⏰ Support Available: Mon-Fri 4:00pm-6:00am | Weekends 24/7
Microsoft 365 emergency support
Compromised mailboxes, admin lockouts, ex-staff who still have access, cutovers that have gone sideways. Remote, tonight, by someone who has seen it before.
Call now0403 401 250$165 per hour, GST inclusive, billed from when work starts rather than when you call. The call itself is free.
Which one is it?
Not on the list? Call anyway. Most of what comes in at night is one of these four wearing a different hat.
A mailbox is compromised and sending to your clients
Containment first, explanation second. Every minute spent working out how they got in is a minute the account is still sending.
In the next five minutes, before anyone connects
- Do not delete anything. The evidence you need is in that mailbox.
- Change the password for that account, from a different device.
- Tell your team not to action any payment or bank detail change that arrived today until it is confirmed by phone.
- Warn anyone who has been emailed, by phone or text rather than by replying to the thread.
What I do on connecting
- Revoke every active session, so a stolen sign-in token stops working. A password change alone does not do this.
- Find and remove the inbox rules hiding the attacker’s replies. There are almost always rules, usually filing to an obscure folder or straight to deleted items.
- Check forwarding, delegate access, app passwords and any apps the account has consented to.
- Check whether other accounts sent anything, and whether your domain itself is being spoofed from outside.
- Then work out how they got in, and close it.
Locked out, or the MFA device is lost, broken or wiped
This one deserves an honest answer rather than a reassuring one, because how fast it goes is decided by things that were set up months ago.
What makes it fast
- A second account that also holds Global Administrator. There is often one nobody remembers.
- A second multi-factor method registered on the account: another phone number, an authenticator on a different device, a hardware key.
- Recovery codes, if any were ever saved.
What makes it slow, and what I do
- One administrator account, one multi-factor method, on a device that is gone. That is the slow path.
- From there it becomes Microsoft’s own account recovery, which needs identity documents and takes days, sometimes longer. Nobody can shorten that, and anyone telling you they can is guessing.
- What I can do is establish quickly which path you are on, work every alternative method registered on the account first, and if it does come to Microsoft, prepare the submission properly so it is not rejected and started again.
- Afterwards, break-glass accounts get set up so this cannot happen twice.
Someone has left and still has access tonight
A password reset on its own is not enough, and this is the single most common mistake. An existing session keeps working after the password changes.
Right now
- Do not delete the account. Deleting it destroys the mailbox and the audit trail at the same time.
- Block sign-in for the account in the admin centre. This is reversible and it buys time.
What I do
- Revoke active sessions. Without this, a token issued before the password change carries on working.
- Remove app passwords and revoke consented apps, both of which survive a password reset.
- Remove forwarding and any inbox rules pointing at a personal address.
- Check enrolled devices and pull company access off them.
- Check what admin roles they held and what was accessed in the days before they left.
- Convert the mailbox to shared, so a colleague keeps the mail without needing a licence for it.
A migration or cutover has gone wrong
Mail not arriving after a DNS change, a tenant move that stopped half way, a cutover that stalled. Mail is rarely lost here, it is usually queued.
Worth knowing before you panic
- Sending mail servers retry for hours and often for days. Mail that has not arrived is usually delayed rather than gone.
- Do not start reversing DNS changes on a hunch. A second change on top of a half-applied first one is what turns an hour into a night.
What I do
- Triage: what is actually broken, what only looks broken, and whether mail is being lost or held.
- Decide rollback or push through, with you, in the first half hour rather than at 2am.
- Stabilise so people can work in the morning, even if the tidy-up waits for daylight.
- Write up what happened, so whoever was running the migration can pick it back up.
What cannot be fixed tonight
Worth saying plainly, because a page like this is otherwise a list of promises.
Anything only Microsoft can do
Service incidents on their side, tenant-level recovery, account recovery submissions. I can escalate properly and prepare what they need so it is not bounced back, but I cannot make them move faster.
Data that is past its retention window
Deleted items and deleted mailboxes are recoverable for a period, and then they genuinely are not. If something was purged months ago and there is no backup, there is nothing left to restore and no tool that changes that.
A tenant with no reachable administrator at all
If nobody left in the business can prove control of the tenant, it becomes Microsoft's identity verification process. That is measured in days and it is document-driven. I can prepare and lodge it, and that is the honest limit of it.
Money that has already left
If an invoice was paid to changed bank details, your bank is the more urgent call than I am. Ring them first, then ring me. Recalls have a short window and it closes fast.
Who picks up
Hamilton365 is Jamie Hamilton. There is no queue and no triage script: the person who answers is the person who does the work.
By day I run Identity and messaging infrastructure for one of Queensland's largest education providers, a 200,000-user environment where a compromised account is a standing procedure rather than a crisis. MCSE certified, 25+ years in the field. That is the whole point at 9pm: the odds that whoever answers has seen your failure before.
25+ years
Enterprise IT experience
200,000+
Users managed across Microsoft Identity environments
MCSE
Microsoft Certified Solutions Expert
Quick answers
Rather type it out
If it is happening right now, call 0403 401 250. This is here for when writing it down is easier than talking.
Or email jamie@hamilton365.com.au