When a mailbox is compromised, the response cannot stop at “reset the password.” Modern phishing often involves stolen sessions, attacker-controlled MFA, inbox rules, forwarding, OAuth consent, and cloud tokens. This guide breaks down what each remediation action does, how fast it takes effect, and what bad looks like before and after containment.
Phishing remediation works best when detection signals are mapped directly to containment actions.
Each action targets a different layer: sessions, credentials, and MFA persistence.
Invalidates refresh tokens and forces active cloud sessions to re-authenticate. This is the fastest way to interrupt active attacker mailbox access.
Blocks future authentication with the stolen password. In cloud-first response, this should be paired with session revocation.
Removes existing MFA methods and forces re-registration. This is critical when the attacker may have registered their own Authenticator app, phone method, or passkey.
In hybrid environments, where you reset the password determines how fast cloud access is actually controlled.
| Remediation Area | On-Prem Active Directory Reset | Entra ID Reset |
|---|---|---|
| Primary impact | Domain logons, VPN, Kerberos, NTLM, legacy applications. | Microsoft 365, cloud apps, Entra-authenticated services. |
| Cloud effect | Delayed until password hash sync or identity sync completes. | Immediate for cloud authentication attempts. |
| Active cloud sessions | Not killed by the password reset alone. | Not fully killed unless sessions are revoked. |
| Best use during phishing | Important for hybrid cleanup, but weak as the only action. | Best for immediate cloud containment when paired with session revocation. |
| Common failure | Responder resets AD password only and attacker keeps using a valid cloud session. | Responder resets cloud password but forgets MFA methods or inbox persistence. |
Use the detection signal to decide which remediation action is required.
Indicates potential token reuse, AiTM activity, or impossible travel behavior.
SigninLogs
| where ResultType == 0
| summarize Count = count() by UserPrincipalName, Location, bin(TimeGenerated, 5m)
| where Count > 3Action: Revoke sessions immediately. Reset password if credential compromise is suspected.
Indicates mailbox recon, data access, or automated message review after compromise.
OfficeActivity
| where Operation == "MailItemsAccessed"
| summarize AccessCount = count() by UserId, bin(TimeGenerated, 5m)
| where AccessCount > 50Action: Revoke sessions and reset password. Review message access scope.
Indicates mailbox persistence, hiding security messages, auto-delete rules, or external forwarding preparation.
OfficeActivity
| where Operation == "New-InboxRule"Action: Remove malicious rules, reset MFA, revoke sessions, and reset password.
Indicates the compromised account may be actively sending phishing or invoice-fraud messages.
OfficeActivity
| where Operation == "Send"
| summarize SentCount = count() by UserId, bin(TimeGenerated, 5m)
| where SentCount > 100Action: Full containment: revoke sessions, reset password, reset MFA, and inspect sent items.
Before remediation, the account may still look “valid” because the attacker is using real authentication paths.
The order matters because each step closes a different door.
Invalidate refresh tokens and force re-authentication. This interrupts active attacker access to Outlook, OWA, Teams, SharePoint, and other cloud sessions.
Block future authentication with the stolen credential. In hybrid, make sure the reset path aligns with the source of authority and sync behavior.
Remove attacker-controlled MFA methods and force clean re-registration. This is especially important after AiTM or suspicious MFA registration activity.
Delete malicious inbox rules, disable external forwarding, review delegates, inspect sent items, and remove unauthorized OAuth app consent.
Confirm failed attacker sign-ins, no new mailbox access spike, no new outbound phishing, and normal user re-authentication from expected locations and devices.