Incident Response

What Happens in the First 24 Hours of a Microsoft 365 Breach

Black Tower Cyber Incident Response 10 min read

The phone call comes at different times. Sometimes it is a Monday morning when someone notices emails they never sent sitting in their outbox. Sometimes it is a Friday afternoon when a client calls asking about a wire transfer your firm never authorized. Sometimes it is a weekend, because attackers do not take weekends off.

What happens next matters more than most people realize. The decisions made in the first few hours after a Microsoft 365 breach are discovered directly determine how bad the outcome is — how much was accessed, how long the attacker was inside, whether the breach was isolated or has spread, and what the path to recovery looks like.

This is a walkthrough of what we actually do when we respond to a Microsoft 365 breach. Not a theoretical framework. Not a vendor whitepaper. What happens on a real engagement, hour by hour.

Before we start: If you are reading this because something is happening right now, stop and call us directly at 203-558-8645. Do not reset passwords yet. Do not revoke sessions yet. Do not wipe anything. Read this later.

Hour 0 — The First Call

The first call is always triage. Before we touch anything inside your environment, we need to understand what you know, what you have already done, and what is still actively happening.

The questions we ask on that first call are not bureaucratic. They determine what we do first:

  • When was the suspicious activity first noticed, and by whom?
  • Has anyone changed passwords or revoked sessions already?
  • Is there an active wire transfer or financial transaction in progress?
  • Are there other accounts or systems that may also be compromised?
  • What does your IT provider know, and what have they done so far?

The answers to these questions shape everything that follows. If someone has already reset the compromised account password without preserving the session tokens, that changes what forensic data is still available. If there is an active wire transfer in flight, that becomes the immediate priority over everything else.

Phase 1
Hours 0 to 1

Access and Initial Assessment

We get access to your Microsoft 365 tenant through the Security and Compliance portal, Entra ID, and the Microsoft 365 Defender console. We need Global Reader access at minimum, and Global Admin access if active containment is required. We start pulling sign-in logs, audit logs, and mailbox activity within minutes of getting credentials.

Hours 1 to 3 — Determining the Scope

The most dangerous assumption you can make after discovering a compromised account is that only one account was compromised. In our experience, by the time an attacker is doing something visible — like sending fraudulent emails or creating inbox rules — they have often already been in the environment for days or weeks.

During the first few hours, we are trying to answer four questions:

  • How did the attacker get in? Phishing, password spray, exposed credentials from a third-party breach, or a malicious OAuth application are the most common entry points in Microsoft 365.
  • How long have they been inside? Sign-in logs in Microsoft 365 go back 30 days by default. If the compromise is older than that, we may need to pull data from other sources.
  • What did they access? Email, SharePoint, OneDrive, Teams — we check all of them. Attackers who have been inside for weeks often do reconnaissance across multiple data sources before taking action.
  • Are they still active? Active sessions, recently registered MFA devices, and inbox rules that are still forwarding mail are all indicators that the attacker has not been fully removed.
Phase 2
Hours 1 to 3

Containment

Once we have enough picture of the scope, we move to containment. This means revoking active sessions on compromised accounts, removing malicious inbox rules, blocking attacker IP addresses where possible, disabling any OAuth applications the attacker may have registered, and beginning a guided credential reset process for affected accounts. We do this in a specific order to avoid tipping off an attacker who may still be watching.

Hours 3 to 12 — The Investigation

Containment stops the bleeding. The investigation tells you how bad the wound was.

This is the part of incident response that most IT providers are not equipped to do. It requires access to Microsoft 365 audit logs at a level most organizations have never configured, knowledge of what attacker behavior actually looks like in those logs versus normal user activity, and time to work through thousands of events systematically.

What we are building during the investigation is an attacker timeline — a chronological reconstruction of everything the attacker did from the moment they first gained access to the moment they were contained. This timeline is not just for our own understanding. It is what your insurance carrier will ask for, what your attorney will need if there is a notification obligation, and what leadership needs to understand the full scope of the incident.

  • When exactly did the attacker first authenticate?
  • Which emails did they read, and over what time period?
  • Did they access SharePoint or OneDrive? Which files?
  • Did they communicate with external parties using your accounts?
  • Did they create any forwarding rules, delegate access, or register new devices?
  • Were any other accounts in the tenant used or accessed from the same infrastructure?
Phase 3
Hours 3 to 12

Forensic Investigation

We work through the Microsoft 365 Unified Audit Log, Entra ID sign-in logs, mailbox audit logs, and where applicable, Microsoft Defender for Office 365 data. We pull this into a structured timeline and begin correlating attacker activity across accounts, timestamps, and IP addresses. When something does not add up — an action that happened before the first known sign-in, or activity from an IP we have not seen before — we dig deeper.

Hours 12 to 24 — Hardening and the Path Forward

Once the investigation has reached a point where we have a clear picture of the incident scope, we shift into hardening — making sure the same attack cannot happen again.

The entry point that allowed the initial compromise is the first thing to close. If it was legacy authentication, we block it. If it was a weak or reused password with no MFA, we enforce MFA across the tenant with Conditional Access. If it was a phishing email that bypassed your current mail filtering, we review and tighten those controls.

We also implement the visibility controls that most Microsoft 365 environments are missing — the ones that would have caught this attack earlier or made it easier to investigate:

  • Mailbox audit logging enabled and retention extended to 90 days
  • Inbox rule creation alerts configured in the Security and Compliance center
  • Sign-in anomaly alerts enabled for impossible travel and unfamiliar locations
  • External mail forwarding blocked at the tenant level
  • Global admin count reduced to what is actually necessary
Phase 4
Hours 12 to 24

Hardening and Recovery

We implement the controls needed to close the attack vector and improve detection going forward. We walk your team through what changed and why, and we verify that no attacker persistence mechanisms remain — no forwarding rules still active, no delegated mailbox access still in place, no OAuth applications still authorized. The environment is not handed back until we are confident the threat has been fully eradicated.

After 24 Hours — The Report

Every engagement we handle ends with a written incident report. Not a one-page summary — a full forensic document that includes the confirmed timeline of attacker activity, the entry point and how it was exploited, every system and account that was accessed, every action the attacker took inside the environment, the containment actions we took and when, and the hardening changes implemented.

This report serves multiple purposes. It is the document your cyber insurance carrier will use to evaluate the claim. It is what your attorney needs to determine whether breach notification is required under state or federal law. It is what leadership needs to brief partners, clients, or regulators if that conversation becomes necessary.

It is also the document that, frankly, forces a real conversation about security posture — because seeing exactly what an attacker was able to do inside your environment, and for how long, makes the case for proactive controls better than any sales pitch could.

What Most Organizations Get Wrong

The most common mistake we see is waiting. A partner notices something strange on a Monday and decides to wait until the IT company's regular Tuesday visit to mention it. By then, another 24 hours of attacker access has occurred. An attorney gets an email from a client asking about a wire transfer and assumes it is a misunderstanding — it is not.

The second most common mistake is doing too much too fast without guidance. Resetting passwords without revoking sessions means the attacker's active session stays alive even after the password is changed. Wiping a device before forensics are done destroys evidence that may be needed for insurance or legal purposes. Notifying clients before the scope is understood means potentially having to send a second, worse notification when more is discovered.

The first 24 hours are high stakes. The decisions you make — or do not make — in that window determine a significant portion of the outcome.

Active incident or just want to be prepared?

We respond to Microsoft 365 breaches and help firms harden their environments before an attack happens. Direct response from the engineer who will handle your case.

Call 203-558-8645