How to Tell If Your Microsoft 365 Account Has Been Compromised
M365 breaches often go undetected for weeks. Attackers set up quiet email forwarding rules, register OAuth apps, and slowly exfiltrate data while everything looks normal. Here's where to look and what to check right now.
Why M365 compromises are easy to miss
Unlike a ransomware attack that announces itself, most M365 account compromises are designed to be invisible. The attacker's goal is usually Business Email Compromise (BEC) — sitting in a mailbox and watching for invoices, payment requests, or sensitive conversations to exploit. They don't lock you out because that would end the access.
The most common attack paths are: password spray against accounts without MFA, phishing for session tokens (bypasses MFA entirely), and OAuth consent grant attacks where a malicious app gets read access to email and files.
7 signs your M365 tenant has been compromised
Email forwarding rules you didn't create
This is the most common indicator. Attackers create inbox rules that silently forward copies of all incoming mail — especially anything matching keywords like "invoice", "payment", "wire transfer" — to an external address. Check: Exchange Admin Center → Mail flow → Rules and individually check each compromised user's Outlook rules.
Sign-ins from unexpected locations or IPs
Go to Entra ID (Azure AD) → Sign-in logs. Filter by the user in question and look for sign-ins from countries you don't operate in, unusual ISPs, or sign-ins via legacy auth protocols (IMAP, POP3, SMTP AUTH). A single successful sign-in from an unusual country after a failed MFA prompt is a major red flag.
OAuth apps with broad permissions
Consent grant attacks are underreported. An attacker sends a link that grants a malicious app read access to mail, contacts, and files — and the user approves it thinking it's a legitimate tool. Check: Entra ID → Enterprise Applications → All applications. Look for apps with Mail.Read, Files.Read.All, or Contacts.Read permissions that were consented to recently.
New or changed MFA methods
Once attackers have temporary access (e.g. via session token theft), they often add a new authentication method — a different phone number or authenticator app — to maintain persistent access even after a password reset. Check: Entra ID → Users → Authentication methods for any recently added phone numbers or authenticator registrations.
Sent items you don't recognise
If the attacker is running a BEC campaign from the account, they'll be sending emails. They often delete these from Sent Items immediately, but check anyway. Also check Deleted Items and Recoverable Items — messages deleted by inbox rules often land in Recoverable Items for 14 days before permanent deletion.
Unusual admin role assignments
A compromised admin account may be used to elevate another account to Global Admin before it gets detected and locked. Check: Entra ID → Roles and administrators → Global Administrator and compare the list to what you expect. Also check M365 Admin Center → Audit log for recent role assignment events.
Unified Audit Log events for mass download
Attackers often exfiltrate data before you notice. In M365 Compliance Center → Audit, search for FileDownloaded, FileCopied, and MailItemsAccessed events for the suspected account. Hundreds of file downloads in a short window is a clear indicator of data theft.
Immediate response checklist
- Revoke all active sessions — Entra ID → Users → [User] → Revoke sessions. This invalidates all current tokens.
- Reset the password — Force a new strong password immediately.
- Review and remove MFA methods — Delete any authentication methods you don't recognise.
- Delete suspicious inbox rules — Remove all forwarding rules you didn't create.
- Revoke OAuth app consents — Remove any apps with suspicious permissions.
- Check for new admin accounts — Lock or delete any accounts you don't recognise with elevated roles.
- Preserve audit logs — Export relevant sign-in and audit logs before they age out (default retention is 90 days on most plans).
- Enable legacy auth block — If not already done, create a Conditional Access policy blocking all legacy authentication protocols.
How to prevent this from happening again
The misconfiguration that enabled most of the above — MFA not enforced, legacy auth enabled, no Conditional Access policies — are exactly what Workspace Posture Pro audits automatically every week. You get a prioritised list of what needs fixing before the next incident, not after.
📬 Weekly M365 security digest
Get practical M365 security tips, threat intel, and product updates. No spam — unsubscribe anytime.
Catch these misconfigurations before attackers do
Workspace Posture Pro runs automated weekly audits of your M365 tenant — MFA gaps, legacy auth, stale admins, OAuth apps, forwarding rules — and emails you a prioritised fix list every Monday.
Start Workspace Posture Pro — $19/mo →Early access · rate locked forever · cancel anytime