Ms 365 Compromised Account Playbook for End Users

When a Microsoft 365 account is compromised, it can be alarming, but the good news is that there are steps we can take to secure it. This playbook is here to guide you through what happens next, and how we work to ensure that your data and business remain protected. Rest assured, we’ll help you every step of the way.

---

1. Recognizing the Problem

What to Look For:

• You might notice strange activity, like seeing emails you didn’t send or files being accessed that shouldn’t be.
• You may be locked out of your account, or receive alerts from Microsoft about unfamiliar logins.

If anything seems unusual, let us know immediately. Quick action can prevent further damage.

---

2. Taking Immediate Action

Once we know an account has been compromised, here’s what happens next to protect you:

2.1 Reset the Password

• We’ll reset the password to block any unauthorized users from accessing the account.
• You’ll receive a secure new password and instructions on how to log back in.

2.2 Log Out Suspicious Users

• We’ll force any active sessions out of your account. This means that anyone who shouldn’t be logged in will be kicked out instantly.

---

3. Strengthening Security

After we stop the immediate threat, we’ll make sure your account is even more secure:

3.1 Enabling Two-Step Verification

• We’ll turn on two-step verification (also called Multi-Factor Authentication or MFA). This makes it much harder for hackers to get in, even if they have your password.

3.2 Checking for Suspicious Changes

• We’ll review the account settings to make sure no harmful changes were made, such as emails being forwarded to unknown addresses.

---

4. Investigating the Cause

We’ll investigate how the account was compromised to prevent it from happening again. This includes checking:

• If any sensitive data was accessed.
• Whether the issue came from phishing, weak passwords, or other security lapses.

---

5. Clear Communication

We’ll keep you informed throughout the process. You’ll know:

• What we’re doing to fix the issue.
• Any additional steps you need to take, like updating passwords on other accounts.
• How your business data was impacted (if at all).

---

6. Preventing Future Issues

Once your account is secure, we’ll help you make it harder for this to happen again:

• Regular security updates and guidance on avoiding phishing attacks (those suspicious emails asking for personal info).
• Best practices for creating strong passwords and keeping them safe.
• Regular monitoring of your accounts for unusual activity.