Containing compromised access

Containment and remediation

An attacker may still be monitoring email, sending messages or accessing files when an incident is discovered. Reducing ongoing harm is an early priority.

Containment

Act as quickly as possible to limit further harm by restricting compromised access.

Remediation

Remove unauthorised changes and address the cause of the compromise to help prevent it happening again.

Capture available evidence and record changes as response work proceeds. Urgent containment and evidence collection can happen alongside one another.

Securing the account

Changing a password is one part of the response. Sessions, authentication methods and other permissions need attention too.

Restrict access

Block or restrict the compromised account when appropriate to stop further use while it is secured.

Reset the password

Replace compromised credentials with a new password through a trusted recovery process.

Revoke sign-in sessions

Revoke sign-in sessions to help end the attacker’s access. Some applications may keep existing sessions active until they expire or are separately revoked.

Review MFA methods

Multi-factor authentication (MFA) adds another identity check. Remove unauthorised methods and help the user securely register approved methods again.

Coordinate these actions using the organisation’s response procedure. A password reset or session revocation alone does not guarantee that all attacker access has ended.

Checking for continued access

Persistence means maintaining or regaining access after the initial compromise. Early checks can catch obvious changes while deeper investigation continues.

Inbox rules and forwarding

Look for unexpected external forwarding, rules that hide replies, and mailbox-level forwarding settings. A forwarding rule can continue sending email to an external address after the password is changed.

Mailbox permissions

Review unexpected delegates or other permissions that allow a different account to access the mailbox.

Application permissions

Check newly added or changed applications, consent grants and credentials that could allow access to email or files.

Authentication and account changes

Review added MFA methods, unfamiliar accounts and relevant permission changes.

Applications and service principals

Application consent

Permission granted to an application to access data or act for a user.

Service principal

A service principal is an application’s identity within an organisation’s Microsoft Entra environment, called a tenant. Enterprise applications in Entra represent these identities and their configuration.

Changing the user’s password may not remove an application’s access. Review the application’s permissions, credentials, creation time and activity to identify and remove unauthorised access.

Recording and verifying the response

Record what was changed, when it was changed and why. Preserve details of suspicious rules and permissions before removing them where practical.

Continue monitoring for further suspicious activity and investigate how access was gained. Quick checks reduce risk; they do not replace the full investigation.