You get a call from a customer: “Did you just send me an invoice with new banking details?” You didn’t. Someone else did — from your Microsoft 365 mailbox. This is one of the most common incidents we see at small businesses, and what you do in the first hour matters.

Here is a practical checklist, based on Microsoft’s own guidance for responding to a compromised account.

Signs a Microsoft 365 account has been compromised

  • Customers or suppliers receive emails you didn’t send — often invoices, payment changes or “shared document” links
  • New inbox rules you didn’t create, especially ones that forward mail outside the company or move messages to Archive, RSS or Junk folders
  • Emails missing from your inbox, or unfamiliar messages in Sent Items or Deleted Items
  • Microsoft blocks the mailbox from sending email
  • Unexpected password-reset or multi-factor authentication (MFA) prompts, or you are suddenly locked out

Step 1: Lock the attacker out

An administrator should do this immediately, in this order:

  1. Reset the password to a strong, new one — or temporarily block sign-in to the account while you investigate. Do not send the new password by email.
  2. Sign the user out of all sessions. In the Microsoft 365 admin centre or Entra admin centre, revoke sessions so any stolen sign-in is ended. A password reset alone does not always kick out an attacker who is already signed in.
  3. Check MFA methods. Attackers often register their own phone or authenticator app. Remove any method the user doesn’t recognise, then make sure MFA is enforced.

Step 2: Find out what they changed

  • Inbox rules and forwarding — delete any rule or forwarding address the user didn’t set up. This is how attackers keep watching your email after you change the password.
  • App consents — remove any unfamiliar applications the user granted access to.
  • Admin roles — make sure the account hasn’t been given extra permissions.
  • Sent Items and sign-in logs — see who was emailed and where the sign-ins came from.

Step 3: Warn the people who may have been targeted

If fraudulent emails went out, contact those customers and suppliers by phone — not by replying to the email thread. Tell them not to act on any payment-change request and to confirm banking details with you directly. If money has already been sent, contact your bank right away.

Step 4: Close the gap so it doesn’t happen again

  • Turn on MFA for every user, not just admins
  • Block automatic forwarding of email to outside addresses unless there is a business reason
  • Turn off legacy sign-in methods that bypass MFA
  • Keep admin accounts separate from everyday email accounts
  • Give staff a simple rule: any change to banking details is confirmed by phone

When to get help

If you are not sure what the attacker accessed, if several accounts are affected, or if money has been lost, bring in someone who handles Microsoft 365 security. A Microsoft 365 security audit after an incident also shows what else might be exposed.

Meet Software Solutions is based in Greater Sudbury and helps businesses across Northern Ontario secure Microsoft 365. If you think an account has been hacked, call 705-988-2825 or book a free technology review.

Source: Microsoft Learn, “Respond to a compromised email account in Microsoft 365”.