Server on Azure hosting software licenses was compromised and now cannot access or receive support

Ellie 0 Reputation points
2026-02-01T03:30:25.3666667+00:00

I received an email saying that my Azure account was disabled due to violation of terms of use. I was confused, logged in and found that a bunch of new resources had been created under my user and I had a long list of successful sign-ins that were not me.

I cannot delete all of the new resources as some were tied into the only resource I actually need, which is a server hosting a couple of software licenses. I don't want to reactivate my subscription as it will then allow the hackers to regain access.

I can't open a support ticket because I don't have a support plan, but there is an error report when I try to upgrade my support plan. I can't even trick a chatbot into connecting me with an agent. What gives, Azure? Please help.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-02-01T03:30:35.15+00:00

    If your Azure account has been compromised and you are unable to access or receive support, here are some steps you can take to address the situation:

    1. Change Credentials: Immediately change the credentials for your Azure account, especially for any tenant admins and users with role-based access control (RBAC). Ensure that multi-factor authentication (MFA) is enabled for all accounts to enhance security.
    2. Review Activity Logs: Check the Microsoft Entra sign-in logs to identify unusual sign-in patterns. This can help you understand the extent of the compromise and identify unauthorized access.
    3. Identify Compromised Resources: Use the Azure Activity Log to check for any unauthorized activity, such as changes to billing or resource configurations. If you find resources created by unauthorized users, you may need to disable or delete them.
    4. Contact Support: If you are unable to open a support ticket due to not having a support plan, consider contacting Azure support through other means, such as social media or community forums, to explain your situation. They may provide guidance on how to regain access or escalate your issue.
    5. Secure Your Environment: After addressing the immediate threats, focus on securing your Azure environment by following best practices for cloud security. This includes regularly reviewing your security posture and ensuring that all accounts have the necessary protections in place.

    Since you mentioned that you do not want to reactivate your subscription due to the risk of allowing hackers back in, it is crucial to ensure that you have taken all necessary steps to secure your account before considering reactivation.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.