LIVE · cybersecurity feed
Live wire
vulnerability

Microsoft blames massive Microsoft 365 outage on maintenance bug

Microsoft has attributed a significant outage affecting numerous Microsoft 365 and Azure services on Thursday, July 23, to a bug in its automated network maintenance system. The incident, tracked under ID MO1437424, began at 10:44 AM ET and primarily impacted customers accessing services through network infrastructure linked to Microsoft's West US Azure region.

ZeroDay News ·

Source: BleepingComputer

Microsoft has attributed a significant outage affecting numerous Microsoft 365 and Azure services on Thursday, July 23, to a bug in its automated network maintenance system. The incident, tracked under ID MO1437424, began at 10:44 AM ET and primarily impacted customers accessing services through network infrastructure linked to Microsoft's West US Azure region.

The disruption was caused by an error during routine device maintenance where specific network paths were being isolated. Microsoft's system, designed to convert maintenance requests into machine-readable instructions, incorrectly marked additional network devices as part of the maintenance event. This led to the unintended removal of IP routes from more devices than planned, specifically between Microsoft's West US datacenter and its wide-area network. Consequently, network traffic entering or leaving the West US region was severely disrupted, though traffic remaining entirely within the region was unaffected.

Reports on Downdetector surged to 2,403 at 11:11 AM ET, significantly above the typical baseline of 29. SharePoint accounted for the majority of complaints at 78%, followed by Excel at 11%, and the Microsoft 365 Admin Center at 6%.

Multiple Microsoft 365 services experienced degradation or outages. OneDrive access was intermittent, SharePoint Online users encountered "Something went wrong" errors, and Microsoft Teams chat functionality was degraded, including issues with images loading. The Microsoft 365 Admin Center loaded slowly or not at all, Power Automate flows failed to load, and Copilot Chat users experienced intermittent delays or failures. Microsoft Loop pages were also inaccessible. Other affected services included Fabric, Power BI, Power Apps, Copilot Studio, Windows 365, and Microsoft Defender, with some Defender customers reporting delays in receiving responses from Defender Experts and failures in investigations, workflows, and remediation actions through Threat Explorer and Advanced Hunting.

Azure services also suffered, including connectivity failures, increased latency, and access problems for Azure App Service, Application Gateway, Azure AD B2C, Azure AI Search, Azure API Management, Azure Cosmos DB, Azure Databricks, Azure Firewall, Azure Kubernetes Service, Azure Monitor, Azure Virtual Desktop, ExpressRoute, Log Analytics, Microsoft Graph, Microsoft Sentinel, Power BI Embedded, Virtual WAN, and VPN Gateway.

Microsoft engineers initiated an investigation immediately after the outage began, identifying large-scale route churn in Microsoft's WAN. They later traced the route removals to a datacenter in the West US region and linked them to recent maintenance activity. Initial mitigation efforts involved rerouting traffic through alternate network paths, which provided some relief, but many services remained affected.

At 1:45 PM ET, Microsoft began rolling back the problematic maintenance change. This rollback was completed by 2:26 PM ET, restoring the affected network infrastructure and allowing Microsoft 365 services to begin recovery. While most services recovered swiftly, some Azure services continued their recovery process, with Microsoft confirming full recovery for all affected services by 3:41 PM ET.

Before the cause was identified, Microsoft had advised customers to review their business continuity and disaster recovery plans. The company is now conducting a comprehensive internal review focusing on the safety checks and automated processes involved in executing maintenance requests. A final Post Incident Review is expected to be published within 14 days following the completion of this investigation.

vulnerabilitycloud
ShareXLinkedInWhatsAppFacebook

More News

view all →
security

Canadian cybersecurity executive arrested in federal extortion case

A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…

breach

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…

ai

AI Is Getting Really Good at Messing With Cybercriminals

Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.

ransomware

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

security

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.