To contain a suspected Microsoft 365 phishing compromise, first block the affected account if you can, then reset its password in the correct identity system and revoke its sign-in sessions. Next, remove attacker persistence—such as unfamiliar MFA methods, app permissions, mailbox forwarding, and inbox rules—and investigate sign-ins and messages sent during the compromise. Session revocation is important, but it does not guarantee that every existing application connection ends immediately.
1. Block access and reset credentials
Microsoft recommends disabling a compromised account during the investigation when feasible. If you cannot disable it, reset its password. Do not send a replacement password through the potentially compromised mailbox. Reset any app passwords too: a normal password reset does not automatically revoke them.
As an Amazon Associate I earn from qualifying purchases.
Use the password authority for the account
| Identity type | Containment action |
|---|---|
| Cloud-only Entra ID account | Disable the account and reset its password in Entra ID. |
| Synchronized Active Directory account | Disable the on-premises AD account and reset its password in AD twice. Microsoft recommends the second reset to help mitigate pass-the-hash risk, including where password replication may be delayed. |
| Federated account | Change the password in the on-premises identity environment and coordinate with that environment’s administrator. |
Microsoft’s compromised-account guidance, updated July 17, 2026, says disabling the account is preferred and highly recommended until the investigation is complete. If you disabled the user, keep the account disabled while investigating; after recovery work, reset the password and then re-enable it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →2. Revoke the user’s Microsoft 365 sign-in sessions
For a repeatable response, use Microsoft Graph PowerShell. Use the Microsoft Graph Authentication and Users Actions modules, connect with the least-privileged delegated scope shown below, then revoke the sessions for the affected user:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Connect-MgGraph -Scopes User.RevokeSessions.All
Revoke-MgUserSignInSession -UserId [email protected]Replace [email protected] with the affected user’s UPN. The Graph v1.0 REST operation is POST /users/{id | userPrincipalName}/revokeSignInSessions. For work or school accounts, Microsoft lists User.RevokeSessions.All as the least-privileged delegated or application permission. The PowerShell connection example above uses delegated sign-in; application-based automation must be configured with the corresponding application permission.
For a cloud-only account, an administrator can also use the affected user’s Revoke sessions action in the Entra admin center. Microsoft Graph v1.0 documents the operation as invalidating refresh tokens issued to applications and browser session cookies by updating the user’s signInSessionsValidFromDateTime.
Rank #2
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
What session revocation does—and does not—end
- Microsoft says there may be a delay of a few minutes before tokens are revoked.
- Existing access tokens can remain usable until they expire. Microsoft’s Entra emergency guidance gives one hour as the default lifetime for access tokens issued by Microsoft Entra ID; actual access depends on token and application behavior.
- An application that issues and maintains its own session token may require a separate revocation or deprovisioning action. Revoking the Entra session alone does not guarantee immediate sign-out from every application.
- The operation does not revoke sessions for external users, who authenticate through their home tenant. Contact the user’s home-tenant administrator if those sessions are in scope.
3. Remove persistence the attacker may have added
After recording relevant evidence for the investigation, review the account and mailbox for changes that could let an attacker return or continue receiving information.
Check authentication and access
- Inspect registered MFA methods and devices; remove unfamiliar entries.
- Review user-consented applications and revoke any that should not have access.
- Review administrative role assignments and remove unauthorized roles.
Check Exchange Online forwarding and inbox rules
Inspect mailbox forwarding settings and all inbox rules, including hidden rules. Look for unfamiliar SMTP forwarding destinations and rules using RedirectTo, ForwardTo, or ForwardAsAttachmentTo. One Microsoft-documented inspection command is:
Rank #3
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Get-InboxRule -Mailbox <Identity> -IncludeHiddenPreserve the information needed for the investigation before removing suspicious forwarding settings or rules.
4. Investigate the compromise and verify recovery
Review Entra sign-in logs and risk reports for unfamiliar IP addresses, locations, timestamps, and successful or failed sign-ins. Review Defender audit logs starting just before the suspected activity and continuing through remediation. Use the resulting timeline to examine messages sent during the suspicious period, and use Message Trace to verify what was sent.
Rank #4
- SECURITY KEY FOR ENTERPRISE ACCESS: Supports FIDO2 passkeys and U2F for secure authentication across enterprise IT systems.
- PHISHING-RESISTANT AUTHENTICATION: Enables passwordless login with secure on-device credential storage and PIN-based user verification.
- COMPATIBLE WITH ENTERPRISE SYSTEMS: Works with FIDO2, WebAuthn, and U2F across enterprise, cloud, and modern IT environments.
- DRIVERLESS FIDO2 AUTHENTICATION: FIDO2 works natively with modern browsers and platforms. No drivers required.
- USB AND NFC CONNECTIVITY: Supports authentication via USB-C and NFC. No batteries required.
Look for suspicious forwarding rules, missing or deleted mail, unusual sent or deleted items, unexpected password changes or account lockouts, and altered signatures. Each is an investigation signal, not proof of compromise on its own. If Microsoft blocked the mailbox from sending spam, remove the user from Restricted entities only after recovery work is complete.
What to prioritize in a hybrid or third-party environment
Session revocation is a user-level Entra control; it does not replace action in the identity source or in applications that maintain their own sessions. For synchronized identities, contain the on-premises AD account as well as the Entra account. For federated credentials, perform the password change in the on-premises identity environment. For third-party applications with independent sessions, use that application’s own session-revocation or deprovisioning controls.
Best Value
- FIDO2 SECURITY KEY: A versatile, tamper-evident USB-C authentication device with sensitive presence detection for online security. FIDO 2.0 level 1 and U2F certified
- PASSWORDLESS CONVENIENCE: Replace frustrating passwords with a simple 4-digit PIN for accessing apps and sites. Seamlessly login to web apps and Windows sessions
- BROAD COMPATIBILITY: Works with Windows, Mac, Linux, Apple, iOS, iPhone, Android and USB-C devices. Seamlessly integrates with Identity Providers or Credential Management Systems supporting FIDO2, including Thales, Microsoft, AWS, and Google
- ENHANCED USER ADOPTION: Features a sensitive presence detector on the USB key, providing ease of use and superior security. Certified for U2F and FIDO2, ideal for individuals who want to secure access to their personal online accounts - Microsoft, Google, Twitter, Facebook, GitHub
- THALES: We offer a wide range of FIDO authenticators, providing robust, phishing-resistant MFA that comply with stringent regulations. With almost three decades of experience, Thales is a pioneer in passwordless authentication devices, supported globally by the FIDO Alliance and industry analysts
Microsoft’s compromised-account guidance was updated July 17, 2026, and its Entra emergency revocation guidance was updated June 19, 2026. Portal labels and token behavior can change, so use the current tenant interface and Microsoft documentation when carrying out the response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
