How to Check if Your Microsoft 365 Account Has Been Compromised and What to Do Next

Summary

This guide helps you troubleshoot and resolve: How to Check if Your Microsoft 365 Account Has Been Compromised and What to Do Next. Follow the steps below to fix the issue.

Common Causes

Microsoft 365 accounts are a primary target for cybercriminals targeting Australian small businesses. Because these accounts often provide access to email, OneDrive, SharePoint, and Teams, a single compromised account can lead to data theft, fraudulent invoices, and widespread business disruption. If you suspect your account has been breached, acting quickly is essential to minimise damage and secure your organisation's data.

Signs Your Account May Be Compromised

Review the following indicators to determine if your Microsoft 365 account has been accessed by an unauthorised user:

• You cannot sign in because your password has been changed without your knowledge.
• Sent emails appear in your Sent Items folder that you did not write.
• Colleagues or clients report receiving strange emails or phishing links from your address.
• Unfamiliar login locations or devices appear in your recent sign-in activity.
• Email forwarding rules have been created to send copies of your mail to an external address.
• Files in OneDrive or SharePoint have been moved, renamed, or deleted.

Quick Fix Steps

1. Immediately change your Microsoft 365 password using a different, trusted device.
2. Sign out of all active sessions across all devices.
3. Check and remove any unauthorised email forwarding rules.
4. Enable Multi-Factor Authentication (MFA) if it is not already active.
5. Notify your IT support provider or Open a Ticket so we can assist with a full security audit.

Detailed Instructions

1. Change Your Password

1. Go to account.microsoft.com and sign in.
2. Select Security from the top navigation menu.
3. Under the Password security tile, select Change my password.
4. Enter your current password (if known) and create a new, strong password. Avoid reusing passwords from other services.
5. Select Save.

2. Sign Out of All Sessions

1. While signed into account.microsoft.com, select Devices.
2. Review the list of devices currently signed into your account.
3. Select Sign out everywhere or remove any unfamiliar devices from the list.

3. Check Email Forwarding Rules

1. Open Outlook on the web at outlook.office.com.
2. Select the Settings (gear icon) in the top right corner.
3. Navigate to Mail > Rules.
4. Look for any rules that forward emails to an external address you do not recognise.
5. Select the rule and click the Delete icon.

4. Enable Multi-Factor Authentication (MFA)

1. Go to account.microsoft.com and sign in.
2. Select Security > Advanced security options.
3. Under Additional security, find Two-step verification.
4. Select Turn on and follow the prompts to set up the Microsoft Authenticator app or a phone number.

5. Review Recent Sign-In Activity

1. Go to account.microsoft.com > Security.
2. Select Review recent activity.
3. Check the list of sign-ins for unfamiliar locations, IP addresses, or devices.
4. If you see a sign-in you do not recognise, select This wasn't me to trigger a security review.

Next Steps for Your Organisation

If one account has been compromised, there is a risk that other accounts in your organisation may also be vulnerable. We recommend the following actions:

• Alert all staff to be vigilant for phishing emails appearing to come from the compromised account.
• Review shared folders in OneDrive and SharePoint for any unauthorised access or data exfiltration.
• Ensure all users have MFA enabled across the organisation.
• If you use Windows devices and need to update your local login credentials, refer to our guide on Password reset (Windows login).
• Contact 220 Internet Services via Open a Ticket for a professional security assessment.

Still Having Issues?