Protect the Microsoft 365 accounts that hold firm email, files, client conversations, and administrative access.
An attacker may still have an active session, a connected application, a forwarding rule, delegated mailbox access, or control of the recovery method. Resetting the password deals with one part of the problem.
A proper response checks the account, connected applications, Exchange mailbox, devices, and audit history together. The firm should know what will be revoked, what will be reviewed, what records will be kept, and who needs to be involved.
How we keep one account from becoming a firm-wide problem. Conditional Access that reflects how the firm works. We set different rules for staff, administrators, devices, locations, older sign-in methods, and emergency access. One blanket policy rarely covers a real Microsoft 365 environment safely. Stronger login for the accounts that matter most. Administrators and sensitive roles move to phishing-resistant options such as passkeys or security keys first, with a recovery process that does not create an easy way around them. Monitoring risky sign-ins and sessions. We watch Entra ID for risky users, unusual sign-ins, and token activity, then investigate using a response path agreed with the firm in advance. Control over connected applications. We limit who can approve new applications, review the access each application requests, and make sure a real person owns the business decision. Checking the mailbox for access left behind. Every investigation includes forwarding, inbox rules, delegates, message handling, and mailbox history. These are common places for an attacker to keep access or hide activity. A complete account response. We revoke sessions and tokens, secure the account, remove access the attacker left behind, review what was touched, and keep a record of the response.
What the person accountable for Microsoft 365 can see. Who the login rules cover. The record shows which people and accounts are covered by Conditional Access and strong authentication, where exceptions remain, and who approved them. Which applications can reach firm data. Every connected application has a named owner, a list of permissions, and a decision to keep, restrict, or remove it. What happened during an investigation. The response record puts sign-ins, sessions, mailbox changes, application access, affected files, and containment actions in one timeline. When sensitive settings were last reviewed. Administrative roles, emergency accounts, sharing, recovery, and key security settings are checked on a defined schedule rather than only after an incident.
A good fit for firms that run email, files, identity, and collaboration on Microsoft 365; have years of settings, exceptions, and connected applications that nobody has reviewed as a whole; want someone watching for account misuse after the initial security review is complete.
Important limits. If an account may be compromised now, start incident response. A planned review can wait. The Microsoft licences you hold affect which native safeguards are available, so the design has to match your environment and budget. A live compromise may create legal, insurance, privacy, and client obligations. Those decisions remain with your counsel, insurer, and leadership.