How to fix a hacked/compromised Microsoft Office 365 user account in 10 STEPS|User Account Security|
10 STEPS to take when an O365 user account is hacked/compromised.
1. RESET ACCOUNT PASSWORD
2. SIGN OUT ALL SESSIONS
3. REMOVE THE ACCOUNT FROM ALL ADMIN ROLES.
4. RE-ENROLL (ENFORCE) MFA
5. CHECK FOR ENTERPRISE APPS AUTHORIZED FOR THE USER
6. SCAN DEVICES FOR MALWARE
7. REVIEW MAILBOX RULES AND FORWARDING
8. REVIEW AUDIT LOGS FOR ANY OTHER UNUSUAL ACTIVITY
9. REVIEW EMAIL APPS AND CHANGE AVAILABILITY
10. REVIEW SIGN-IN LOGS AND CHECK FOR ADDITIONAL SECURITY MEASURES YOU CAN TAKE