First identify which kind of account was compromised. A personal Microsoft account is recovered by its owner through Microsoft’s sign-in helper and account settings. A work or school Microsoft 365 identity belongs to an organization’s tenant, so the IT or security team must contain and investigate it. The consumer recovery process cannot restore or investigate an organization-managed identity.
If you are unsure, look at the address and sign-in page you normally use. An address controlled by an employer, school, or other organization is generally managed by that organization, even if you use Outlook, OneDrive, Teams, or another Microsoft 365 app at home.
As an Amazon Associate I earn from qualifying purchases.
Decide whether this is a personal or work/school account
| Account type | Who controls recovery | Correct first action |
|---|---|---|
| Personal Microsoft account | You, through Microsoft account security settings | Run an up-to-date antivirus full scan, then use Microsoft’s sign-in helper and review account activity |
| Work or school Microsoft 365 account | Your organization’s Microsoft 365 tenant administrators | Contact IT or the security team immediately; do not try to treat it as a consumer account |
Do not send a replacement password to the affected mailbox. If the mailbox is being read by someone else, that message would disclose the new credential.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If your work or school account was compromised
1. Report it through a trusted channel
Call the help desk, use the organization’s incident-reporting portal, or contact a known security administrator through a separate channel. Do not rely on a reply from the compromised mailbox. Tell the team when you first noticed the problem, what you saw, and which services may have been used.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
An ordinary employee should not begin with PowerShell or attempt to change tenant-wide settings. Administrators need to preserve evidence and coordinate containment, password changes, session revocation, and investigation.
2. Let an administrator disable or reset the identity
Microsoft advises administrators to disable the affected user during an investigation when possible. If disabling the user is not possible, the administrator should reset the password. The correct password-reset location depends on how the organization manages identities:
- Synced identity: reset the password in on-premises Active Directory and reset it twice, following the organization’s synchronization process.
- Federated identity: change the password in the on-premises identity environment and notify the organization’s administrator or identity team.
- Cloud-only identity: an authorized tenant administrator can reset it in the Microsoft 365 or Microsoft Entra admin experience.
A password reset does not automatically revoke existing app passwords. Administrators must identify and review app passwords separately and remove any that are not trusted.
3. Revoke active sessions
Resetting a password is not the same as ending every access token or browser session. An administrator should revoke the user’s active sessions so stolen credentials cannot continue to be used. Microsoft’s documented Microsoft Graph PowerShell command is:
Revoke-MgUserSignInSession -UserId <UPN>Replace <UPN> with the user principal name, such as the organization-managed sign-in address. This command requires suitable administrator permissions and should be run by the identity or security team, not by an ordinary employee.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft’s admin-center workflow can reset the password and sign the user out. Microsoft says the user may be prompted to sign in again within an hour or when leaving the current Microsoft 365 page, depending on token and session behavior. Blocking sign-in can take up to 24 hours to take effect, so do not promise that a block is instantaneous or that every session ends at once.
4. Check every authentication method
Review the user’s registered MFA devices and other authentication methods. Look for an unfamiliar phone number, authenticator registration, hardware key, email address, or other method added shortly before the incident. A malicious method can let an intruder regain access after the password is changed.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Microsoft’s authentication-method guidance treats malicious changes as a compromise that should be rebuilt from a trusted state. Remove unauthorized methods, set a new password, and have the user register trusted methods again. Do not simply leave a suspicious method in place because the password has changed.
5. Review applications and administrator roles
Inspect user-consented applications and enterprise application permissions for grants the user did not make. An attacker may use an approved token or consented application even after a password reset. Remove unauthorized consent according to the organization’s change-control process.
Check the user’s assigned administrative roles and role-activation history. An unexpected privileged role or change to an existing assignment is a high-priority finding. Remove unauthorized additions and investigate any actions performed while the role was active.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How administrators should investigate the compromise
Build the investigation window from just before the first suspected compromise through the end of remediation. Do not limit the review to the moment when the user noticed something unusual; attackers may have changed settings earlier and used them later.
Free tools Windows power users keep installed
One-click scans. No signup required.
Review Microsoft Entra sign-in activity
- Compare successful and failed sign-ins for the relevant period.
- Record time, IP address, approximate location, application, device information, and authentication result.
- Look for password changes, MFA changes, unusual lockouts, and other identity modifications.
- Compare the activity with the user’s travel, work schedule, devices, and known network locations.
An unfamiliar location or IP address is a lead, not proof by itself. Mobile networks, corporate gateways, VPNs, and cloud services can make a legitimate sign-in appear to come from an unexpected place. Verify suspicious activity with the user and the organization’s network or security team.
Search Microsoft 365 audit records
Microsoft Purview audit documentation describes the activities captured in the Microsoft 365 audit log and how administrators search them in the Purview portal. Search for events before, during, and after the suspected compromise, including sign-ins, mailbox actions, permission changes, application consent, and administrative changes. Preserve relevant records according to the organization’s retention and incident procedures.
Inspect the mailbox
Review both visible and less-obvious mailbox activity:
- Messages in Sent Items that the user did not write
- Messages in Deleted Items that may show what the attacker read or removed
- New inbox rules, forwarding rules, delegates, or other delivery changes
- Suspicious messages sent to colleagues, customers, or external addresses
- Automatic replies that reveal information or redirect correspondents
Suspicious forwarding, unexplained sent or deleted messages, and unusual lockouts are recognized warning signs. Export or preserve the relevant message headers and audit details before deleting evidence, following the organization’s procedures.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rebuild compromised authentication methods
If an unauthorized MFA method or other authentication method was added, remove it and treat the account as compromised even if no unusual sign-in is visible. After the password is reset, require the user to register trusted methods again from a clean, known environment. Confirm that the attacker’s methods, app passwords, application consents, and sessions are all gone.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If your personal Microsoft account was hacked
1. Scan the computer before changing the password
Microsoft Support recommends running an up-to-date antivirus full scan on the PC before changing the password. The purpose is to reduce the chance that malware or a credential-stealing program immediately captures the replacement password.
2. Use Microsoft’s sign-in helper
Use Microsoft Support’s sign-in helper for a hacked personal account. Follow its recovery prompts and provide the requested verification information. If you can sign in normally, change the password from the account’s security settings; if you cannot, continue through the helper’s recovery flow.
3. Review connected settings after recovery
Once you regain access, inspect connected accounts, email forwarding, and automatic replies. Remove anything you did not configure. Check whether a forwarding address or automatic reply could have exposed future messages or revealed that the account was being monitored.
Recommended Free Tools
4. Use Recent activity as an investigation aid
The Recent activity page can show events such as security-information additions or removals, new app permissions, password changes, unusual activity, and “Sign-in blocked (Account compromised) | We think someone else accessed your Microsoft account.” Treat unfamiliar entries as leads to investigate, not as a substitute for changing credentials and securing the account.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What a password reset does not fix by itself
Whether the account is personal or organization-managed, a password change is only one part of recovery. After the credential change, verify the surrounding access paths:
- Active browser and application sessions have been signed out or revoked.
- App passwords have been reviewed and removed when untrusted.
- MFA and other authentication methods belong only to the legitimate user.
- Connected applications and consent grants are expected.
- Mailbox forwarding, inbox rules, delegates, sent mail, deleted mail, and automatic replies are clean.
- No unauthorized administrative role or privilege remains.
For a work or school account, the organization should record what was changed, when it was changed, and who authorized it. That record helps distinguish the attacker’s activity from the remediation work.
After containment: restore normal access carefully
Confirm the user’s device and identity
Have the user complete the next sign-in from a trusted, updated device and verify the registered MFA method during the process. If the organization uses synchronized or federated identities, confirm that the reset occurred in the authoritative on-premises system and that synchronization or federation is functioning as expected.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Warn contacts when the mailbox sent malicious messages
If the investigation finds messages sent during the compromise, notify affected recipients through a trusted channel and explain which messages should be ignored. Avoid including the new password or sensitive incident details in email.
Consider stronger MFA for future protection
Microsoft Entra recovery documentation lists FIDO2 security keys among available authentication methods. A key is a prevention option, not a containment step, and compatibility depends on the organization’s tenant policy, devices, and enrollment process. Ask the organization’s IT team before purchasing or enrolling one.
When to escalate beyond account recovery
Escalate promptly if the account had access to financial data, regulated information, source code, customer records, administrative systems, or other high-value resources; if an attacker created forwarding or delegated access; or if unauthorized administrative roles or application permissions were assigned. The organization’s security and legal teams should decide whether additional investigation, preservation, customer communication, or regulatory action is required.
The appropriate notification duties depend on the jurisdiction, the organization, the information involved, and the facts established in the investigation. The account-recovery steps above do not determine those legal obligations.
Quick Recap
A compact response checklist
- Identify personal versus work/school account.
- For work or school, contact IT or security through a trusted channel.
- Do not send a new password to the affected mailbox.
- Disable the user when possible; otherwise reset the password using the authoritative identity system.
- Review and revoke sessions, app passwords, MFA methods, application consents, and administrative roles.
- Search Entra sign-in activity and Microsoft 365 audit records from just before the suspected compromise through remediation.
- Inspect sent and deleted mail, forwarding, inbox rules, automatic replies, and suspicious messages.
- For a personal account, scan the PC first, use Microsoft’s sign-in helper, then review Recent activity and connected settings.
- Allow for Microsoft’s documented timing: sign-out prompts may take up to about an hour in some flows, and blocking sign-in can take up to 24 hours.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
