Compromised Account
A practical Microsoft 365 compromised account SOP covering triggers, triage, containment, investigation, remediation, prevention, evidence, ownership and escalation.
Entra ID · Security
← Back to the knowledge base
CODWEBPRO / Microsoft 365
Procedures
Clear, verifiable and reusable operating procedures for Microsoft 365 tasks that should never depend on one person’s memory.
1 Published guides2 Drafts for technical review4 Planned topics
Search all guides, including clearly marked review drafts. Try MFA, deleted file or access denied.
Published guides
Drafts for technical review
These guides are available to review. Tenant validation is pending.
Investigate Suspicious Sign-ins
A practical draft SOP for investigating a suspicious Microsoft 365 sign-in, preserving evidence, and deciding whether to start compromised-account response.
Entra ID · Security
Recover a deleted or overwritten OneDrive file
Choose the narrowest recovery method, check the available history and verify the correct file without undoing unrelated work.
OneDrive · Recovery
Planned topics (4)
These are topics to develop, not usable guides or running tools.
- Mailbox migration with a rollback plan
A controlled sequence to prepare, execute and validate the migration while keeping a documented return path.
- Onboard a new administrator
Assign roles, access and responsibilities using least privilege and a final validation checklist.
- Handle a lost corporate device
Block access, assess risk and choose the right remote action while keeping a complete record.
- Prepare a tenant for a merger
Capture dependencies, domains, identities and workloads before building the technical consolidation plan.
Need help applying this to your tenant?
Share a short description. We can scope technical support, documentation or a licensing review.