Responding to a suspicious sign-in
Who is involved
| Role | What they do |
|---|---|
| Employee | Receives the unfamiliar-sign-in email and reports it. |
| Tenant admin | Ends the sessions and resets the credentials. |
Step by step
- Employee
Receives the email that a sign-in came from a new network or device, and does not recognise it.
What they see:The email lists the address and browser.
- Employee
Reports it to the administrator.
What they see:The administrator has the person's name and time.
- Tenant admin
Opens Settings, Users, looks at the person's devices and signs them out everywhere.
What they see:Every session ends within seconds.
- Tenant admin
Sends a password reset and, if needed, removes the authenticator.
What they see:Earlier reset links are cancelled and a fresh one is sent.
- Employee
Opens the new link and chooses a new password.
What they see:Any session that had survived is ended and a password-changed notice is sent.
- Tenant admin
Opens the person's Devices on the Users list again.
What they see:No live sessions remain until the person signs in with the new password.
Who is told what
The person receives the unfamiliar-sign-in email, the reset email and a password-changed notice.