The Company Was Locked Out of Its Own Microsoft 365 Account: How to Investigate Cloud Account Compromise and Business Email Takeover

A Microsoft 365 account can become the control centre for an entire business. Employees use it to access email, documents, calendars, shared files, collaboration tools and, in many organisations, other connected applications. If an administrator or employee suddenly loses access, the disruption can extend far beyond an ordinary password problem.

A lockout may be caused by a forgotten password, a misconfigured security policy or an administrative change. But it can also be a warning sign of account compromise. An unauthorised person may have changed authentication details, registered a new sign-in method, altered mailbox rules, accessed cloud files or used the account to impersonate an employee.

The immediate priority is to regain control safely. The next is to establish what happened, which resources may have been accessed and whether the account was used to target other people.

At Cyb3rsect, cloud account investigations focus on the digital evidence that can help reconstruct suspicious activity. This guide explains how organisations can respond to a Microsoft 365 account lockout, preserve relevant records and investigate a possible cloud account takeover.

Why a Microsoft 365 lockout deserves investigation

An unexpected lockout should not automatically be treated as proof of hacking. There are legitimate reasons an account may become inaccessible, including repeated failed sign-in attempts, conditional access restrictions, expired credentials, changes to multifactor authentication or an administrator disabling an account.

However, certain circumstances justify a closer investigation:

• An employee receives an unexpected password-reset or authentication notification.
• The account’s password or recovery information appears to have changed without authorisation.
• A user reports unfamiliar sign-in notifications or sessions.
• Messages have been sent that the employee does not recognise.
• Email forwarding or inbox rules have appeared unexpectedly.
• Documents have been accessed, downloaded or shared without a clear business reason.
• Other employees receive unusual requests from the affected account.
• An administrator discovers unfamiliar authentication methods or account changes.

The important distinction is between an access problem and a security incident. A lockout tells you that access has been interrupted. It does not, by itself, explain why.

1. Secure the account without destroying evidence

If compromise is suspected, involve the organisation’s Microsoft 365 administrator and security team immediately. Where an external IT provider manages the environment, notify them through a trusted contact channel.

The response should be coordinated. Avoid repeatedly changing settings without recording what was changed, when it happened and who authorised it.

Depending on the circumstances, containment may include:

• Resetting the affected user’s password through a trusted administrative process.
• Revoking active sign-in sessions and refresh tokens.
• Reviewing and removing authentication methods that the user does not recognise.
• Disabling suspicious application access or consent grants.
• Temporarily disabling the account if continued access presents an unacceptable risk.
• Reviewing privileged accounts and other accounts that may have been exposed.
• Enforcing appropriate multifactor authentication and access policies.

A password reset alone may not be sufficient. An attacker could have established additional access through a session, authentication method, application permission or mailbox configuration.

Record each containment action. If possible, preserve relevant audit and sign-in information before making changes, while ensuring that evidence collection does not delay urgent security measures.

2. Establish the timeline of suspicious sign-ins

One of the central questions is: when did the unauthorised access begin?

Microsoft Entra sign-in logs can help administrators examine authentication activity associated with a user or application. Depending on the organisation’s licensing, configuration and log-retention settings, records may include timestamps, IP addresses, locations, client applications, authentication details and sign-in outcomes.

Investigators should look for patterns rather than relying on one unusual entry.

Relevant questions include:

• Were there successful sign-ins from unfamiliar IP addresses?
• Did sign-in activity occur at unusual times?
• Were there repeated failed attempts before a successful login?
• Did the account access services it does not normally use?
• Were authentication requirements satisfied in an unexpected way?
• Did activity change shortly before the user lost access?
• Were there sign-ins involving unfamiliar devices, applications or session types?

Geolocation should be interpreted cautiously. IP-based location is approximate, and legitimate users may connect through VPNs, mobile networks or corporate gateways. An unfamiliar location is a lead to investigate, not conclusive proof of an attack.

The timeline should connect authentication activity with other events, such as password changes, mailbox-rule creation, file access and administrator actions.

3. Investigate mailbox rules and email forwarding

Mailbox manipulation is a common concern in business email compromise investigations. An unauthorised user may create inbox rules to hide particular messages, redirect correspondence or monitor conversations.

For example, an attacker who gains access to a finance employee’s mailbox may attempt to identify supplier invoices, payment instructions or ongoing commercial discussions. A forwarding rule could send selected messages to an external address, while another rule may move replies into an obscure folder.

Review:

• Inbox rules that the user does not recognise.
• Automatic forwarding settings.
• Mailbox delegation and permissions.
• Unfamiliar send-as or send-on-behalf permissions.
• Suspicious sent messages and deleted items.
• Unexpected changes to mailbox settings.
• Messages containing altered payment instructions or unusual requests.

Do not assume that every unfamiliar rule is malicious. Some organisations use legitimate automation, shared mailboxes and delegated access. Compare the configuration with documented business requirements and previous records where available.

For a deeper examination of message origins, headers and related communications, see Cyb3rsect’s guide to Email Forensics.

4. Check for unauthorised access to cloud files

A compromised Microsoft 365 identity may provide access to more than email. Depending on permissions, the account may also reach SharePoint sites, OneDrive files, Teams content and other connected resources.

The investigation should identify whether sensitive information was viewed, downloaded, modified, shared or deleted.

Relevant evidence may include:

• SharePoint and OneDrive audit events.
• File access and modification records.
• External sharing activity.
• Unusual download patterns.
• Changes to sharing links or permissions.
• Unexpected deletions or bulk file operations.
• Access to folders outside the employee’s normal responsibilities.

The presence of an access event does not always establish that a person viewed or copied the contents. Investigators should distinguish between an attempted action, a successful access event and evidence of actual data transfer.

Organisations should also consider whether the affected account had access to shared departmental folders, confidential client records or other users’ information.

5. Examine application permissions and connected services

Not every cloud account compromise depends on repeated password access. An attacker may attempt to establish persistence through an application integration or a permission grant.

Microsoft Entra administrators should review enterprise applications, app registrations and user-consent activity relevant to the affected account and environment.

Questions include:

• Did the user approve an unfamiliar application?
• Were permissions granted that appear excessive for the application’s purpose?
• Are there unfamiliar service principals or application registrations?
• Did an application gain access to mail, files or directory information?
• Were credentials, secrets or certificates added or changed unexpectedly?
• Does the application have access beyond the user’s normal business requirements?

Application permissions can be complex. A suspicious-looking application name is not enough to establish malicious intent. Verify the publisher, business purpose, permission scope, consent history and related activity before removing access.

If an application is confirmed to be unauthorised, document its configuration and relevant events before containment where practicable.

6. Review administrator activity and privilege changes

A compromised standard user account is concerning. A compromised administrator account can create a much wider incident.

Review privileged activity around the suspected compromise period, including:

• Changes to user roles and administrative privileges.
• New or modified administrator accounts.
• Password and authentication-method resets.
• Conditional Access policy changes.
• Changes to security defaults or multifactor authentication requirements.
• Creation or modification of applications and service principals.
• Changes to audit settings or log-retention configuration.

Determine whether the changes were authorised and whether they align with a documented IT request.

If a privileged account may be compromised, treat it as a priority. Secure other administrative identities through a trusted process and assess whether the attacker could have changed security controls or accessed additional users.

7. Preserve the evidence before it disappears

Cloud investigations depend on records that may have limited retention periods or may be affected by administrative changes. Evidence preservation should therefore begin as early as reasonably possible.

Preserve relevant records in their original or properly exported form, including:

• Microsoft Entra sign-in and audit logs.
• Microsoft 365 unified audit log records.
• Exchange mailbox audit information.
• Mailbox rules and forwarding configuration.
• Relevant message files and email headers.
• SharePoint and OneDrive activity records.
• Application permissions and consent records.
• Security alerts and incident notifications.
• Relevant endpoint security logs.
• Administrator notes and incident-response timestamps.

Record the source of each item, the collection date and time, the person who collected it and any transformations performed. Maintain access controls over exported records and use a consistent naming and storage process.

Screenshots can help document what an administrator observed, but they should not be the only evidence where original logs or exports are available.

For a more detailed explanation of evidence handling, see Digital Evidence Preservation.

8. Determine whether the account was used to target others

A compromised business account can become a platform for further attacks. An attacker may send phishing messages, request urgent payments, distribute malicious links or impersonate an employee in ongoing conversations.

The investigation should establish whether the account communicated with internal or external recipients during the suspected compromise period.

Review:

• Unrecognised messages in the Sent Items folder.
• Mail trace information where available.
• Messages containing unexpected attachments or links.
• Unusual requests for payments or changes to bank details.
• Messages sent to large groups or external contacts.
• Reports from recipients who received suspicious communications.
• Similar activity involving other accounts.

Notify potentially affected recipients through a trusted communication channel. If payment instructions may have been altered, contact the relevant financial institution promptly using verified contact details.

The organisation should also consider whether the incident involves personal information, regulated data or contractual notification obligations. Legal, privacy and regulatory advice may be necessary depending on the jurisdiction and information involved.

9. Reconstruct what happened and identify remaining risks

A useful investigation should do more than list suspicious events. It should connect the evidence into a coherent timeline and explain what can and cannot be established.

A structured assessment may address:

1. Initial access: What evidence indicates how the account may have been compromised?
2. Authentication activity: Which sign-ins and authentication events appear relevant?
3. Account changes: Were passwords, authentication methods, roles or permissions altered?
4. Mailbox activity: Were messages sent, forwarded, hidden or deleted?
5. Cloud resources: Was there evidence of access to files, shared folders or collaboration content?
6. Persistence: Were applications, permissions or additional access methods established?
7. Further targeting: Was the account used to contact colleagues, customers or suppliers?
8. Containment: Which actions were taken, and what risks remain?

Where the available records do not establish whether a file was copied or whether a particular person controlled an account, the report should say so. Reliable investigations distinguish confirmed facts from indicators, assumptions and unresolved questions.

10. Prevent another Microsoft 365 account takeover

Once the incident has been contained and investigated, review the organisation’s identity and cloud-security controls.

Practical improvements include:

• Enforcing multifactor authentication for all users, with stronger methods for privileged accounts.
• Applying least-privilege access to users, administrators and applications.
• Reviewing Conditional Access policies and exceptions.
• Removing obsolete accounts and unnecessary permissions.
• Monitoring suspicious sign-ins and risky account activity.
• Auditing mailbox forwarding, delegation and rule changes.
• Restricting user consent to applications where appropriate.
• Maintaining suitable audit logging and retention.
• Training employees to report unexpected authentication prompts.
• Establishing a documented process for account compromise and evidence preservation.

Security controls should be tested against the organisation’s actual environment. A policy that exists on paper may not protect every account, application or legacy access path.

When should an organisation seek a digital investigation?

Specialist assistance may be useful when the cause of a lockout is unclear, multiple accounts appear affected, sensitive information may have been accessed, payment instructions were altered or the organisation needs a documented account of what happened.

A digital investigation can help organise available records, identify relevant activity, assess competing explanations and produce findings for internal decision-making or further professional review.

Cyb3rsect provides information and investigation-focused support through its digital forensics and cyber investigation work. Organisations considering an investigation can begin at Cyb3rsect and describe the account issue, approximate incident timeline, affected services and evidence already available.

Do not send passwords, authentication codes or unrestricted access credentials through an ordinary enquiry form. Access to systems and records should be provided only through an authorised, secure process.

Final thoughts

Being locked out of a Microsoft 365 account can be disruptive, but the lockout itself is only one part of the incident. The more important questions are whether someone gained unauthorised access, what they changed, which information they reached and whether they used the account to target others.

A disciplined response combines containment, careful log analysis, mailbox and application review, evidence preservation and a clear timeline. Acting quickly can reduce further exposure while preserving the information needed to understand the incident.

For organisations facing a suspected cloud account takeover, the goal is not simply to restore access. It is to establish what happened, address remaining risks and make informed decisions based on the available digital evidence.