Cannot log into Investigate in M365 Defender portal

Hello @Jakub Ozga

The error indicates an identity/tenant mismatch, not necessarily that the Defender portal itself has been compromised.

The important part is:

Selected user account does not exist in tenant 'Microsoft Services'

and cannot access application

'80ccca67-54bd-44ab-8625-4b79c4dc7775'

The same application ID and error have been reported when accessing Microsoft Defender with an account that isn't associated with the tenant being used for authentication.

First, open an InPrivate/Incognito browser session and sign in to the Defender portal using your Microsoft 365 work or school account, not a personal Microsoft account.

If you belong to multiple Microsoft Entra tenants, make sure you're authenticating against the tenant containing your Microsoft 365/Defender environment. Microsoft documents this type of error as commonly occurring when the account doesn't exist in the tenant to which authentication is being directed.

Since you mentioned being attacked, I'd also recommend not relying on links from suspicious emails or messages to reach the Defender portal. Navigate directly to the portal above. If you believe the account itself was compromised, contact your organization's Microsoft 365 administrator immediately so they can review sign-in activity, revoke sessions, reset credentials, and verify MFA.

If the error persists even when using the correct organizational account in a private browser session, please post the AADSTS error code, Correlation ID, Request ID, and timestamp from the error details, but don't post your tenant ID or other sensitive account information publicly.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.