Microsoft 365 Incident Response Runbook: First 60 Minutes After a Compromised Account (2026)

Field notes on the first sixty minutes of Microsoft 365 incident response: triage, containment, blast radius mapping, evidence preservation and communication.