What to do if a clients Office365 Tenant was compromised. PWC has a nice and very through writeup. You can download it, along with some scripts to accomplish it directly from their GitHub. GitHub – PwC-IR/Business-Email-Compromise-Guide: The Business Email Compromise Guide sets out to describe 10 steps for performing a Business Email Compromise (BEC) investigation in an Office 365 environment. Each step is intended to guide the process of identifying, collecting and analysing activity associated with BEC intrusions.
This one is on the wishlist to break down to an SOP.