Preventing Account Compromise in Microsoft 365: MFA Enforcement and Auto-Forwarding Protection
This article outlines how to identify such compromises and implement Microsoft-recommended remediation steps — including enforcing MFA via Conditional Access and blocking external auto-forwarding at the tenant level.
🔍 Symptoms
⚠️ What You May Experience
- Multiple suspicious sign-ins detected in Entra ID sign-in logs
- Unfamiliar IP addresses and geographic locations in authentication logs
- Sudden spike in outbound email volume from affected accounts
- Inbox rules or mailbox forwarding configured to external recipients
🧠 Root Cause
Why accounts get compromised
- Lack of Multi-Factor Authentication (MFA) — allows attackers to access accounts using stolen credentials alone
- Malicious inbox rules or forwarding settings — created post-compromise to exfiltrate data or relay spam
- No restriction on auto-forwarding — enables bulk email abuse without detection at the tenant level
⚠️ Attack Pattern
Attackers typically use credential phishing or password spray attacks to gain initial access, then configure persistence mechanisms — such as inbox forwarding rules — to maintain access and exfiltrate data silently.
🛠️ Step-by-Step Resolution
Identify Compromised Accounts (Microsoft Entra ID)
Review sign-in logs to detect suspicious authentication activity before taking remediation action.
✅ GUI Method — Microsoft Entra Admin Center
- Navigate to Microsoft Entra Admin Center → Sign-in logs
- Filter by: Risky sign-ins and Unknown locations / IPs
- Identify and note all affected user accounts
Enable MFA for All Users
Enforce MFA via Conditional Access — the Microsoft-recommended approach for all tenant sizes.
✅ GUI Method — Microsoft Entra Admin Center
- Go to Microsoft Entra Admin Center → Protection → Authentication Methods
- For small tenants: enable Security Defaults
- For larger tenants: configure a Conditional Access Policy — Require MFA for all users, exclude break-glass accounts
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Directory.ReadWrite.All" $policy = @{ displayName = "Require MFA for All Users" state = "enabled" conditions = @{ users = @{ includeUsers = @("All") } } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } New-MgIdentityConditionalAccessPolicy -BodyParameter $policy
Remove Malicious Inbox Rules and Forwarding
Clean up any forwarding rules or inbox rules created by the attacker post-compromise.
✅ GUI Method — Exchange Admin Center
- Go to Microsoft 365 Admin Center → Users
- Select the affected user → Mail → Manage email apps/settings
- Remove any forwarding addresses and suspicious inbox rules
Connect-ExchangeOnline # Check forwarding Get-Mailbox -Identity user@yourdomain.com | Select ForwardingSmtpAddress,DeliverToMailboxAndForward # Disable forwarding Set-Mailbox -Identity user@yourdomain.com -ForwardingSmtpAddress $null -DeliverToMailboxAndForward $false # List inbox rules Get-InboxRule -Mailbox user@yourdomain.com # Remove suspicious rule Remove-InboxRule -Mailbox user@yourdomain.com -Identity "YourRuleName"
Block External Auto-Forwarding at Tenant Level
Prevent any user from auto-forwarding emails externally by configuring an outbound anti-spam policy.
💡 Why This Matters
Without a tenant-level block, any compromised account can silently forward all received emails to an external address — a common data exfiltration technique.
Connect-ExchangeOnline # Create anti-spam outbound policy New-HostedOutboundSpamFilterPolicy -Name "Block External Forwarding" -AutoForwardingMode Off # Apply the policy New-HostedOutboundSpamFilterRule -Name "Apply Block Forwarding Policy" -HostedOutboundSpamFilterPolicy "Block External Forwarding"
Reset Credentials and Revoke Sessions
Force a password reset and invalidate all active sessions for compromised accounts immediately.
Connect-MgGraph -Scopes "User.ReadWrite.All" # Reset password Update-MgUser -UserId user@yourdomain.com -PasswordProfile @{ Password = "TempP@ssword123!" ForceChangePasswordNextSignIn = $true } # Revoke all active sessions Revoke-MgUserSignInSession -UserId user@yourdomain.com
✅ Expected Outcome
The user will be signed out of all devices and apps immediately. They will be required to set a new password on next sign-in and complete MFA registration before regaining access.
💡 Best Practices & Recommendations
- Enforce MFA using Conditional Access for all users — apply stricter policies (phishing-resistant MFA) for admin accounts
- Disable external auto-forwarding by default at the tenant level to prevent silent data exfiltration
- Regularly monitor Entra ID sign-in logs and mailbox audit logs for anomalous activity
- Implement Microsoft Defender for Office 365 anti-phishing and Safe Links policies for enhanced protection
- Enable Mailbox Audit Logging to capture inbox rule creation and forwarding changes for all users
✅ Key Takeaway
The most effective defence against account compromise in Microsoft 365 is a two-layer approach: enforce MFA so stolen credentials alone cannot grant access, and block external auto-forwarding so that even a compromised account cannot be used to exfiltrate data silently.
📚 References & Further Reading
- 🔗 Get started with MFA in Microsoft Entra — Microsoft Learn
- 🔗 Require MFA for all users — Conditional Access — Microsoft Learn
- 🔗 Outbound spam controls in Exchange Online — Microsoft Learn
- 🔗 Manage inbox rules in Exchange Online — Microsoft Learn