A customer calls about an invoice your employee never sent. Messages are disappearing, an unfamiliar forwarding address appears, or a user receives unexpected authentication prompts. These are reasons to investigate a possible Microsoft 365 account compromise.
Business Communication Solutions helps Austin-area businesses with Microsoft 365 administration, email security, and account-response support. If you suspect an incident, call 512-257-1433 from a trusted device to discuss available assistance. Use a separate, trusted communication channel if the mailbox may be exposed.
Watch: Hacked Microsoft 365 Mailbox? Admin Response Steps
This BCS video introduces the topic. The administrator checklist below accompanies it with links to Microsoft’s response guidance.
What should a business owner do first?
Contact your IT administrator through a known phone number. Describe what happened, when you noticed it, and whether a payment or sensitive document was involved. Keep relevant messages and screenshots. Avoid deleting the account or wiping a device before the response team considers evidence preservation.
If an invoice or bank-account change is involved, verify it through an established contact method. Promptly contact your bank if a fraudulent payment may have occurred. Coordinate other incident communications through your response plan.
Administrator response checklist
The appropriate actions depend on the account, identity architecture, and evidence. An authorized administrator should coordinate containment with the business and keep a record of findings and changes.
1. Contain the affected identity
Microsoft recommends disabling the affected account during investigation. Reset credentials through the correct identity source, revoke sign-in sessions, and review registered authentication methods, app consent, and administrative roles for unauthorized changes. Cloud-only, synchronized, and federated identities need different handling. See Microsoft’s compromised-account response guide.
2. Verify that access is actually restricted
Revoking sessions is an important containment action, but it does not guarantee that every application session stops immediately. Token behavior and application-controlled sessions can affect the result. Check relevant applications and devices, and verify containment instead of assuming that a successful button click ended every connection. Microsoft’s access-revocation guidance explains these limits.
3. Inspect mailbox rules and forwarding
Check forwarding settings and inbox rules, including hidden rules where appropriate. Attackers can use rules to redirect messages or conceal replies. Preserve relevant findings before removing malicious configurations, and investigate affected endpoints when evidence warrants it. Refer to Microsoft’s Outlook rules attack guidance.
4. Investigate scope and business impact
Review available sign-in records, audit events, sent messages, and message traces around the suspected incident. Check other services accessible to the identity, including SharePoint and OneDrive, rather than treating the mailbox as an isolated system. Record what the available evidence supports and where visibility is limited. Log availability and retention depend on licensing and configuration.
5. Restore access with a follow-up plan
Restore normal use after the response team has addressed identified access paths and reviewed the evidence. Continue monitoring, document remaining actions, and involve the appropriate business stakeholders. Microsoft’s business email compromise playbook provides a broader investigation framework.
Why changing the password is only part of the job
A password reset is one action in an investigation. Unrecognized authentication methods, app permissions, or mailbox rules require their own review. BCS connects identity administration, mailbox configuration, device checks, and recovery planning so the business can understand what was changed and what still needs attention.
Reduce the chance of another incident
After containment, review MFA coverage, administrative privileges, email protection, file sharing, and employee reporting procedures. Choose improvements for your actual environment and licenses. Microsoft Secure Score can help organize recommendations; it is not proof that an incident is resolved.
Plan follow-up improvements with our Microsoft 365 security and hardening services in Austin, including Secure Score reviews and configuration checks.
Explore our Microsoft 365 support in Austin, Intune device-management support, Purview data-protection support, and cybersecurity services.
Microsoft 365 account-response help in Austin and surrounding communities
BCS supports businesses in Austin, Cedar Park, Round Rock, Georgetown, Leander, and surrounding communities. We can work alongside your internal IT administrator or discuss ongoing managed support.
Need help with a suspected compromised mailbox? Call 512-257-1433 or contact BCS to discuss the situation and available support. For a suspected active incident, use a trusted phone or separate channel rather than the affected mailbox.
Frequently asked questions
Does a strange email mean my account was hacked?
No. Spoofing, lookalike domains, and account compromise can produce similar complaints. Investigate the evidence before concluding that someone accessed the mailbox.
Should I delete the affected Microsoft 365 account?
Account deletion is not the starting point in Microsoft’s response workflow. Contain access and coordinate evidence preservation with an authorized administrator.
Can an attacker affect SharePoint or OneDrive too?
Yes. Review the services and permissions associated with the affected identity. The extent of access must be investigated.
Do you help businesses that already have an IT administrator?
Yes. BCS can work with your internal team on Microsoft 365 administration and security support, with responsibilities agreed before work begins.
Technical guidance reviewed November 13, 2026. Administrative procedures, portal interfaces, and licensing can change; use the linked Microsoft documentation for current instructions.