Sign User Out of O365
In situations involving compromised user accounts simply disabling an account is often not sufficient to mitigate the threat especially if the account is actively being using to send SPAM/Phishing email or to download data.
Pablo Legorreta - Cloud & Virtualization Expert