Employee's Microsoft account compromised — what should we do in the first hour?

Send an urgent notice to clients immediately or call them directly. Tell them to disregard any recent emails regarding invoices or bank account changes originating from your systems. If a client issues a wire transfer while you're busy resetting passwords, recovering that financial loss will be far harder than handling the technical fix.

Just clicking the sign-out button might not be enough; check APIs and authorized third-party apps as well. Sometimes they connect external app permissions to the account, allowing them to keep reading mail via bearer tokens even after the session is closed. Definitely scan the enterprise applications and permissions list in the portal.

Stay calm and do not delete any records. Panicking administrators sometimes purge the entire inbox or delete the user account; however, under German data protection regulations and local cyber incident notification mandates, you will need those log records. Download the audit logs immediately as forensic evidence.

happened to us last year too. tbh definitely dont skip the rules part they were auto-forwarding and deleting any mail containing the word invoice took us two weeks to realize unfortunately.

Once the incident is contained, I recommend contacting your data protection officer. If it is determined that third-party personal data or trade secrets were exfiltrated, you may be required to formally notify the competent supervisory authority and affected clients within statutory deadlines.

The real issue to question is why the firm you pay 800 Euro a month to is unreachable during an emergency. Isn't there an SLA response time clause in your contract? Once this crisis passes, review that agreement, because support that doesn't answer within the first hour provides zero security assurance.

Let me summarize what needs to be done right now in order: 1) Terminate the user's sessions from the global admin panel. 2) Delete mailbox forwarding rules. 3) Update the password and multi-factor authentication methods. 4) Back up the sign-in logs for that user over the past 48 hours. 5) Brief the finance and operations teams regarding the fraudulent bank detail emails.

In short, on the tech side, revoking active sessions, resetting passwords, clearing authentication devices, and wiping forwarding rules are absolute musts. On the administrative side, you need to warn clients over the phone and back up and store system logs in case of a potential data breach risk. You can deal with your IT support provider regarding contract terms later.

Saved. When you try to change everything at once, nothing settles.

I have a question. btw payment information changes are never verified through the channel they came from.

Im also curious if anyone does it differently.

Noted, thanks.

How did you solve this? Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Forgotten test environments are more often the entry point than live systems. Hope this helps.

I'd appreciate it if you shared the outcome. The answer varies greatly by industry; there is no one-size-fits-all rule.

Of course it varies if your situation is different.

Correct in theory, but it doesn't work that way in practice. Start with a small trial; don't commit to everything at once.

Payment information changes are never verified through the channel they came from. Just leaving this note, it might be useful.

Three different views emerged, they all complement each other. Payment information changes are never verified through the channel they came from.

That's all, sorry if I went on too long.

If you're going this route, sort this out first. An untested backup is not a backup.

id say dont rush then the answer varies greatly by industry; there is no one-size-fits-all rule.

if I were you, I'd go this route.

We need to make a distinction here. Processes without records never improve, because you don't know what to fix.