Microsoft 365 incident response runbook

An incident response runbook for Microsoft 365 is essential preparation for the day something bad happens — confirmed account compromise, suspected data exfiltration, ransomware, business email compromise. The runbook isn't a long document; it's a clear, step-by-step procedure that lets responders act fast without inventing process during a crisis.

The phases

Incident response in Microsoft 365 follows the standard SANS model — detection, triage, containment, eradication, recovery, lessons learned — with Microsoft-specific tooling at each phase.

Detection

How incidents surface:

• Defender XDR alerts — automatic detection from Defender for Office 365, Endpoint, Identity, Cloud Apps.
• User reports — "I think my account was hacked" via the IT support channel.
• External notification — partner or customer reports unusual email from a colleague.
• SIEM correlation — Microsoft Sentinel cross-source correlation.
• Audit log review — proactive hunting.

For high-fidelity sources (Defender XDR), automatic escalation to the SOC team is the right pattern. For user reports, a clear "report a security issue" path matters.

Triage

When an incident is reported, decide severity and scope quickly:

• Severity 1 — confirmed widespread compromise, ransomware in progress, major data exfiltration. All-hands response.
• Severity 2 — single confirmed compromise, contained but real impact. Standard response team.
• Severity 3 — suspicious activity, investigation needed. Single analyst.
• Severity 4 — informational, low confidence. Routine log review.

The triage call decides the resource allocation and communication posture for what follows.

Containment

Cut the attacker's access. Standard Microsoft 365 actions:

• Revoke session tokens for affected users — Revoke-MgUserSignInSession.
• Disable user accounts that are confirmed compromised.
• Reset passwords of affected users.
• Reset MFA methods that may have been registered by attacker.
• Isolate devices via Defender for Endpoint.
• Remove malicious OAuth consents the attacker granted.
• Disable any newly created mailbox rules (forwarding rules are a classic attacker move).
• Stop active sharing links if mass-share is part of the attack.

If Defender XDR Automatic Attack Disruption is enabled, much of this is automatic.

Eradication

Remove the attacker's footholds:

• Find every malicious artefact — files, scripts, scheduled tasks, accounts.
• Hunt for similar patterns across the tenant — sometimes one compromised user is the visible tip of broader compromise.
• Patch the entry point — phishing campaign? Update DLP, phish-resistant MFA, training.
• Block the attacker's infrastructure — IPs, domains, file hashes.

The Threat Explorer in Defender for Office 365 P2 and advanced hunting in Defender XDR are the right tools for cross-tenant hunting.

Recovery

Restore normal operations:

• Re-enable users with new strong credentials and fresh MFA registration.
• Recall malicious emails if they were sent — via Defender Soft Delete or AIR.
• Restore from Microsoft 365 Backup if files were encrypted or destroyed.
• Verify integrity of restored content.
• Communicate to users that the incident is contained.

Lessons learned

Within 1–2 weeks after closure:

• Root cause analysis — what specifically went wrong, what controls failed.
• What worked — what should we keep doing.
• What didn't work — gaps to close.
• New controls — Conditional Access tightening, training updates, monitoring gaps.
• Runbook updates — what would we do differently next time.

Without the lessons-learned discipline, the same incident happens again.

Communications

In every phase, communications matter:

• Internal IT — clear channel for responders to coordinate.
• Affected users — what happened, what they need to do.
• Leadership — status updates appropriate to severity.
• Customers / partners — if their data or interactions are affected.
• Regulators — if notification requirements apply.

Pre-define templates for severity 1 / 2 / 3 communications. During an incident is not the time to draft from scratch.

Tabletop exercises

Quarterly tabletop exercises with the response team are how you find weaknesses without paying for real incidents:

• Specific scenario — BEC, ransomware, insider threat.
• Walk through the runbook — who does what, when.
• Identify gaps — missing tooling, unclear roles, broken procedures.
• Update the runbook based on findings.

Practice matters. The team that practiced last quarter responds dramatically better than the team that hasn't done one in years.