
Next, determine what the account did while access may have been compromised. Review the Microsoft 365 audit records available to your organization, along with sign-in information and message activity. Microsoft explains how administrators can search the audit log for common investigation scenarios.
Look for changes to mailbox settings, unusual sign-ins, messages sent or deleted, and activity involving connected services. Check whether suspicious messages went to employees, customers, suppliers, or other contacts. If you can identify recipients, keep a record of who received what and when. Do not assume that a message was harmless simply because it was deleted from the sender’s mailbox.
If someone received a suspicious message, contact them using a separate, trusted channel. Explain that the message may not be legitimate, and ask them not to open links, attachments, or payment instructions in it. If the message requested a payment or change to financial details, use an independently verified contact method to confirm before taking action.
Some mailbox compromises are part of a broader attempt to access business files or systems. Consider whether the account had access to other Microsoft 365 services, shared mailboxes, or business applications, and investigate those access paths as well. Zevonix’s overview of cybersecurity risk assessment for Atlanta businesses offers related guidance on looking beyond a single system.
Decide who to notify
There are two separate questions: who needs an operational warning, and whether the incident triggers a legal notification duty. People who received a suspicious message may need a prompt warning so they can avoid acting on it. That practical step is different from a formal breach notification.
Whether personal or sensitive information was accessed, what information was involved, and which requirements apply can affect notification decisions. For an Atlanta-area business, involve qualified legal counsel to assess the facts and any applicable obligations. Georgia’s consumer guidance discusses notification following a data breach, but it is not a substitute for advice about your specific incident.
If you don’t have an in-house administrator
Contact your managed IT provider or a qualified Microsoft 365 security professional right away. Share the affected account, when the compromise was discovered, what suspicious messages or changes you observed, and what containment steps have already been taken. Ask them to secure sessions and authentication, inspect mailbox rules and forwarding, review available logs, and assess connected services.
Avoid experimenting with unfamiliar settings while the investigation is underway. Keep a simple incident timeline, preserve suspicious messages and records, and coordinate any employee or customer communications through a trusted channel. Zevonix provides managed IT services and support, including remote and onsite support for businesses in the Atlanta metro area.
Frequently asked questions
Is changing the password enough?
Not necessarily. Have an administrator revoke active sessions and inspect multifactor authentication methods, forwarding, inbox rules, app access, and sign-in activity. These steps help check for access that a password change alone may not address.
Should I notify people who received suspicious messages?
Usually, warn identifiable recipients promptly through a separate trusted channel so they can avoid interacting with the message. Separately assess whether the incident requires formal breach notification with qualified legal counsel.
What if we have no Microsoft 365 administrator?
Escalate immediately to your managed IT provider or a qualified security professional. Share the facts you have gathered, and ask them to lead account containment and investigation.
Take the next step
A calm, documented response can help contain the incident and reveal what needs attention next. If your Atlanta business needs help securing Microsoft 365 access or investigating a mailbox compromise, contact Zevonix to discuss support.