Outlook account has been compromised

For a personal Outlook.com account, allow up to 24 hours for Sign out everywhere to invalidate browser and app sessions; the Microsoft Graph session-revocation cmdlet cannot be used with personal Microsoft accounts.^1^^2^

Complete the remaining containment checks

Since the password, malicious app, two-step verification, and global sign-out have already been handled, do not repeat those actions now.

1. Wait for the global sign-out to finish
   • Count 24 hours from when Sign out everywhere was selected.
   • During that period, avoid repeatedly deleting the extortion draft; an existing synchronized client may recreate it until its session is invalidated.
   • After 24 hours, delete the draft in Outlook.com and check whether it returns.
2. Review every remaining application permission
   • Open the Microsoft account Privacy area.
   • Go to Other privacy settings → Apps and services → Apps and services that can access your data.
   • Remove permissions for every app or service that is unknown or no longer needed—not only “Microsoft Graph Command Line Tools.” This is the personal-account location for managing apps with access to account data.^3^
3. Inspect mailbox persistence settings in Outlook.com In Outlook.com → Settings → Mail, review:
   • Rules: delete rules you did not create.
   • Forwarding and IMAP: disable unknown forwarding. If POP or IMAP is not intentionally used, turn it off.
   • Automatic replies: remove unauthorized content.
   • Junk email: remove unfamiliar blocked or safe senders.
   Microsoft’s compromised-account procedure specifically calls for checking connected accounts, forwarding, and automatic replies after unauthorized access.^4^ Outlook.com exposes POP and IMAP under Settings → Mail → Forwarding and IMAP.^5^
4. Check recent activity
   • Open the Microsoft account Recent activity page.
   • Expand suspicious entries and select This wasn’t me where offered.
   • Look particularly for:
     • Permission given to an application
     • Automatic sync
     • Successful sign-ins or security changes you do not recognize
   “Automatic sync” can represent Exchange ActiveSync, POP3, SMTP, or IMAP access. The activity page covers the previous 30 days, although it does not display every account event.^6^
5. Scan every device that accesses this mailbox On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends clearing malware before changing a compromised account’s password.^4^ If malware is found, remove it first and then change the password again from a clean device. That second change is necessary because the earlier password could have been captured on the infected device.

About direct token revocation

Revoke-MgUserSignInSession invalidates refresh tokens and browser session cookies, but its delegated permission is explicitly not supported for personal Microsoft accounts. It applies to organizational work or school accounts, so installing Graph PowerShell or consenting to another Graph tool is not an appropriate solution for this Outlook.com account.^2^

Escalate if drafts continue after 24 hours

While signed in to Outlook.com:

1. Select Help on the top menu.
2. Search for compromised account malicious drafts.
3. If the suggested articles do not resolve it, return to the Help pane, scroll to Still need help?, and select Yes.
4. In the request, state:
   • The OAuth app’s displayed name.
   • The date and time it was removed.
   • The date and time Sign out everywhere was initiated.
   • That drafts continue after the full 24-hour invalidation window.
   • Any suspicious Automatic sync or application-permission entries.

This is the documented Outlook.com support-by-email route for users who can still sign in.^7^ Support can investigate, but agents are not permitted to access or directly change account details.^6^

References

1. How to sign out of your Microsoft account everywhere | Microsoft Support
2. Revoke-MgUserSignInSession-Description
3. Where can I find privacy settings in Microsoft products? | Microsoft Support
4. How to recover a hacked or compromised Microsoft account | Microsoft Support
5. POP, IMAP, and SMTP settings for Outlook.com | Microsoft Support
6. Check the recent sign-in activity for your Microsoft account
7. How to get support for Outlook.com | Microsoft Support