our account is under attack causing us to no longer be able to login to outlook etc.

We have already tried the generated answers

Hi Spectrum Security,

In this case, is it the Global Administrator that's being attacked? In this scenario, I would take the following actions:

1. Reset the password for your Global Administrator account again.
2. Within the Entra ID Admin Center, revoke all active sessions. Find the user in question, and select "Revoke sessions" along the top of the page.
3. Sign back in using your new password, and check to ensure no new multifactor authentication methods have been added to your account. If they have, remove them.

I hope this advice helps!

Hi @Spectrum Security 

Thank you for posting your question in the Microsoft Q&A forum.        

It appears your account is experiencing repeated sign-outs even after multiple password resets, which strongly suggests that your account may have been compromised. 

To help you regain control and prevent further unauthorized access, please follow these detailed steps: 

1/ Review recent activity 

• Sign in to Microsoft Account Security. 
• Check Recent Activity for unfamiliar sign-ins, locations, or devices. 
• If you see anything suspicious, select “Look unfamiliar? Secure your account”. 
• Click on Yes 
• You will navigate to Microsoft Security page and select Sign out everywhere. 
• This will invalidate all active sessions across devices and apps, forcing reauthentication with your new credentials. 

2/ Reset password and enable MFA 

• Reset your password immediately using a strong, unique password that you haven’t used elsewhere: 
• Go to Security info tab > Choose Change at Password (preview) 
• Enable Multi-Factor Authentication (MFA) for added protection. MFA ensures attackers cannot access your account even if they know your password. 
• You can learn how to enable MFA at here: Set up multifactor authentication for users - Microsoft 365 admin | Microsoft Learn 

3/ Sign out everywhere 

• Go to My Sign-Ins | Security Info | Microsoft.com and select Sign out everywhere. 
• This will invalidate all active sessions across devices and apps, forcing reauthentication with your new credentials. 

4/ Check for suspicious rules in Outlook 

• Sign in to Outlook on the web. 
• Click the Settings (gear icon) in the top-right corner. 
• Go to Mail > Select Rules
• Review all rules listed. 
• Delete any unfamiliar or suspicious rules (e.g., rules that forward emails to unknown addresses). 
• Go to Mail > Forwarding:  
• Check if forwarding is enabled. 
• Remove any forwarding addresses you did not set up. 

For more detailed guidance, please refer to these official Microsoft resources: 

• Recover a hacked or compromised Microsoft account 
• Responding to a compromised Microsoft 365 email account 
• Address compromised user accounts with automated investigation and response 
• Token Theft Playbook 

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.    

Thank you for your patience and your understanding. If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you. 

I look forward to continuing the conversation. 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.