1- Password change from the ADM.

2- Sign out session from Office 365 admin.

3- Suggest user to disconnect from WIFI or Hotspot.

4- Validate if user has clicked on any link.

If yes, Link and what appears after clicking on the link. Then assign to the Information Security Team.