Account Security Problems

How to Secure a Microsoft 365 Tenant from Unauthorized Users

Tauseeq Magsi Oct 23, 2026 868 views

Question details

The user needs to secure their Microsoft 365 tenant after noticing unexpected users, subscriptions, licenses, or billing activities indicative of a compromised admin account.

Product: Microsoft 365
Device & OS: not provided
Scenario: Discovering unauthorized users, subscriptions, or billing activity in a Microsoft 365 environment.
Observed behavior: An administrator account has likely been compromised, leading to unauthorized creation of users and subscriptions.

Before you start

Ensure you have global administrator access to the Microsoft 365 admin center and Microsoft Entra ID to perform security audits and system-wide password resets.

Solution 1Recommended

Immediate Action: Secure Administrator Accounts

Lock down all privileged accounts immediately to prevent attackers from maintaining access or creating further unauthorized changes.

When unexpected subscriptions or users appear, the first priority is to sever the attacker's access by updating authentication credentials for all administrators.

Use a Private Browser Window

Open a private or incognito browsing window to log into the admin center. This prevents attackers from leveraging any authenticated cookies saved in your standard browser session.

Change Administrator Passwords

Log into the Microsoft 365 admin center, navigate to Active Users, and immediately change the passwords for all accounts with global, billing, or user administration rights.

Enable Multifactor Authentication (MFA)

While in the admin center, enforce MFA for every privileged account to ensure a password alone is insufficient for future access.

Immediate Action: Secure Administrator Accounts

Pro Tip: Review your list of administrators and reduce their permissions if multiple accounts possess unnecessary global administrative rights.

Solution 2

Investigate and Remediate Unauthorized Activity

Identify the extent of the breach, remove unauthorized entities, and secure compromised end-user mailboxes.

Free Microsoft Office alternative

Try WPS Office for a Streamlined Office Experience

If managing Microsoft 365 tenant security, user licenses, and cloud subscriptions is becoming overly complex, WPS Office offers a free, lightweight, and user-friendly desktop alternative. Enjoy robust productivity without the hassle of extensive cloud administration.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install and Launch: Run the installer, follow the on-screen prompts, and launch the WPS Office application.
3. Open Your Documents: Simply drag and drop your existing Microsoft Office files into WPS Office to continue working seamlessly.

Fully compatible with Microsoft Word (.docx), Excel (.xlsx), and PowerPoint (.pptx) formats.No complex tenant administration required for individual professionals and small teams.Free to download and use with a highly familiar user interface.Built-in local document encryption to keep your files secure offline.

microsoft office alternative - wps office

Frequently Asked Questions

How can I tell if my Microsoft 365 admin account is compromised?

Signs of a compromised admin account include unexpected new user accounts, unfamiliar subscriptions or licenses in your billing dashboard, unauthorized mail forwarding rules, and sign-ins from unrecognized locations or IP addresses in your Microsoft Entra logs.

Why is it important to use a private browser window when securing accounts?

Using a private or incognito window ensures that you are not using saved authenticated cookies. If an attacker has compromised your current browser session, closing the private window upon completion helps invalidate those session tokens and reduces risk.

What should I look for in the Microsoft Entra audit logs?

You should review the sign-in logs for unexpected locations (such as foreign countries) and IP addresses that occurred right before the unauthorized users or subscriptions were created. This helps pinpoint exactly which account was compromised.

How do I handle unauthorized subscriptions billed to my tenant?

First, cancel the subscriptions immediately via the Billing section in the Microsoft 365 admin center. Then, open a support ticket with Microsoft Support, explain that your tenant was compromised, and request assistance with removing the fraudulent charges.

Microsoft Office Security Issues