Account Security Problems

How to Bulk Delete Unrecognized Users in Microsoft 365 After a Hijacking

Maira Mehtab Oct 20, 2026 868 views

Question details

The user needs to securely remove a large number of unauthorized accounts created in Microsoft 365 and Microsoft Entra ID following an account compromise.

How to Bulk Delete Unrecognized Users in Microsoft 365 After a Hijacking

Product: Microsoft 365
Device & OS: not provided
Scenario: Recovering from an account hijacking incident where unauthorized users were added to the tenant.
Observed behavior: A large volume of unrecognized users exist in the Microsoft Entra ID directory, posing an ongoing security risk to the tenant.

Before you start

Before making any bulk deletions, immediately reset compromised administrator credentials, revoke active sessions, enforce multifactor authentication (MFA), and export audit logs for evidence.

Solution 1Recommended

Remove Unauthorized Users via Microsoft Entra Admin Center

Manually select and delete unrecognized accounts using the web interface, ideal for a manageable number of rogue accounts.

This method is straightforward but requires careful manual review to ensure legitimate users, guests, and service accounts are preserved.

Access Microsoft Entra

Navigate to the Users list

Go to 'Identity' > 'Users' > 'All users' in the left-hand navigation menu.

Select unauthorized accounts

Review the list carefully and check the boxes next to the unrecognized users created during the hijacking.

Delete the accounts

Click the 'Delete' button at the top of the page and confirm the action to move them to the Deleted users container.

Remove Unauthorized Users via Microsoft Entra Admin Center

Protect Admin Accounts: Ensure you explicitly exclude your own administrator account and emergency access accounts from any bulk selection.

Solution 2

Bulk Delete Users Using Microsoft Graph PowerShell

Use a PowerShell script to filter and delete hundreds or thousands of unauthorized users efficiently.

Free Microsoft Office alternative

Experience a Secure and Lightweight Office Suite with WPS Office

While Microsoft 365 requires complex tenant administration and robust security management against hijacking, WPS Office offers a straightforward, powerful, and locally secure alternative for your daily document needs. Enjoy seamless file compatibility without the heavy administrative overhead.

1. Download the installer: Visit the WPS Office website and download the free version for your operating system.
2. Install the application: Run the installer and follow the simple on-screen instructions to complete the setup.
3. Open your files: Launch WPS Office and instantly open your existing Microsoft Word, Excel, and PowerPoint files without formatting loss.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Free and lightweight office suite for Windows, Mac, Linux, iOS, and Android.Built-in PDF editing and offline document security features without complex tenant setups.Familiar user interface for a smooth and immediate transition.

microsoft office alternative - wps office

Frequently Asked Questions

What should I do first if my Microsoft 365 tenant is hijacked?

Immediately reset all administrator passwords, revoke active user sessions, enforce multi-factor authentication (MFA), and check audit logs for unauthorized changes before deleting any users.

Can I recover users deleted by mistake in Microsoft Entra ID?

Yes, deleted users are moved to the 'Deleted users' container in Microsoft Entra ID and can be restored within 30 days before they are permanently removed.

When should I contact Microsoft Support for unauthorized users?

Contact Microsoft Support or your incident response team if thousands of accounts were created, the tenant is completely compromised, or if you need forensic assistance before performing irreversible bulk deletions.

Microsoft Office Security Issues