Microsoft Purview Audit

Compromised Microsoft 365 account runbook: contain, investigate, recover

A step-by-step runbook for a confirmed Microsoft 365 account takeover: disable and revoke, remove attacker persistence, scope the breach with audit logs and restore the user safely.