Account Security Problems

How to Secure a Compromised Microsoft 365 Account After Unauthorized Access

Huma Ashraf Ch Oct 12, 2026 869 views

Question details

The user needs to regain control and secure a Microsoft 365 or Outlook account that has experienced unauthorized access.

How to Secure a Compromised Microsoft 365 Account After Unauthorized Access

Product: Microsoft 365 / Outlook
Device & OS: not provided
Scenario: A malicious actor has breached the account, potentially bypassing standard authentication and exposing sensitive customer information.
Observed behavior: Unauthorized access to the account, suspicious mailbox activity, and potential data exposure.

Before you start

Ensure you are using a secure, uncompromised device to perform the recovery steps. Disconnect any potentially infected devices from your network before logging into your Microsoft 365 account.

Solution 1Recommended

Change Credentials and Secure Your Account

Take immediate action to lock out the attacker by resetting your password, revoking active sessions, and enabling Multi-Factor Authentication (MFA).

The first step in recovering a compromised account is to sever the attacker's access completely. This requires a coordinated approach of resetting credentials and clearing active login tokens.

Reset your password

Navigate to the Microsoft 365 sign-in page and select 'Forgot my password', or contact your IT administrator to initiate a secure password reset. Ensure the new password is long, complex, and unique.

Revoke active sessions

If you have administrative access, go to the Microsoft 365 admin center, locate the compromised user under 'Active users', and click 'Sign out of all sessions'. This forces all devices to re-authenticate.

Enable Multi-Factor Authentication (MFA)

Go to your account's security settings and enable MFA. Set up an authenticator app or SMS verification to require a secondary form of identification for future logins.

Review mailbox rules

Open Outlook, go to Settings > Mail > Rules, and check for any suspicious forwarding rules created by the attacker to intercept your emails. Delete any unrecognized rules immediately.

Change Credentials and Secure Your Account

Admin Assistance: If you are part of a corporate environment, notify your IT or security team immediately so they can investigate the breach across the broader organization and monitor logs.

Solution 2

Run a Security Assessment on Your Devices

Run a comprehensive scan on your local devices to ensure no malware, keyloggers, or vulnerabilities contributed to the breach.

Free Microsoft Office alternative

Try WPS Office for Secure and Lightweight Document Management

If you are reassessing your software ecosystem after a security incident, consider WPS Office as a free, lightweight, and user-friendly alternative to Microsoft Office. It offers secure local saving options, seamless format compatibility, and operates smoothly across multiple platforms without complex cloud dependencies.

1. Download WPS Office: Visit the official WPS Office website and click the free download button for your operating system.
2. Install the software: Run the downloaded installer and follow the simple on-screen instructions to set up the suite.
3. Open existing documents: Launch WPS Office and seamlessly open your existing DOCX, XLSX, and PPTX files with zero formatting loss.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight software that consumes minimal system resources.Built-in document encryption and secure local saving options for sensitive data.Free to download and use with a familiar, intuitive interface.

microsoft office alternative - wps office

Frequently Asked Questions

How can I tell if my Microsoft 365 account has been compromised?

Common signs include missing or deleted emails, unrecognized sent messages, unexpected password reset notifications, new inbox rules you did not create, or alerts from your IT administrator regarding unusual sign-in locations.

Will simply changing my password log out the attacker?

Changing your password prevents new logins, but an attacker may still have an active session token. You or your IT admin must explicitly select 'Sign out of all sessions' in the Microsoft 365 admin portal to terminate active access.

What should I do if the attacker deleted my emails?

First, check the 'Deleted Items' and 'Recoverable Items' folders in Outlook to restore them. If they have been purged, your IT administrator can use eDiscovery in the Microsoft Purview compliance portal to recover the emails if they are within the organization's retention period.

Microsoft Office Security Issues