Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
First determine whether the affected identity is a personal Microsoft account or a work or school account managed by an organization. For a personal account, use Microsoft’s sign-in helper after scanning the device. For a work or school account, contact your IT or security team immediately through a different channel; only tenant administrators can contain the identity, revoke sessions and investigate Microsoft 365 activity. A password change by itself may leave active sessions, app passwords, unauthorized authentication methods, application consent and mailbox rules in place.
Identify which kind of Microsoft account was compromised
The recovery path depends on who controls the account.
| Account type | Typical examples | Who controls recovery | First action |
|---|---|---|---|
| Personal Microsoft account | Outlook.com, Hotmail, Live, Xbox or a personal Microsoft subscription | You, using Microsoft Support’s consumer recovery tools | Run an up-to-date antivirus full scan, then use the Microsoft sign-in helper |
| Work or school Microsoft 365 account | An address issued by an employer, school or other tenant | Your organization’s Microsoft 365 and identity administrators | Report the suspected compromise to IT or security through an alternate channel |
Do not use the personal-account recovery flow to try to restore an organization-managed identity. Your employer or school may need to disable the user, reset credentials in an on-premises directory, revoke tokens and preserve audit evidence.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIf it is a work or school account: act in this order
1. Contact IT or security without trusting the affected mailbox
Call the help desk, use a known internal phone number, visit the service desk or use another account and device. Do not send a new password, recovery code or other secret to the compromised mailbox. Tell the team when you first noticed the problem, what you observed and whether you clicked a link, opened an attachment or approved an unexpected sign-in.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Until the team gives instructions, avoid deleting suspicious messages or changing mailbox rules. Those items can help establish what happened. If the account is being used to send messages, warn likely recipients through a separate channel rather than replying from the affected account.
2. Contain the identity
Microsoft advises administrators to disable the affected user during an investigation when possible. If disabling is not possible, the administrator should reset the password. The correct location for a password reset depends on how the identity is configured:
- Cloud-only identity: reset the password in the organization’s Microsoft 365 or Microsoft Entra administration tools.
- Synced identity: reset the password in on-premises Active Directory and reset it twice, following Microsoft’s guidance for synchronized users.
- Federated identity: change the password in the on-premises identity system and notify the administrator responsible for federation.
Existing app passwords are not automatically revoked by a normal password reset. Administrators must identify and remove any app passwords that the user does not recognize or that policy no longer permits.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →3. Revoke active sessions
Password changes do not necessarily terminate every access token that has already been issued. An administrator with the required permissions should revoke the user’s active sessions. Microsoft documents this Microsoft Graph PowerShell command:
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Revoke-MgUserSignInSession -UserId <UPN>Replace <UPN> with the user principal name, such as the affected work address. This is an administrator operation, not a first step for an ordinary employee.
Microsoft’s documented reason for revoking sessions is direct: “Revoking active sessions immediately invalidates any active access using the stolen credentials, and prevents the attacker from accessing more sensitive data or doing unauthorized actions on the compromised account.” Session invalidation still has timing limits. Microsoft’s admin-center guidance says a user may be prompted to sign in again within about an hour or when leaving the current Microsoft 365 page, depending on token and page behavior. Blocking sign-in can take up to 24 hours to take effect, so do not assume that a block is instantaneous or that every session ends at once.
4. Check authentication methods, applications and roles
After containment, compare the user’s configuration with a known-good state. Remove additions the user and administrator cannot explain, then require trusted re-registration where necessary.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Authentication methods: inspect phone numbers, authenticator registrations, security keys and other MFA methods. Microsoft’s guidance treats malicious method changes as evidence of compromise; remove the malicious methods, set a new password and have the user register trusted methods again.
- App passwords: review every existing app password because a password reset does not revoke them automatically.
- Enterprise applications and consent: examine user-consented applications and delegated permissions. Revoke unfamiliar grants and investigate what data they could access.
- Administrative roles: check whether the account was added to or changed in a privileged role. Remove unauthorized assignments and review actions performed while the role was active.
Investigate what the attacker did
Review Microsoft Entra sign-in activity
Start just before the suspected compromise and continue through remediation. For each relevant event, examine the time, IP address, approximate location, authentication result and the change or resource accessed. A location or sign-in that looks unfamiliar is a lead, not proof by itself: mobile networks, VPNs, proxies and travel can produce surprising locations. Confirm anomalies with the user and other organizational records.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Search Microsoft 365 audit records
Administrators can search activities in the Microsoft Purview portal. Include identity changes, authentication-method updates, application consent, role assignments, mailbox actions and other events that overlap the suspected window. Export or preserve relevant records according to the organization’s incident procedures before retention limits remove them.
Inspect the mailbox
- Review Sent Items and Deleted Items for messages the user did not send or delete.
- Look for suspicious inbox rules, forwarding rules and external forwarding addresses. Attackers commonly use these to hide replies or copy future mail.
- Check automatic replies, mailbox delegates and other settings that could disclose information or impersonate the user.
- Search for suspicious messages, especially phishing mail sent from the account or messages that may have delivered the original credential theft.
- Ask recipients whether they received fraudulent messages and have them report or delete those messages through the organization’s normal process.
Unexplained lockouts, new MFA methods, application grants, administrative changes and mail anomalies should be correlated with sign-in and audit records rather than considered in isolation.
If it is a personal Microsoft account
1. Scan the device before changing the password
On the computer you normally use, update the antivirus definitions and run a full scan before entering a replacement password. Microsoft’s personal-account guidance points to Microsoft Defender and recommends an up-to-date antivirus scan. If malware is found, follow the security product’s removal and restart instructions before continuing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Use Microsoft’s sign-in helper
Open Microsoft Support’s sign-in helper from a device you trust and follow the prompts for a hacked account. Change or reset the password only through the official Microsoft sign-in and account pages. Create a unique password that is not reused on another site. If recovery information has been changed, follow the helper’s identity-verification process rather than repeatedly guessing credentials.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Review connected settings after regaining access
Once signed in, inspect the account for persistence mechanisms and data exposure:
- Connected accounts and services you do not recognize
- Email forwarding addresses and forwarding rules
- Automatic replies that were not written by you
- Recent password, security-information and permission changes
- Devices and sessions that remain signed in
Remove unauthorized connections, forwarding and automatic replies, then sign out of sessions you do not recognize. Do not assume that changing the password alone removed an attacker’s access.
4. Use the Recent activity page as an investigation lead
Microsoft’s Recent activity page can show events such as security-information additions or removals, new application permissions, password changes, unusual activity and “Sign-in blocked (Account compromised) | We think someone else accessed your Microsoft account.” Treat unfamiliar entries as leads to investigate. The page is not a substitute for scanning the device, changing credentials and checking connected settings.
Verify recovery before returning to normal use
For an organization account, the user should sign in only after IT confirms that containment and investigation steps are complete. For a personal account, perform the checks yourself before resuming sensitive activity.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Confirm the password was changed through an official Microsoft page or the organization’s approved identity system.
- Verify that every MFA method and recovery address belongs to the legitimate user.
- Confirm that unknown applications, app passwords, forwarding rules and automatic replies are gone.
- Check that unexpected administrative roles, delegates or mailbox permissions were removed.
- Review sign-in and audit activity again for attempts after remediation.
- Notify contacts or the organization’s security team about fraudulent messages sent during the incident.
Strengthen the account after the incident
Use the incident to remove access paths that are no longer needed. Keep MFA enabled and register more than one trusted method when organizational policy allows it. Microsoft Entra documentation includes FIDO2 security keys among supported authentication methods, but compatibility and enrollment rules depend on the tenant; ask the organization before buying or registering a device. A security key is a prevention and recovery-hardening measure, not a replacement for containing an active compromise.
Do not reuse the recovered password, approve unexpected MFA prompts or grant application consent just to make a sign-in work. If a sign-in repeatedly fails or a method keeps reappearing, stop and return the case to IT or Microsoft Support rather than weakening security controls.
Common mistakes that prolong a compromise
- Resetting only the password: active sessions, app passwords, tokens, MFA methods and mailbox rules may remain.
- Using the compromised mailbox to report the incident: an attacker may read the report or impersonate the responder.
- Deleting evidence: deleted mail, rules and audit events can show the scope and timeline.
- Assuming a foreign location proves compromise: verify the event against travel, VPN and network context.
- Expecting an immediate block: Microsoft documents that blocking sign-in can take up to 24 hours.
- Buying a new security product as the first response: containment, session revocation, investigation and trusted credential recovery come first.
When to involve other responders
Escalate to the organization’s incident-response, privacy, legal or communications teams when business data, regulated information, privileged access or many recipients may be involved. Notification and reporting duties depend on the jurisdiction, the organization and the facts of the incident; Microsoft’s account-recovery instructions do not determine those obligations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
