Staff Email hacked how to reset from admin

A password reset alone may not be enough—the attacker could still have an active session, an added authentication method, or a forwarding rule. Since you’ve already tried resetting it, keep the account blocked while you check those.

1. Block sign-in and revoke sessions. In the Microsoft 365 admin center, go to Users > Active users, select the employee, and block sign-in. In the Entra admin center > Users > affected user, use Revoke sessions. Revocation may not take effect instantly in every app.
2. Reset the password and secure MFA. Set a new, unique password. Under Authentication methods, remove any methods the employee doesn’t recognise and require MFA re-registration. Verify the employee’s identity through a trusted channel before giving them new access details.
3. Check the mailbox for persistence. In Exchange admin center, review forwarding and mailbox delegation. Also inspect inbox rules for anything that forwards, deletes, or hides messages. Review the user’s recent Entra sign-in logs and unfamiliar application permissions.
4. Restore access only after cleanup. Have the employee use a trusted, updated device and register their own MFA method. Then unblock sign-in. If Microsoft separately blocked outbound mail, remove the user from Restricted entities in Microsoft Defender only after securing the account.

If it still fails, the exact symptom matters: can’t sign in, can’t send mail, or suspicious activity continuing require different fixes. Open a support request through Microsoft 365 admin center > Help & support with the error message and the time of the failed attempt. If your users sync from on-premises Active Directory, also check whether the password must be reset there.