Start with the affected identity and the observed behaviour
A customer reports a strange invoice from your colleague. The colleague cannot find it in Sent Items, or a forwarding rule appears that nobody recognises. Begin with the message, account and approximate time. These observations warrant investigation; they do not yet establish every action taken by an attacker.
Microsoft 365 accounts can reach more than email. Scope the relevant tenant services, privileged roles and connected applications. In a hybrid company, also establish whether the same person has an on-premises account and which system controls identity changes. Assign owners for tenant administration and local infrastructure before making competing changes.
Preserve enough evidence to answer the business question
| Evidence area | Question to resolve |
|---|---|
| Original messages and headers | What was sent, to whom and through which path? |
| Available sign-in and audit records | Which identities and actions appear in the incident window? |
| Mailbox configuration | Were forwarding, rules or delegation changed? |
| Application permissions and authentication methods | Could access persist through another mechanism? |
| Relevant file and sharing activity | Did the incident involve documents as well as email? |
Available records depend on licensing, configuration and retention. Record the exact query window and timezone, preserve original exports and note gaps. Avoid interpreting an empty search as proof that no activity occurred. The investigation should explain what the evidence can and cannot establish.
Contain the access path, then verify the effect
Have an authorised administrator coordinate containment. Microsoft’s account-compromise guidance covers account access, authentication methods, application consent and mailbox investigation. A response plan should address the relevant persistence paths rather than stop at changing a password.
Microsoft also explains that access-revocation effects depend on the token and application. Some sessions can continue until expiry or require application-side action. Verify the outcome in the affected services; do not promise that clicking one control instantly ends every possible session. Preserve records where operationally safe without allowing ongoing harm merely to collect more evidence.
Check payment fraud and external communications
If an invoice or beneficiary instruction changed, involve the finance owner immediately. Use independently verified contact details for the bank and counterparty, rather than numbers in the suspicious thread. Record transaction references and the steps taken. The email investigation and the payment response need coordinated owners, but one does not replace the other.
Determine whether other employees or external recipients received malicious messages. Keep confirmed recipients separate from a guessed population. Provide privacy, legal and communications colleagues with an evidence-backed account of the data and actions involved so they can make their own decisions.
Recover with explicit acceptance criteria
Agree what must be true before restoring normal use: authorised access works, the identified unwanted configuration is removed, relevant permissions are reviewed and the original path no longer provides access. Document unresolved questions and assign follow-up owners. Monitoring should focus on the observed incident and related access paths.
If AI-assisted phishing is suspected, record that as a hypothesis unless evidence supports a stronger conclusion. Your Microsoft 365 environment still needs the same careful identity and data investigation. See our AI-assisted attack response guide for that distinction.
Get help with the affected business systems
Explore this response workstream or our AI incident response services. You do not need to operate an AI application or prove the attacker used AI to request help. Describe the affected systems, observed impact and urgency; we confirm availability and agree an authorised scope.
Send only non-sensitive context through the website. If company email may be compromised, use a trusted communication channel and avoid sharing the investigation through the suspected account.
Sources and review
Reviewed 24 October 2026. The decision tables and planning examples are Atlant Security guidance. A suspected use of AI is not established attribution. Scope, availability and evidence handling are agreed before an engagement.
