BEC Response: What to Do in the First Hour (Microsoft 365)
The first hour after a Microsoft 365 business email compromise: stop the money, keep the logs, revoke sessions and remove persistence, in the right order.
This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Microsoft 365, Microsoft Entra ID, Exchange Online and Microsoft Purview are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.
The first hour after a Microsoft 365 business email compromise: stop the money, keep the logs, revoke sessions and remove persistence, in the right order.
How to spot an illicit OAuth consent grant in the Unified Audit Log and Entra audit logs, which scopes matter, and how to remove the app's access.
How to analyze Entra ID sign-in logs in a BEC case: key fields, error codes, impossible travel and its false positives, spray, MFA fatigue, legacy auth.
How AiTM phishing steals Microsoft 365 sessions despite MFA, and how to detect the token replay in Entra ID sign-in logs and the Unified Audit Log.
Step-by-step export of the Purview Unified Audit Log and Entra ID sign-in and audit logs for a BEC case: roles, row limits, PowerShell paging, pitfalls.
How to investigate business email compromise in Microsoft 365: which logs to pull, what to look for in each, how to tie actions to the attacker's session.