What to do after a Microsoft 365 phishing attack

If you have a user that has fallen for a phishing attack, then you need to act quickly to limit the potential damage as much as possible.

If a user in your Microsoft 365 environment may have been phished (especially their login credentials), there are several critical things you should check right away in the Microsoft 365 Admin Center and Microsoft Entra / Defender portals.

🚨 Incident Response Checklist – Microsoft 365 Admin Console

🔍 1. Review Sign-in Logs

Check for suspicious logins (locations, IPs, times):

• Go to: https://entra.microsoft.com
• Navigate to:
  Users → Select the user → Sign-in logs
• Look for:
  • Logins from unfamiliar countries/IPs
  • Login failures followed by success
  • Unusual device/browser combinations
  • “Legacy authentication” used (often less secure)

✉️ 2. Check Mailbox Rules

Look for malicious forwarding or auto-delete rules:

• Use PowerShell or:
  • Go to: https://security.microsoft.com
  • Navigate to: Email & collaboration → Explorer
  • Or use PowerShell: powershellCopyEditGet-InboxRule -Mailbox user@domain.com

Watch out for:

• Auto-forward rules to external addresses
• Auto-delete or move messages to obscure folders

📬 3. Review Sent Email Activity

Check if the account sent phishing/spam emails.

• Go to: Microsoft 365 Defender Portal
• Navigate to: Email & collaboration → Explorer → Filter by sender (user email)

Look for:

• Mass mailing
• Unusual recipients
• Phishing-like content

🔐 4. Check/Reset MFA & Authentication Methods

Ensure MFA is enabled and no new methods added:

• Go to: https://entra.microsoft.com
• Navigate to: Users → Select user → Authentication methods
• Remove suspicious phone numbers, email addresses, or app registrations
• Reset MFA if unsure

🧾 5. Audit & Alert Policies

Review audit logs (if enabled) and alerts:

• Go to: https://compliance.microsoft.com
• Use Audit under Solutions to search:
  • Set-Mailbox, Add-MailboxPermission, UpdateInboxRules, etc.

Also check:

• Microsoft 365 Defender → Alerts for anything triggered

🚫 6. Immediately: Secure the Account

If compromise is suspected:

• Reset password
• Revoke sessions: powershellCopyEditRevoke-AzureADUserAllRefreshToken -ObjectId <user's object ID> Or via Entra:
  User → Sign-in logs → Revoke sessions
• Force sign-out from all apps

🛡 7. Optional but Recommended

• Run a mailbox investigation using Microsoft Defender
• Turn on User Risk Policy in Entra ID P2 (if licensed)
• Use Attack Simulation Training to test users later

DrayTek Vigor 2962 2.5Gb Ethernet Dual-WAN Broadband Firewall Router, 200 VPN Tunnels, 20 VLANS, QOS, Remote Management, Load Balancing

High Performance Multi-WAN Router - The Vigor 2962 makes full use of FTTP Fibre Broadband at up to 2.2Gbps throughput for single or multi-WAN configurations. With Quality of Service, Firewall and Content Filtering.

Buy Now on Amazon

NETGEAR Orbi Mesh WiFi 6 System (RBK763S) , Mesh Router & 2 Extenders , Cover Every Room, Up To 6,000 Sq Ft , Improve WiFi Speeds up to 5.4 Gbps & 75 devices , Simple App Set Up

WiFI mesh coverage of up to 6,000 sq ft and up to 75 devices, With each satellite (sold separately) you can extend the range by up to 2,000 sq ft

Buy Now on Amazon

DrayTek Vigor 2865Lax-5G Ethernet Router, WiFi 6 AX3000 Wireless and 5G Failover, Integrated 5G Modem, 5+1 GbE LAN Ports with VLANs, VDSL

VDSL and Ethernet Load Balancer - Connect the Vigor 2865 to Superfast Fibre with the integrated VDSL modem. Use the Ethernet WAN with Cable and Ultrafast FTTP. Load Balance multiple connections to boost performance.

Buy Now on Amazon

TP-Link Archer BE550 Router WiFi 7 BE9300Mbps, Tri-Band WiFi Router, 2.5G Ports,USB Port,Maximized Coverage,VPN Router, Parental Control, HomeShield Security, Private IoT Network,Easy Setup,EasyMesh

Wi-Fi 7 Routers: With powerful Wi-Fi 7 performance, lightning-fast wired connections, and brand-new design

Buy Now on Amazon

QNAP TS-253A-4G 2 Bay NAS Enclosure with 4GB RAM - Black (GDPR Compliant)

NAS and iSCSI-SAN unified storage solution for server virtualization

Buy Now on Amazon

WD 16TB My Cloud EX2 Ultra 2-bay NAS - Network Attached Storage RAID, file sync, streaming, media server, with WD Red drives

Centralised network storage: Organise your entire media collection, photos and files in one central, network location

Buy Now on Amazon

Synology DX517 5 Bay Desktop Network Attached Storage Expansion Enclosure, Black

Online volume expansion

Buy Now on Amazon

QNAP TS-431XeU-8G 4 Bay Short-depth Rackmount NAS Enclosure with 10GbE SFP+ & 8GB RAM

The short depth design is suitable for installing in smaller racks or space-constrained locations

Buy Now on Amazon

Seagate 10 TB IronWolf NAS 3.5 Inch Hard Drive ST10000VN0008 (SATA 6 Gb/s/256 MB/7200 RPM)

Model Number: ST10000VN0008

Buy Now on Amazon

QNAP TS-673A-8G 6 Bay Desktop NAS Enclosure - 8GB RAM, AMD Ryzen Quad-core 2.2 GHz Processor - with 2.5GbE connectivity & supporting PCIe expansion

8GB DDR4 RAM (2 x SODIMM slots, max. 64GB, optional ECC RAM support)

Buy Now on Amazon

Synology DS1621+ 48TB 6 Bay Desktop NAS Solution, installed with 6 x 8TB Western Digital Red Plus Drives

Accelerated Performance: 174% higher 4K random read IOPS and 76% faster sequential write speeds compared to its predecessor

Buy Now on Amazon

Synology DS1823xs+ 8 Bay NAS Desktop: High-Performance Storage Solution

Powerful Performance - Over 3,100/2,600 MB/s sequential read/write throughput and over 173,100/80,800 random read/write IOPS2 support heavier applications

Buy Now on Amazon