Microsoft 365 Credentials Compromised? What Your Business Should Do Next

A login to Microsoft 365 is not just an email account. It is the front door to your business: Outlook, Teams, SharePoint, OneDrive, and often the single sign-on that reaches your other tools. So when you suspect that an employee's Microsoft 365 credentials are compromised, it is not a "change the password and forget it" situation. A Microsoft 365 account in the wrong hands can read every email, reset other services, and quietly send invoices in your name.

This is a plain-English response plan for a business owner or office manager, not a security engineer. It covers what a Microsoft 365 compromise actually means, why a password reset alone does not evict the attacker, and the exact checks to run to lock the account back down.

What does Microsoft 365 credential compromise mean?

It means someone outside your business has a working way into a Microsoft 365 account: usually the username (a work email) and password, and sometimes an active session token that lets them skip the login screen entirely. The credential may have leaked through a phishing page, an infostealer infection on the employee's device, or a reused password exposed in another site's breach. However it happened, the risk is the same: everything that account can see or do is now at risk.

Does changing the Microsoft 365 password log an attacker out?

Not reliably on its own, and this is the single most important thing to understand. Resetting the password may not immediately invalidate an active session or token, depending on how the service and identity provider handle it, so an attacker's existing session can keep working. On top of that, a determined intruder often plants other ways back in (an extra authenticator, a mail-forwarding rule, an app with ongoing access) that a password change does not touch. So resetting the password is necessary but not sufficient: you contain the account, reset the credential, then explicitly revoke active sessions and hunt down any footholds the attacker left behind. (Here is the deeper explanation of why a stolen session can survive a password change.)

The Microsoft 365 compromise response, step by step

If you have admin access, most of these happen in the Microsoft 365 admin center and the Microsoft Entra admin center. If you do not, this is the moment to loop in whoever administers your tenant. Work top to bottom.

1. Block or contain the compromised account

If you believe an account is actively compromised, contain it first. In the Microsoft 365 admin center or Microsoft Entra admin center you can block sign-in for the user, which stops new logins while you investigate. Containment does not have to wait for a full investigation: cut off easy access, then work through the rest.

2. Reset the password

Set a fresh, unique, strong password from a device you trust, not the possibly infected one, and confirm the account's recovery email and phone still belong to the employee. This closes off the leaked credential itself. On its own it is not enough (see the next step), but it is the necessary foundation.

3. Revoke active sessions

Because a password reset may not immediately end a live session, explicitly revoke the user's sessions. In Microsoft Entra this is the "Revoke sessions" action, which invalidates the refresh tokens that keep a session alive, so a stolen session stops working rather than lingering for hours. (More on why this matters.)

4. Review Microsoft Entra sign-in logs

Open the sign-in logs for the account and read the recent history, looking for successful sign-ins your team cannot account for. The logs show the time, the app, the IP address, the location, and whether MFA was satisfied. Pay particular attention to unfamiliar countries and devices: a sign-in from another continent minutes after a legitimate one from your town (so-called impossible travel) is a classic sign of account takeover. This is where "maybe compromised" becomes "yes, someone got in on this date," and it is worth noting for your incident record.

5. Review MFA and authentication methods

Look at the authentication methods registered on the account. Attackers frequently add their own phone number or authenticator app so that even after a password reset they can still pass MFA. Remove any method the employee does not recognize, then have the employee re-register their own. If MFA was not enabled, turn it on now; here is how.

6. Check mailbox forwarding

This is how a quiet mailbox break-in becomes ongoing fraud. Check for mailbox forwarding that silently copies incoming mail to an outside address. Look at both the mailbox-level forwarding setting and any rules that forward. A hidden forward is often the only trace of an attacker who otherwise looks gone.

7. Check inbox rules

Beyond forwarding, attackers create inbox rules that move, mark as read, or delete specific messages (for example, anything mentioning "invoice," "payment," or "wire") so the real employee never notices the fraudulent thread. Review every inbox rule and delete any you cannot explain. This step is central to stopping business email compromise.

8. Review connected applications and OAuth permissions

Modern attacks do not always rely on the password at all. An attacker can trick a user into granting a malicious app ongoing permission to the mailbox, which keeps working even after a password reset. In the Entra admin center, review the apps and OAuth grants connected to the account and revoke anything suspicious or unneeded.

9. Review sent and deleted email

Look through Sent Items and Deleted Items for messages the employee did not send: fake invoices, requests to change bank details, or phishing sent to contacts. Attackers often delete their sent messages to cover their tracks, so check Deleted Items and recoverable items too. This tells you whether the compromise has already reached your clients or vendors, who may need a heads-up.

10. Investigate the endpoint

If the credential leaked because malware harvested it, the device is still the problem and will simply leak the new password too. If you see signs of an infostealer (many of that person's saved logins exposed at once), take the device offline and run a full scan or reimage it, and treat everything saved on it as exposed. Our malware incident response steps walk through this.

11. Document findings and determine notification requirements

Record what you found: the suspicious sign-ins, any rules, MFA methods, or apps you removed, the dates, and what you changed. Then decide whether the incident triggers any notification duties to clients, partners, your cyber-insurer, or a regulator. Microsoft 365 compromises are exactly the kind that get asked about later, and a clear record makes that conversation far easier. Our guide on credential monitoring and compliance covers when this crosses into a reportable event.

12. Continue monitoring

A compromised account is a prime target to be hit again, and the leaked address may resurface in a new breach or infostealer log. Keep watching that mailbox and your domain so the next exposure is caught early. Ongoing dark web monitoring is what closes the loop between cleaning up today and staying safe tomorrow.

Why Microsoft 365 is such a common target

Attackers go where the business runs, and for millions of small businesses that is Microsoft 365. A single mailbox can reveal who pays whom, when invoices go out, and how your team talks about money, everything needed to insert a convincing fake payment request. That is why account takeover so often turns into invoice and wire fraud, and why the forwarding-rule and inbox-rule checks above matter so much. The same exposure on a non-email account would be far less dangerous. On Microsoft 365, it reaches everything.

Frequently asked questions

Should I delete the compromised account instead of cleaning it?

Usually no. Deleting a mailbox can destroy evidence and break shared resources before you have exported what you need. Clean it using the steps above (revoke sessions, remove the attacker's footholds, then reset), and only consider removing the account later, for example if the employee has also left.

How do I tell a real break-in from just a leaked password?

The sign-in logs are the answer. A leaked password that was never used shows no unexplained successful sign-ins and no attacker-made rules or app grants. A real takeover usually leaves at least one of those traces, so if you find any, treat it as a confirmed incident and document it.

Do I need special licensing to run these checks?

It depends on your Microsoft 365 and Microsoft Entra licensing. Basic account-security and administrative actions (resetting a password, revoking sessions, blocking sign-in) are available in many business subscriptions, while advanced auditing, identity protection, and investigation features can require additional licensing, and the specifics change over time. Check Microsoft's current documentation for your subscription before relying on a particular feature (see the sources below).

How GuardPilot helps

Finding out your Microsoft 365 login leaked is the easy part. Catching it early, and being walked through every one of these checks, is the hard part, and it is exactly what alert-only tools do not do. GuardPilot is the AI Incident Response Platform for Credential Exposure. It continuously monitors dark-web markets and infostealer logs for your team's Microsoft 365 and other work credentials, and when GuardPilot detects an exposure, its AI explains what was exposed and how serious it is, then generates a step-by-step recovery plan for that account and reminds you until every step is done. It is guided incident response for a business with no security team, not just another list of leaked emails. Start free and see what is already exposed in about a minute. If a login has already surfaced, start with our wider guide on what to do when an employee's work credentials are exposed.

Sources and further reading

• Microsoft: Responding to a compromised email account.
• Microsoft Entra: Revoke user access (sessions and tokens).
• Microsoft Entra: Sign-in logs.
• Microsoft Entra: Authentication methods.
• Microsoft: Investigate risky OAuth app consents.

The takeaway

A compromised Microsoft 365 account is a whole-business problem, because that one login touches email, files, and often everything else. Resetting the password is not enough on its own: contain the account, reset the credential, revoke active sessions, read the sign-in logs, check for attacker-added MFA methods, forwarding rules, inbox rules, and connected apps, investigate the device, then document and monitor. Work the list and you can evict an intruder and close the door behind them, and with continuous monitoring in place, catch the next exposure before it ever becomes a break-in.