How to tell if your business email was hacked (Microsoft 365)

By Greg Mitchell · Squared Away Tech · October 12, 2026

A hacked mailbox doesn’t always look hacked. Attackers who get into a Microsoft 365 account usually try to stay quiet for as long as possible, reading mail and waiting for a chance to redirect a payment. Here are the signs to watch for and the places to check if something feels off.

Warning signs people notice first

Someone asks about an email you didn’t send, such as an invoice, a shared document link, or a request to change bank details.
Replies or emails you expected never arrive, especially from clients, vendors or your bank.
You get MFA prompts or codes you didn’t ask for. That can mean someone already has your password.
A flood of bounce-back or “undeliverable” messages for emails you never wrote.
Microsoft blocks you from sending because the account was flagged for sending spam.
Your contacts report a phishing email from you, often a fake “shared file” or voicemail link.

Where to check in Outlook

Inbox rules. In Outlook on the web, go to Settings, Mail, Rules. Look for rules you didn’t create, especially ones that forward, delete, or move mail into folders like RSS Feeds, RSS Subscriptions, Archive or Conversation History. Rules with odd names, like a single dot or letter, are a classic sign.
Forwarding. Under Settings, Mail, Forwarding, make sure forwarding isn’t on unless you set it.
Sent Items and Deleted Items. Look for messages you didn’t send, and for sent messages that were deleted to hide them.
Signature and automatic replies. Look for changes you didn’t make.

Where to check your account

Security info. At mysignins.microsoft.com, review your MFA methods. An extra phone number or authenticator app you don’t recognize means someone set up a way back in.
Recent sign-in activity. The same site shows recent sign-ins. Sign-ins from places you’ve never been are worth a closer look, but keep in mind locations are approximate and phones on mobile data can show up in unexpected cities.
Connected apps. Look for apps that were granted access to your mailbox that you don’t recognize.

What an administrator can check

If you manage the Microsoft 365 tenant, or someone does it for you, there’s more to look at:

Sign-in logs in Microsoft Entra ID, including failed and successful sign-ins and whether MFA was used.
Risky sign-in and risky user reports, if your licenses include them.
Message trace, to see what the account sent and to whom.
The audit log, for rule changes, permission changes and mailbox access.
Alerts from Microsoft Defender, such as suspicious inbox rules or unusual sending.

If you find something

Don’t just delete the rule and move on. If you have cyber insurance, call your carrier first, since many policies want early notice. Then reset the password, sign the account out of all sessions, remove unknown MFA methods, and document what you found before you clean it up. The full step-by-step plan is in What to do if a Microsoft 365 account is hacked.

Warn people by phone if money is involved. If fake payment instructions may have gone out, call the clients or vendors who might have received them, using a number you already have.

How to make it less likely

Multi-factor sign-in for every account, blocking automatic forwarding to outside addresses, and DMARC on your domain stop most of the attacks that small offices see. A Microsoft 365 Security Checkup reviews all of these settings, read-only, and gives you a plain-English list of what to fix. If you think an account is compromised right now, Compromised Account Cleanup covers containment, the tenant check and a written summary. Or start with the free 20-minute checkup call below.

Free checklist: Is your Microsoft 365 safe?

A one-page, 10-point checklist for small offices: sign-ins, admin accounts, email forwarding, backups and more. Enter your email and the download link opens right away.

Want a second set of eyes? Greg offers a free 20-minute checkup call at your Microsoft 365 sign-in and email forwarding settings. No cost, no obligation. Call or text (941) 479-1075 or email greg@squaredawaytechfl.com.

Book a free 20-minute checkup call

Prefer to check it yourself first? Get the free 10-point Microsoft 365 checklist.

Squared Away Tech serves offices of 5 to 100 people in the Tampa Bay and Sarasota area (Bradenton, Sarasota, Tampa, Ellenton, Lakewood Ranch, St. Petersburg, Palmetto, Venice and Parrish), serving small offices across Florida, and remotely anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different.