Confirm scope without trusting the mailbox
Begin from a known-clean administrative device and protected account. Record the report, affected identity, observed time and business impact. Review sign-in, risk, audit and message evidence according to available licensing and retention, while recognising that records may arrive with delay.
Check recent authentication methods, password changes, registered devices, role assignments, delegated access, inbox rules, forwarding and application consent. Search for related identities and messages. Preserve relevant evidence before removing artefacts so the investigation can explain what changed.
Contain identity and persistence
Revoke active sessions, reset credentials through a trusted process and remove unauthorised authentication methods. Disable or restrict the identity when consequence justifies it. For privileged accounts, review role activation, emergency access and changes to security policy.
Remove malicious inbox rules, forwarding, delegated permissions and application grants. Rotate exposed application secrets where required. Coordinate mail, identity and endpoint actions because a compromised device or token may recreate access after a password reset.
Protect business decisions and recover
If payment, payroll or supplier information may have changed, contact responsible teams and financial institutions through verified channels. Identify messages sent from the account and prepare factual communication for affected recipients. Legal and notification decisions require qualified advice.
Restore access only after authentication, device and persistence checks are complete. Increase monitoring and record residual uncertainty. Review why the activity was possible, which evidence was missing and how reporting, conditional access or application governance should change.
What to do next.
- ✓Use a clean administrative device and account.
- ✓Preserve sign-in, audit and mailbox evidence.
- ✓Review methods, sessions, roles, rules and consent.
- ✓Revoke access and remove persistence together.
- ✓Verify financial changes through an independent channel.
- ✓Monitor recovery and correct the enabling weakness.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.