Account Security Problems

How to Secure a Compromised Microsoft 365 or Outlook Account

Adam Davis Oct 9, 2026 869 views

Question details

The user needs to recover and secure a Microsoft 365 or Outlook account that has been compromised and is sending out unauthorized phishing emails.

How to Secure a Compromised Microsoft 365 or Outlook Account

Product: Microsoft 365 / Outlook
Device & OS: not provided
Scenario: The account is sending phishing messages to contacts and is blocked from sending new emails.
Observed behavior: Unauthorized emails are being sent from the account, and outgoing email functionality has been disabled as a security measure.

Before you start

Disconnect your device from the network if you suspect active malware, and run a full antivirus scan before attempting to reset your account credentials.

Solution 1Recommended

Contact Your Organization's IT Administrator (For Business/Education)

If you are using a work or school account, your organization's global administrator must secure the account via the admin center.

End users in business and education environments do not have the necessary permissions to unblock their own accounts if they are restricted due to suspicious activity. An administrator must intervene using the Microsoft 365 Admin Center.

Notify Your IT Administrator

Contact your IT department or global administrator immediately through an alternative, secure communication channel to report the compromised account.

Admin Action: Reset Password

The administrator must log into the Microsoft 365 Admin Center, locate the compromised user under 'Active users', and force a password reset while selecting the option to require a password change on the next sign-in.

Admin Action: Block Sign-in & Remove Rules

The admin should temporarily block the user's sign-in to terminate existing sessions, then check the Exchange admin center for any hidden inbox rules or email forwarding rules created by the attacker.

Admin Action: Unblock the Account

Once the account is secured, the administrator must navigate to the Microsoft Defender portal, go to 'Review' > 'Restricted users', and unblock the account so the user can send emails again.

Contact Your Organization's IT Administrator (For Business/Education)

Admin Role Required: Only a global administrator or security administrator has the permissions to fully remediate a compromised Microsoft 365 business account.

Solution 2

Use Microsoft Account Recovery (For Personal Accounts)

For personal Outlook.com or Microsoft 365 Family/Personal accounts, use Microsoft's built-in recovery tools to regain access and secure your data.

Free Microsoft Office alternative

Looking for a Secure, Free Alternative to Microsoft Office?

If you are dealing with frequent Microsoft account issues or looking for a lightweight, secure office suite that doesn't rely solely on cloud accounts, try WPS Office. It provides robust offline capabilities, complete format compatibility, and a familiar user interface.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for Windows, Mac, or Linux.
2. Install WPS Office: Run the downloaded installer and follow the on-screen instructions to complete the setup process in minutes.
3. Start Creating Securely: Open WPS Office and start creating, editing, and saving your documents locally or to your preferred secure cloud storage.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Works seamlessly offline without requiring continuous account synchronization.Free and lightweight, consuming fewer system resources while offering powerful features.Includes built-in PDF editing tools and secure local document encryption.

microsoft office alternative - wps office

Frequently Asked Questions

Why is my Outlook account blocked from sending emails?

Microsoft automatically blocks accounts from sending outgoing mail if it detects suspicious activity, such as sending a high volume of phishing or spam emails. This is a security measure designed to protect your contacts and network reputation.

How do I know if my Microsoft 365 account is compromised?

Common signs of a compromised account include missing or deleted emails, unauthorized messages in your Sent Items folder, unknown inbox rules forwarding your emails to outside addresses, and unexpected login alerts from unfamiliar geographic locations.

Can I recover deleted emails after an account compromise?

Yes, if the hacker deleted your emails, you can often recover them by checking the 'Deleted Items' folder. If they were permanently deleted, click 'Recover items deleted from this folder' at the top of the Deleted Items view in Outlook, provided the action is within the server's retention period.

Microsoft Office Security Issues