Microsoft Detection and Response Team (DART) AMA

I have a customer who lost their global admin and also lost access to email and M365 functions. This is a university. The customer has opened up the CA to allow global access, which is not desirable. The original ticket 2307300040000701 was rejected, however as a university the customer has not been able to operate. The customer did notice that a new global admin was created, shortly before the issues started to occur and they are not aware of the person. I am reaching out for help to firstly get the customer back to a secure state, and will provide some education with the current admin arrives back from vacation. He is in the office until 1700 Central today.