Incident Response Checklist 🚨 Immediate Actions (0-24 hours) Disable Direct Send feature temporarily if feasible Alert all employees about potential phishing emails Increase monitoring of email traffic for unusual patterns Notify Microsoft support for assistance and guidance Implement temporary email filtering rules to catch suspicious patterns 🔄 Recovery Actions Re-enable Direct Send with enhanced security controls Implement authenticated SMTP for capable devices Deploy SMTP relays with restricted IP scopes Conduct a full security review of Microsoft 365 configurations Restore any disrupted business processes with minimal impact
