Support for the tenant your business already uses
A suspicious invoice, unfamiliar sign-in or changed forwarding rule can be the start of a wider identity investigation. Scope the affected accounts and services, observed activity and available records. This workstream covers Microsoft 365 compromise whether or not Copilot is deployed and whether or not attacker use of AI is confirmed.
An evidence-led account of access and impact
- Identify affected identities and available sign-in, audit and mailbox records.
- Review relevant forwarding, delegation, authentication methods and application permissions.
- Assess related document access and external communications where included in scope.
- Coordinate approved containment and verify its effect across relevant services.
- Define restoration checks, remaining uncertainty and follow-up actions.
Licensing, retention and configuration affect what can be established. Scope and access are agreed before collection. A password change alone should not be treated as proof that every access path is closed.
Include on-premises dependencies
If your directory, endpoints or applications remain on premises, coordinate with their owners. Our legacy and hybrid infrastructure response workstream addresses that boundary. Existing Copilot incident response remains available when the AI workload itself is involved.
Prepare the initial request
Read Microsoft 365 hacked: what to investigate. Share a high-level account of the observed issue and timing, not raw mailbox exports or credentials.
Get help with the affected business systems
Explore this response workstream or our AI incident response services. You do not need to operate an AI application or prove the attacker used AI to request help. Describe the affected systems, observed impact and urgency; we confirm availability and agree an authorised scope.
Send only non-sensitive context through the website. If company email may be compromised, use a trusted communication channel and avoid sharing the investigation through the suspected account.
