Quick Answer: When someone takes over your Microsoft 365 account, they get everything you get: your inbox, your contacts, your OneDrive and SharePoint files, and the ability to send email as you. Containing it takes six steps, in order: reset the password, sign out every session, check the sign-in methods, remove rules and forwarding, check connected apps, and warn the people who may have been contacted.
If you think it is happening right now, BridgeNet's cybersecurity team can walk you through it.
What can someone do with your Microsoft 365 account?
A Microsoft 365 login is not just an email login.
It is the key to Outlook, Teams, OneDrive, SharePoint, and any other app your business connects to it.
Once an attacker signs in as you, they see what you see. That usually includes:
- Every email in your mailbox, including old threads about invoices, payroll, and contracts
- Your contact list, which tells them who you do business with
- Shared files on OneDrive and SharePoint
- Teams chats and channels you belong to
They can also act as you. They can send email from your real address, reply inside real threads, and message coworkers on Teams.
That is what makes a takeover different from a spam email. Messages from a compromised account pass every filter, because they really did come from your account.
What are the signs your Microsoft 365 account has been taken over?
Most takeovers are quiet. The attacker wants time, not attention.
Watch for these signs:
- Sign-in alerts you don't recognize. A login from another state or country, or from a device you don't own.
- Sent items you didn't write. Check Sent Items and Deleted Items. Attackers often delete what they send.
- Replies to messages you never sent. A customer writes back asking about "the new bank details" you supposedly shared.
- Missing email. Messages you expected never arrive, because a rule is moving or deleting them.
- New inbox rules. Rules with odd names, like a single period or a few random letters, that move mail into RSS Feeds, Archive, or Conversation History.
- Changed security info. A phone number or authenticator app on your account that you didn't add.
- MFA prompts you didn't trigger. A sign-in prompt at 2 a.m. means someone has your password.
- Coworkers asking about strange messages. Phishing links sent to your whole contact list are a common next move.
One sign alone can have an innocent explanation. Two or more together should be treated as a takeover until proven otherwise.
What should you do in the first hour?
Speed matters more than perfection. Work through these in order.
- Reset the password. Use a new password you have never used anywhere else, and do it from a device you trust.
- Sign out every session. A password reset does not always end sessions that are already open. A Microsoft 365 admin can sign the user out of all sessions from the admin center.
- Check sign-in methods. Remove any phone number, email, or authenticator app the attacker added. If you skip this, they can reset the password right back.
- Remove rules and forwarding. Delete inbox rules you didn't create, and confirm forwarding is off or points only where it should.
- Check connected apps. Look for apps that were given access to the mailbox. Some attackers use an app connection to keep reading mail after a reset.
- Warn the people who matter. Tell your team. Call, don't email, any customer or vendor who may have received a message from the account.
If the account belongs to someone who handles money, add one more step. Call your bank and your accounting team, and pause any payment changes requested in the last few weeks.
Why doesn't changing the password fix it?
This is one of the most common mistakes after a takeover.
A password reset blocks new sign-ins. It does not remove what the attacker already set up.
Attackers who get in usually leave themselves a way back:
- A forwarding rule that copies your email to an outside address
- An authenticator app or phone number registered to your account
- An app with permission to read your mailbox
- A session that keeps them signed in for a while
Each of these can survive a password change. That is why the first-hour steps cover every one of them.
How do you find out what the attacker saw or sent?
Once the account is locked down, the next question is scope. What did they read, what did they send, and how long were they in?
Microsoft 365 keeps sign-in logs and audit logs that answer most of those questions. They show when the account was accessed, from where, and what was done.
This matters for more than peace of mind. If the mailbox held customer data, health information, or financial records, you may have notification obligations. Your industry and state rules decide that, so loop in your attorney or cyber insurance carrier early.
The logs also tell you whether this was one account or the first of several. Attackers often use one compromised mailbox to phish the rest of the office, because a message from a coworker gets opened.
The bottom line
A Microsoft 365 takeover is not really a password problem. It is an access problem.
Lock the account, remove everything the attacker added, then look back at what they touched.
The businesses that recover fastest are the ones that had alerts turned on, and someone watching them, before anything happened.
Think an account has been compromised, or want to know whether your Microsoft 365 setup would catch one? Talk to a real person on BridgeNet's team. We'll walk through your sign-in alerts, mailbox rules, and security settings with you. Call 985-635-4380 or schedule a free cybersecurity assessment.
