Tools · Incident response playbooks · 14 / 20
Playbook: compromised user account in Entra ID or Google Workspace
Confirm account compromise from sign-in evidence, contain it with session revocation and credential reset, remove attacker persistence, and scope access to data and apps.
Confirm
Evidence of compromise includes successful sign-ins from unfamiliar locations or networks, sign-ins right after a phishing click, MFA prompts the user did not initiate, new MFA methods, or actions the user denies. Speak with the user through a separate channel, such as a phone call to a known number, not by email to the possibly compromised account.
Contain
Disable the account or block sign-in if the attacker is active. Reset the password, revoke all sessions and refresh tokens, and remove unrecognized MFA methods. Check registered devices, app passwords, OAuth grants, and mailbox rules. Then re-enable the account with fresh MFA registration done in person or via a verified process.
# Microsoft Graph PowerShell (lab tenant) Update-MgUser -UserId j.doe@contoso.example -AccountEnabled:$false Revoke-MgUserSignInSession -UserId j.doe@contoso.example Get-MgUserAuthenticationMethod -UserId j.doe@contoso.example Get-MgUserOauth2PermissionGrant -UserId j.doe@contoso.example # Google Workspace (GAM, lab domain) gam update user j.doe@example.org suspended on gam user j.doe@example.org signout gam user j.doe@example.org show tokens
Lab: rehearse containment
In a developer tenant, sign in as a test user from a second browser profile, register an extra authenticator method, and consent to a test OAuth app. As the administrator, find each artifact, remove it, revoke sessions, and confirm the second browser session is forced to sign in again. Time how long each step takes to propagate.
Scope
Review what the account accessed during the compromise window: files downloaded or shared from OneDrive, SharePoint, or Drive, messages read or sent, admin actions if the user had roles, and apps signed into with single sign-on. Check whether the attacker used the account to phish colleagues internally.
Diagram
Persistence to remove
A password reset alone is not enough.
- Sessions and tokens
Revoke all; attackers reuse refresh tokens.
- MFA methods
Remove unknown phones and authenticators.
- OAuth grants
Remove consents to unfamiliar apps.
- Mail rules and forwarding
Delete rules that hide or forward mail.
- App passwords and devices
Remove legacy app passwords and unknown devices.
Check yourself
1. How should you contact a user whose email account may be compromised?
2. Which artifact lets an attacker keep mailbox access after a password reset?
3. What should be checked after containment to scope impact?