Staff Email hacked how to reset from admin

You're dealing with a compromised Microsoft 365 mailbox where resetting the password and toggling block status did not restore safe access. That is expected if stolen sessions, added authentication methods, forwarding rules, or malicious app consent remain active. First block sign-in while you investigate. In Microsoft Entra, reset the password, require the user to register multifactor authentication again, remove unknown authentication methods, and revoke all sign-in sessions. In Exchange Online, inspect inbox rules, forwarding addresses, delegates, and outbound spam restrictions; remove anything unauthorized. Review Entra sign-in and audit logs to identify the source and scope, then scan the user’s devices before unblocking sign-in. If the account is listed under Restricted entities, remove it only after remediation. Also check sent items and notify affected contacts. If administrative access or recovery methods were changed, open a Microsoft 365 support case immediately rather than repeatedly resetting the password.