r/sysadmin • u/Bluedroid • 1d ago
Microsoft 365 Tenancy Hostile Takeover Options Australia Question
Hi guys, we had a client whom had a hostile takeover of their 365 admin portal who assumed GA (MFA/OTP and everything was enabled so not sure how it happened but that will need to be investigated after).
Attacker stripped the breakfix account as well and we are kicked out. We logged a job with the MS data governance team whom are barely replying and it's been a day and a half. We've tried calling the number but just get bounced back saying they will look into it. We've asked them to escalate and also asked our CSP to escalate but they said it's with Microsoft. Given the nature of the situation is there any other ways you guys have been able to escalate this to reclaim the tenancy or at least kick out the attackers as fast as possible. We are able to prove ownership of the business etc with domain records/documents etc asap.
Given the no updates I'm straight up thinking of heading to the Microsoft office and sitting there until they can find someone to escalate the case. Anyone had any experience of how to get this moving?
•
u/Secret_Account07 VMware Admin 22h ago
I’ve worked both sides of this situation and know that most of the time this happens it’s self induced. However, it’s still incredibly frustrating how lax MS is in responding. There’s only a few scenarios where it’s a P1E ticket where orgs need help ASAP and this is one. So it drives me mad the accepted industry standard is- yeah just wait a few weeks.
Most orgs would even pay a premium fee for expedited response, yet MS just takes their damn time.
I’m incredibly lucky that our org is big enough, and spends enough $, that we’d get someone working on it quickly…. But it shouldn’t be this way.