The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If you suspect an Exchange mailbox was accessed without permission, treat it as an identity incident: contain access, preserve evidence, remove unauthorized changes, and investigate related accounts and activity before restoring normal use. This guide focuses on Microsoft 365 cloud mailboxes, including Exchange Online and Microsoft Entra ID. On-premises Exchange or hybrid identity environments also need the corresponding local Exchange and identity controls.
What signs should you investigate?
Unusual mailbox or account changes are warning signs, not proof of compromise on their own. Record what prompted the concern, the affected account, when the activity was first noticed, and any relevant user actions, such as clicking a link or entering credentials.
As an Amazon Associate I earn from qualifying purchases.
- Messages are missing, deleted, or unexpectedly moved; Sent Items or Deleted Items contain unfamiliar activity.
- Mail is being forwarded to an unfamiliar external address, or a rule forwards messages or moves them to a less-visible folder.
- The user experiences unexplained lockouts or frequent password changes.
- The contact directory, signature, or other account settings have changed unexpectedly.
Look for a pattern and timeline rather than treating any single symptom as confirmation. Microsoft lists these kinds of indicators in its compromised Microsoft 365 email account guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
How should you contain access?
- Disable the cloud account during the investigation if feasible. Microsoft says, “Disabling the compromised account is preferred and highly recommended until you complete the investigation.” If disabling is not practical, reset the password through the identity system that is authoritative for the account.
- Use the right password-reset path. For an account synchronized from Active Directory or using federated identity, follow the organization’s on-premises identity process; do not assume the cloud password is authoritative. Do not send a replacement password to the mailbox that may be exposed.
- Revoke active sign-in sessions and refresh tokens. A password reset and session revocation are separate actions. Use administrator-approved Microsoft Graph permissions and procedures.
- Review app passwords. Microsoft notes that resetting a password does not automatically revoke app passwords. Review them and replace or remove them as appropriate.
These containment steps follow Microsoft’s account response guidance. If you are not the administrator, contact your organization’s IT or security team promptly rather than attempting administrator actions yourself.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do you remove mailbox and account persistence?
After containment, check for changes that could preserve access or continue diverting information. Confirm each item is unauthorized before removing it; a forwarding address, rule, application, or role may be legitimate in some environments.
Inspect forwarding and all inbox rules
In Exchange Online, inspect mailbox-level forwarding as well as inbox rules. Microsoft’s examples use Get-Mailbox to review forwarding properties and Get-InboxRule -IncludeHidden to enumerate hidden rules. Check the forwarding address and the DeliverToMailboxAndForward setting: the latter indicates whether forwarded messages are also kept in the mailbox. A redirect rule may send messages elsewhere without retaining them in the mailbox. Verify the destination and purpose before removing a setting or rule. See Microsoft’s Exchange mailbox investigation guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review identity methods, applications, and roles
- Review registered MFA devices and methods; remove any that the user does not recognize.
- Review applications the user consented to and remove unauthorized consent.
- Inspect administrative role assignments for unexpected changes.
These checks matter because mailbox rules are only one possible way to maintain access or collect information. Microsoft’s response guidance covers these identity and application reviews alongside session revocation.
Use audit records to confirm changes
Microsoft Purview audit records can help establish who configured forwarding or created inbox rules. Audit searches can also help identify deleted-message actions. Whether deleted items can be recovered depends on the mailbox’s applicable deleted-item retention period or hold. Consult Microsoft’s Purview audit troubleshooting guidance when interpreting these records.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do you establish the timeline and scope?
Build a time-ordered account of what happened, beginning shortly before the suspected activity and continuing through containment and cleanup. Avoid making the initial audit search so narrow that it excludes earlier setup or later follow-on activity.
| Evidence source | What it can help answer | What to review |
|---|---|---|
| Microsoft Entra sign-in logs | When and from where sign-ins occurred, and whether they succeeded | Time, IP address, location, and sign-in result |
| Purview audit records | What changes were made and, where recorded, who made them | Forwarding configuration, inbox-rule creation, and deleted-message actions |
| Exchange message trace and mailbox Sent Items | Whether messages were sent, delivered, or otherwise involved in the suspected activity | Activity around the suspected time, correlated with sign-in and audit events |
The sources answer different questions and should be correlated rather than treated as competing ways to investigate. Microsoft’s account response guidance describes reviewing sign-ins, audit activity, message trace, and Sent Items. Its phishing response playbook says Entra sign-in and audit log retention is limited to 30 or 90 days depending on licensing, and recommends exporting logs for longer analysis.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Look beyond the mailbox when the evidence warrants it
Check for suspicious sign-ins, password-spray or brute-force attempts, OAuth consent grants, token abuse, unusual activity in other mailboxes or collaboration services, and possible data exfiltration. Look for related accounts and other persistence, such as forwarding rules or delegation. If a phishing attachment was opened, determine whether malware ran on the endpoint. Microsoft’s phishing and password-spray response playbooks provide investigation guidance for these broader patterns. Escalate to the organization’s incident-response lead if evidence indicates wider access, sensitive data exposure, or involvement of an administrative account.
Recommended Free Tools
When is it safe to restore normal access?
Restore the account only after investigation and remediation are complete. If you disabled the account, reset its credentials before re-enabling it. If the user was restricted from sending after spam or high-volume mail, Microsoft directs administrators to remove the user from Restricted entities after investigating and resolving the cause; do not treat that change as a substitute for cleanup.
As post-incident hardening, enforce MFA and assess whether a phishing-resistant method is appropriate for the account’s risk and organizational policy. Microsoft provides administrator guidance on recovering a compromised account and on phishing response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
