The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If you suspect a SharePoint compromise, open an incident under your organization’s response process, contain the affected identity and active sessions, and preserve evidence as you investigate. Then establish what was accessed or changed, remove the attacker’s entry and persistence routes, and restore only from a known-good state. A password reset or files reappearing does not, by itself, prove the incident is resolved.
What should you do first?
Follow your organization’s incident-command, legal, privacy, and approval processes. Before disabling an account or rotating credentials, check whether it is a break-glass account, service principal, or sensitive executive identity; containment can disrupt critical operations. Microsoft’s Create a compromised identity incident response SOP template states: “Contain the risk before you complete the full investigation, but apply organization-specific approval logic first.”
As an Amazon Associate I earn from qualifying purchases.
- Open the incident. Record when the suspicion arose, the affected identity or workload, the initial indicators, and the incident owner. Preserve the original alerts and incident IDs.
- Contain access promptly, with approval. Revoke active user sessions and refresh tokens. Reset the user’s password or rotate secrets according to the identity type. If active risk remains, temporarily disable a user when authorized. Block known malicious IP addresses, devices, applications, or tokens where those controls are available.
- Capture evidence while containing. Retain relevant sign-in screenshots or exports, alerts, user statements, timestamps, and the filters used for searches. Record what containment actions were taken and when.
A password change alone is not a complete containment or eradication plan. Investigate other access routes indicated by the evidence, including active tokens, authentication-method changes, devices, applications, and permissions.
How do you establish the access path and timeline?
Review successful Microsoft Entra sign-ins around the suspected start time. Compare the first successful sign-in that appears malicious with the alert time and the account holder’s account of events. Relevant details can include the time, IP address or location, device, application, MFA result, and recent authentication-method changes.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Keep possible causes—such as phishing, password reuse, adversary-in-the-middle activity, token theft, or MFA fatigue—as hypotheses unless evidence supports them. A suspicious sign-in or unusual file event is an investigative lead, not proof on its own.
Preserve the underlying records and user statements in line with your organization’s legal-hold, privacy, and evidence-handling requirements. Microsoft’s guidance identifies examples of evidence to retain, but does not establish a universal chain-of-custody procedure; use your organization’s own process.
How do you investigate suspicious SharePoint file activity?
Use Microsoft Purview audit records to scope the affected user, SharePoint Online activity, and incident timeframe. Look for file access, creation, modification, and deletion, then identify the sites and content involved. Use those findings to determine whether the incident extends to related identities, devices, applications, privileged roles, or other services the compromised identity could reach.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAudit search requires the Audit Logs or View-Only Audit Logs role, according to Microsoft’s audit-search troubleshooting guidance. Select the relevant investigation date range and user; records can include IP and client information. Audit coverage, availability, retention, and permissions depend on tenant settings and licensing, so verify what records are available in the affected tenant rather than assuming every tenant has the same history.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Correlate suspected token use across Entra and SharePoint
If token misuse is suspected, Microsoft documents correlating Entra authentication with SharePoint Online audit activity using the Session ID (SID) and Unique Token Identifier (UTI). Search the relevant timeframe and SharePoint workload, filter for the affected user and identifiers, and export the results for analysis. This can help associate file activity with the session under investigation; it does not, by itself, establish who controlled the token.
What evidence should you preserve?
Keep records that let responders reconstruct what happened and what they did. Preserve original material where possible, and document search criteria and timestamps so another investigator can understand the results.
- Incident IDs, original alerts, and the time the suspicion was reported.
- Relevant Entra sign-in and Purview audit exports or screenshots, including search filters and the timeframe covered.
- User statements and a timeline of confirmed events, clearly distinguishing observations from hypotheses.
- Containment and remediation actions, their timestamps, and the person or team responsible.
Apply your organization’s requirements for legal holds, privacy, and evidence handling. Microsoft’s published workflows do not specify one chain-of-custody procedure for every organization or incident.
How do you remove the attacker’s access before restoring?
Use the evidence to identify and remove the entry point and any persistence route that could allow re-entry. Depending on what the investigation establishes, this may involve compromised credentials, an exposed token, unauthorized authentication changes, a malicious application, or excessive permissions. Microsoft describes eradication as evicting the adversary and mitigating the vulnerability that enabled the intrusion.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Do not treat a password reset, account disablement, or file restoration as proof that eradication is complete. Before restoring, confirm that the known vulnerable paths have been addressed. If the evidence points to additional identities, applications, devices, or privileges, include them in the investigation and response.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which SharePoint recovery route fits the incident?
Choose a recovery route only after establishing what happened to the content, how long ago it occurred, and whether the proposed restore point is known-good. The options below reflect Microsoft’s published SharePoint deletion and restore guidance; actual availability depends on the affected content and tenant circumstances.
| Content state or problem | Potential route | What to know |
|---|---|---|
| Item remains in the site Recycle Bin | Restore the item from the Recycle Bin. | Microsoft’s 2026 data-deletion documentation says an item remains in the site Recycle Bin for 93 days after deletion from its original location, unless it is removed from that bin or the bin is emptied. |
| Item has moved to the second-stage/site-collection Recycle Bin | Check whether the item can be restored from the second-stage bin. | Microsoft says items can remain there for the remainder of the retention period. Purging an item from the second-stage bin permanently removes it according to Microsoft’s guidance. |
| Content is hard-deleted, corrupted, or malware-infected and cannot be recovered through other methods | Ask Microsoft support promptly whether a full site-collection or subsite point-in-time restore is available. | Microsoft’s 2026 guidance describes an additional 14-day backup period beyond actual deletion for this support route and says it is unavailable after that period. It is not a guaranteed self-service restore; confirm the case’s eligibility. |
Deletion behavior can vary: some API delete operations may purge content directly rather than route it through the recycle bins. Do not empty recycle bins during an incident unless doing so is an intentional, approved response action.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For any restore, weigh the deletion path and elapsed time against the type of damage, the appropriate recovery scope (item versus site or subsite), confidence in the proposed known-good state, business impact, and evidence-preservation requirements. Verify the content’s actual recoverability in the tenant. Restored files can still contain compromised or malicious content, so inspect the restored state and its access paths before returning it to normal use.
When is recovery complete?
Recovery is not complete just because files reappear. After restoring, inspect the content and permissions, confirm that the entry and persistence routes identified in the investigation are removed, and apply heightened monitoring. Validate that signs of the breach have stopped and continue watching for recurrence across the affected identity, sites, applications, and connected workloads.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
