Help Needed: Unauthorized Azure Charges & Suspected Account Compromise

For suspected Azure account compromise with unauthorized charges, take these actions immediately:

1. Change credentials for tenant admins and any Azure RBAC owners immediately.
2. Verify all admin password recovery email addresses and phone numbers in Microsoft Entra ID, and update them if needed.
3. Ensure MFA is registered and enforced for all tenant admins and RBAC owners.
4. Review users, tenants, and subscriptions at risk in the Azure portal, and investigate risk reports in Microsoft Entra ID Protection.
5. Review the Azure Activity Log for unauthorized changes, including billing, usage, or configuration changes.
6. Review Microsoft Entra sign-in logs for unusual sign-in patterns around the time the suspicious activity started.
7. Disable or delete compromised resources and remove any resources created by the unauthorized party. This is destructive, so confirm the resources are unauthorized before deleting them.
8. Review spending anomalies in Azure Cost Management.
9. Create an Azure support request to report the charges and get billing help. In the Azure portal, go to Help + Support or Support + Troubleshooting and create a Billing support request. If the portal keeps showing suggested solutions instead of letting the case proceed, select Create a support request or Return to support request, then continue through the billing case flow.
10. If charges are unexpected and need investigation, create an Azure support request.

For consumer Microsoft account compromise tied to payment activity, Microsoft also recommends using the account compromise sign-in helper tool, running a full malware scan before changing the password, then changing or resetting the password and reviewing connected accounts, forwarding, and automatic replies.

For unexpected Microsoft charges outside Azure, the Microsoft account dashboard provides a Manage your payments page with an Investigate option. If payment information may be compromised, contact the bank or payment provider immediately to prevent further charges.

References:

• Detect and respond to security alerts
• Understand the terms in your Azure usage and charges file
• Azure Account Compromised - Microsoft Q&A Hi
• Who can I speak with about a hacked Azure account that has sudden enormous costs? - Microsoft Q&A
• Azure account has been compromised, how can I contact Microsoft - Microsoft Q&A
• How to recover a hacked or compromised Microsoft account
• How to investigate a billing charge from Microsoft