Business Email Compromise Investigation and Recovery is an emergency engagement for organizations whose Microsoft 365 account — or several — has been taken over. IT Partner contains the attacker first (revoking sessions and tokens, resetting credentials in the right order, removing malicious inbox rules, forwarding, and rogue OAuth grants), then builds a timeline of attacker activity from Microsoft Entra sign-in logs and the Microsoft Purview unified audit log, hunts down every persistence mechanism, summarizes what was accessed or sent, and hands you a prioritized hardening plan. We prepare the evidence your bank, cyber-insurance carrier, and law enforcement will ask for — your counsel and carrier lead those tracks; we support them. The compromised-account remediation steps are listed on this page in the order they should run, so your administrator can start the first ones while you reach us; a single compromised account with no lateral movement sits at the low end of the per-incident quote.
A business email compromise rarely announces itself. It surfaces as a customer asking about changed bank details on an invoice, a vendor confirming a payment you never requested, inbox rules nobody created, or a wave of phishing sent from your own domain. By that point the attacker has usually been reading mail for days or weeks — and every hour of improvised cleanup can destroy the evidence that shows what they actually did. Compromised account remediation steps, in order — for one Exchange Online or Microsoft Entra account. This is the sequence we run, and the first steps are safe for your administrator to start while you contact us: 1. Revoke the account's sessions and refresh tokens in the Microsoft Entra admin center. Access tokens already issued keep working until they expire unless Continuous Access Evaluation is in effect, so the next step follows within minutes. 2. Reset the password. Do not send the new one to the mailbox the attacker may still be reading, and delete and recreate any app passwords — a password reset does not revoke them. 3. Remove every authenticator app, phone number, or passkey the attacker registered, revoke the user's multifactor authentication sessions, and require re-registration — on a call where you have verified the person. 4. Export, then remove, inbox rules and any mailbox or transport-rule forwarding. 5. Review the OAuth application consents and app registrations tied to the account and revoke what you do not recognize. 6. Check mailbox delegation — Full Access, Send As, Send on Behalf — and the tenant's transport rules for additions. 7. If Microsoft restricted the user from sending, unblock the account on the Restricted entities page in the Microsoft Defender portal only after the steps above; sending usually resumes within about an hour. 8. Export the Microsoft Entra sign-in logs and the Microsoft Purview audit log for the account before they age out. 9. Establish what the attacker read, searched, and sent. 10. Notify the customers, vendors, and staff affected. In the engagement IT Partner performs steps 1 through 9 for every account in scope, preserving the evidence before each removal, then hunts the rest of the tenant for the persistence a single-account sequence cannot see. Step 10 — deciding whom to tell and telling them — stays with you and your counsel, with the recipient list and the facts from us. Investigation follows containment: a timeline of attacker sign-ins and actions reconstructed from the Microsoft Entra sign-in logs and the Microsoft Purview unified audit log, a systematic hunt for persistence across the tenant — rules, delegations, added MFA methods, app registrations, new accounts, role changes — and an exposure review of what was read, searched, or sent, to the extent your licensing and retention captured it. Hardening closes it: a prioritized, owner-assigned list of the changes that would have prevented or shortened the incident, so the same door is not left open twice. Who this is for: organizations on Microsoft 365 that are mid-incident or have just closed one — including cases where fraudulent payment instructions already went out. Who it is not for: ransomware and endpoint malware response, on-premises server forensics, or litigation-driven forensic work — those need a different engagement, and we say so during intake rather than after. If the incident is already contained and what you need is the written account of it, Microsoft 365 Post-Incident Investigation and Report is the read-only reconstruction with the formal report. The engagement is scoped per incident, from $4,950, with the quote confirmed in writing before work begins. A single compromised account with no lateral movement — one mailbox, no administrative role, no second account touched — is the low end of that range; more accounts, an administrator's account, or longer attacker dwell time move the quote up, always in writing. The defined investigation scope typically completes within five business days; containment actions start on day one.
Confirm scope, access, and the containment order with your decision-maker, then run the remediation sequence on this page for each account in scope: revoke sessions and refresh tokens and reset the password back to back, remove attacker-added MFA methods and require re-registration, export then remove inbox rules and forwarding, revoke rogue OAuth grants, check delegation and transport rules, and unblock sending if Microsoft restricted the user. Preserve rule definitions, messages, and audit evidence before removing anything, and export the sign-in and audit logs that age out first.
Sweep the tenant for everything an attacker leaves behind: inbox rules and transport rules, delegations and mailbox permissions, OAuth grants and app registrations, added MFA and recovery methods, new accounts, and admin-role changes. Revert what is malicious; record what is ambiguous for your review.
Reconstruct attacker activity from Entra sign-in logs and the unified audit log: initial access, sessions, mail access and searches, sent messages, and data touched. Identify affected third parties — customers or vendors who received fraudulent mail — so you can decide on notifications.
Assemble the evidence package for bank, carrier, and law enforcement, and draft the prioritized hardening plan with owners. Apply any quick mitigations you approve during the engagement.
Deliver the incident report, walk your administrators through the timeline and the tenant changes, review re-compromise indicators, and agree the follow-on hardening or monitoring work if you want it.
In this order, for each account. (1) Revoke sessions and refresh tokens in the Microsoft Entra admin center and (2) reset the password, back to back: a reset alone leaves valid tokens, a revocation alone leaves a known password, and access tokens already issued keep working until they expire unless Continuous Access Evaluation is in effect. (3) Remove any authenticator app, phone number, or passkey the attacker registered, revoke the user's multifactor authentication sessions, and require re-registration on a call where you have verified the person; delete and recreate app passwords, which a password reset does not revoke. (4) Export and then remove inbox rules, mailbox forwarding, and any transport rule that forwards or redirects the account's mail. (5) Review OAuth application consents and app registrations tied to the account and revoke what you do not recognize. (6) Check Full Access, Send As, and Send on Behalf delegation on the mailbox. (7) If Microsoft restricted the user from sending, unblock the account on the Restricted entities page in the Microsoft Defender portal after the steps above; sending usually resumes within about an hour. (8) Export the Microsoft Entra sign-in logs and the Microsoft Purview audit log for the account before they age out. (9) Establish what was read, searched, and sent. (10) Notify the customers, vendors, and staff affected. Microsoft's own "Responding to a compromised email account" guidance covers the password, forwarding, inbox-rule, and unblock steps and recommends MFA; the token, consent, delegation, and audit steps are where most self-run cleanups stop short. In this engagement IT Partner performs steps 1 through 9 for every account in scope, preserving the evidence before each removal, then hunts the rest of the tenant for persistence the single-account sequence cannot see. Step 10 is your decision, made on the recipient list and timeline we hand you.
Three things before anything else. First, if fraudulent payment instructions went out, call your bank now and ask for a recall — hours matter more than anything an investigator does later. Second, stop the improvised cleanup: do not delete inbox rules, purge messages, or wipe the account, because that destroys the record of what the attacker did. Third, contact us with what you know — which accounts, since when, what tipped you off. Containment (revoking sessions, resetting credentials, removing rules and rogue app grants) starts on day one, in an order that preserves evidence. If you have an administrator free, the remediation sequence in the previous answer is safe to start before we are on the call.
Our published support SLA is first response within one business hour — and we publish our monthly support statistics for every month since December 2023, including the months we missed, so you can check the record rather than take the claim on faith. We do not advertise a guaranteed 24/7 emergency dispatch, because we would rather publish a number we can prove.
Often yes, sometimes partially. Microsoft 365 records mailbox activity in the unified audit log, and item-level access events (MailItemsAccessed) — once reserved for premium licensing — have been extended by Microsoft to standard tiers, though coverage depends on your license and configuration history. Where item-level events exist, we can list what was accessed and searched; where they do not, we reconstruct exposure conservatively from sign-ins, sync activity, and sent items, and the report states the confidence level explicitly.
We will not promise that, and you should be suspicious of anyone who does. Recalls are decided between your bank, the receiving bank, and law enforcement, and success drops sharply with every passing hour. What we do: help you move immediately — bank recall request, evidence for an IC3 (FBI Internet Crime Complaint Center) filing, message traces and timeline extracts your bank and investigators will ask for — prepared fast and documented properly. Recovery actions themselves belong to your bank and law enforcement.
Yes — in a support role. Your carrier and counsel lead the claim and the legal determinations, including whether the incident triggers breach-notification obligations. We produce what they need: the factual timeline, containment log, exposure summary, and evidence package, with the collection method documented. If your policy requires using a carrier-approved response panel, engage the carrier first and we will coordinate with whoever they appoint.
No, and we say that plainly. This is an operational investigation and recovery engagement: its job is to evict the attacker, establish what happened, and harden the tenant. We document our methods and preserve evidence carefully, and our output can be handed to a forensics firm — but bit-for-bit imaging, formal chain of custody, and expert-witness work are a different discipline that should be engaged through your counsel if litigation is anticipated.
The investigation identifies which external parties received attacker mail — recipients, messages, and send times — so the notification decision is made on facts rather than guesswork. We help you pull the affected-recipient list and draft the technical explanation of what happened; deciding whom to notify, and sending those communications, stays with you and your counsel, because notification carries legal and commercial judgment we should not make for you.
No. Containment is targeted at the accounts in scope: their sessions are revoked, their credentials reset, their attacker-registered MFA methods removed. Those users re-authenticate and keep working; the rest of the organization is not touched unless the investigation shows the compromise is wider. Every disruptive action is approved by your decision-maker before it runs.
Usually not, and this is the most common mistake we see. A password reset alone does not revoke existing sessions and refresh tokens, does not revoke app passwords, does not remove an authenticator app the attacker registered, and does not touch inbox rules, mailbox forwarding, delegate permissions, or OAuth applications the attacker consented to — any one of which keeps them reading your mail after the reset. The persistence hunt exists precisely because attackers assume you will change the password and stop there.
Yes, and the order matters. For the compromised account, MFA is re-registered as part of containment: attacker-added methods are removed, existing multifactor sessions are revoked, and the user re-registers on a call where you have verified who you are talking to — never through a link sent to the mailbox that was just compromised. For the rest of the tenant, the hardening plan almost always starts with MFA coverage, because an account without MFA is the usual way in, and Microsoft's own guidance for a compromised account ends with the same recommendation. Tenant-wide enforcement is its own engagement: Enable MFA for All Users rolls out authentication methods and mandatory MFA policies for every user, and Conditional Access Policy Implementation adds the sign-in conditions that make a stolen password useless on its own.
Often, yes. When a compromised account starts sending spam or phishing, Exchange Online Protection's outbound limits and spam detection can block the user from sending — mail still arrives, nothing goes out, and the user's messages bounce. The account then appears on the Restricted entities page in the Microsoft Defender portal (Email and collaboration, Review). Do not unblock it first: unblocking before sessions, password, MFA, rules, and consents are cleaned up hands the attacker a working mailbox again, and the restriction tends to come back. Once containment is done, an administrator unblocks the user there and sending usually resumes within about an hour. If you have Microsoft Defender for Office 365 Plan 2, the alert for a user restricted from sending email also opens an automated investigation whose recommended actions your team can approve; we review those alongside our own findings rather than relying on either alone. Unblocking is step 7 of the sequence above and is part of the engagement.
Four sources, in the order we use them. The Microsoft Purview audit log for the account — mailbox events such as MailItemsAccessed, Send, SearchQueryInitiated, New-InboxRule, and Set-Mailbox show what was read, searched, sent, and changed, where those events were recorded for the mailbox; Microsoft extended the item-level events to Purview Audit (Standard) during 2024, so most tenants hold some of them, at the time of writing. The Microsoft Entra sign-in logs, interactive and non-interactive, show when the attacker was in, from where, and through which application, for the 30 days kept with Microsoft Entra ID P1 or P2 (7 days without). Exchange Online message trace shows every message that left the mailbox, including ones the attacker deleted from Sent Items. The mailbox itself — Sent Items, Deleted Items, and the Recoverable Items folder — holds what the attacker did not manage to scrub. The engagement combines all four into the timeline and the exposure review. If your incident is already contained and what you need is that written account on its own, Microsoft 365 Post-Incident Investigation and Report is the read-only reconstruction with the formal report.
Yes. Microsoft Purview Audit (Standard), included with business and enterprise plans, retains 180 days of activity for events generated since October 2023, and Microsoft has extended previously premium item-level events to standard tiers. Sign-in log depth depends on your Entra ID license. The practical effect of lighter licensing is coarser detail in places, not an impossible investigation — and the report will distinguish what the logs prove from what they merely suggest.
The base engagement covers a defined per-incident scope — confirmed in your written quote before work begins — including containment, the persistence hunt, the audit-log timeline and exposure review, the evidence package, the hardening plan, and the handoff, typically within five business days. The low end of the range is a single compromised account with no lateral movement: one mailbox, no administrative role, no second account touched. What moves the price up: more compromised accounts, an administrator's account, longer attacker dwell time to reconstruct, or extension beyond Microsoft 365 into endpoints and other systems. Any change is a written, approved re-quote, and you pay after you approve delivery.
The engagement ends with a prioritized hardening plan — typically MFA coverage gaps, Conditional Access, legacy authentication, mail-authentication records, and alerting — with owners and order. Implementation is available as follow-on work: Microsoft 365 Security Baseline and Secure Score Remediation for tenant-wide hardening, Enable MFA for All Users and Conditional Access Policy Implementation for identity, DMARC, DKIM, and SPF Email Authentication Implementation so mail claiming to come from your domain is authenticated at the receiving end, Microsoft Defender for Office 365 Implementation for mail-borne threats, Defender XDR Incident Readiness and Automated Response so the next compromised account is seen and contained without waiting for a person, and Managed Detection and Response for continuous monitoring.