Microsoft 365 Account Takeover: Detection and Investigation Guide

Microsoft 365 account takeover happens when an attacker gains control of a user's cloud identity and uses it to read mail, move money, impersonate the user or reach other systems. It is the foundation of most business email compromise (BEC). This guide explains what to look for and how to reconstruct what happened.

This is an educational guide to the investigation method. It does not describe specific product integrations.

Signals to Investigate

Sign-ins

• New country, ASN or hosting provider IP addresses.
• Legacy authentication protocols that bypass MFA.
• Token or session reuse from a different location than the original sign-in.
• Unfamiliar user agents or device IDs.

MFA activity

• Repeated push prompts in a short period (MFA fatigue).
• A new MFA method registered, especially soon after a risky sign-in.
• MFA method removed or phone number changed.

Mailbox changes

• Inbox rules that delete, move or mark as read messages containing words like "invoice," "payment" or "wire."
• External forwarding rules or SMTP forwarding.
• New delegate access or app consent grants.

Data access

• Unusual volume of mail reads or file downloads.
• Searches for finance or HR terms.

Reconstructing the Account's Activity

Build a single timeline for the account across sign-in logs, audit logs and mailbox audit records. Normalize all timestamps to UTC. The goal is to establish the first malicious action, the scope of access and whether the attacker still has access (active sessions, tokens, registered MFA methods, app consents).

A Chronological Case (Synthetic Data)

All names and events are synthetic.

Time (UTC)	Event	Suspicious?	Benign explanation to check
Mon 07:45	a.visser signs in from Utrecht, usual device	No	—
Mon 11:20	Sign-in from Lisbon, new browser	Possibly	User travelling? Check calendar and HR travel records
Mon 11:21	6 MFA pushes in 90 seconds, last one approved	Yes	User confused by a broken app? Ask the user
Mon 11:24	New authenticator app registered	Yes	User replacing a phone? Check IT tickets
Mon 11:30	Inbox rule: messages containing "invoice" → Archive, mark read	Yes	User organizing mail? Unlikely given timing
Mon 11:42	340 messages read in 8 minutes	Yes	Search indexing? Check client type
Mon 14:05	Reply sent to supplier with changed bank details	Yes	—

Benign checks performed: The user was in Utrecht all day (badge records). No IT ticket for a phone replacement. The user did not recall approving a prompt.

Conclusion: Account takeover via MFA fatigue, followed by BEC preparation. Open question: Was the password obtained through phishing or reuse from another breach?

Legitimate Explanations to Rule Out

• Travel, confirmed through calendar, HR or expense records.
• VPN or proxy use, including privacy relays on mobile devices.
• Authorized administration, such as an IT admin configuring a mailbox.
• New device setup that legitimately registers a new MFA method.

Unusual is not the same as malicious. Each suspicious event should be weighed against these explanations before escalation.

Evidence Needed to Escalate

Escalate a suspected compromise when you have at least one strong indicator (for example, a concealment inbox rule or external forwarding after a risky sign-in) or several moderate indicators in a coherent sequence, and the obvious benign explanations have been checked.

Containment Steps (for Human Approval)

1. Revoke all sessions and refresh tokens.
2. Reset the password and review registered MFA methods.
3. Remove malicious inbox and forwarding rules.
4. Review and revoke suspicious app consents.
5. Notify contacts who may have received fraudulent mail.

Key Takeaways

• Look across sign-ins, MFA, mailbox changes and data access together.
• Build one timeline and identify the first malicious action and remaining access.
• Always test travel, VPN and admin explanations before concluding.

Related reading: Automated Threat Investigation, Behavioral Threat Detection and Explainable AI in Cybersecurity.