Remove Inbox Rule via Outlook Web Access
Go to Outlook Web Access
Log in to the Affected Mailbox with the user name and password
Go to Option > Rules and remove the infected rule
Remove Inbox Rule via PowerShell
Log in to the Exchange Online via PowerShell and run the following commands:
install-module ExchangeOnlineManagement
Connect-ExchangeOnline
From Remove-InboxRule -Mailbox "[email protected]" -Identity "affected rule name"
Suspend a user via Entra Admin Portal
Go to Entra Admin Center → Users → All users, find and select the user
Set Account Enabled = No (Block sign-in = Yes) under Edit properties, then Save
Password Reset via Microsoft Entra Admin Center
Go to Microsoft Entra Admin Center → Users → Find the affected user.
Click Reset Password → Choose the Reset password > Ensure you have the message “Password has been reset”
Save the new password temporarily in a secure location, such as a vault, for the next steps, and send it to the user
Password Reset via PowerShell
Connect first with Global Admin permissions
Connect-MgGraph -Scopes User.ReadWrite.All
Update-MgUser -UserId "[email protected]" -PasswordProfile @{ ForceChangePasswordNextSignIn = $true; Password = "Put Temporary Password } -Verbose
Reset MFA Settings via Microsoft Entra Admin Center
Entra Admin Center → Users → The required Users → Authentication Methods → Require re-registration of multifactor authentication
When the Require re-registration multifactor authentication pop-up message appears, choose OK
Then, the Require User Verification will run
Note: This will wipe all MFA registrations and force re-enrollment.
Reset Session via PowerShell
Revoke-MgUserSignInSession -UserId "[email protected]"
Revoke-MgUserSignInSession -UserId "[email protected]" -Verbose
Note: Wait for a message in PowerShell.
Re-enable the User Account via PowerShell
Update-MgUser -UserId "[email protected]" -AccountEnabled $true