Microsoft has recently admitted to losing two weeks of security logs for its Cloud products, potentially impacting customers’ ability to detect security threats.
As per TechCrunch, a notification was sent to the affected users by Microsoft, which stated “a bug in one of Microsoft’s internal monitoring agents resulted in a malfunction in some of the agents when uploading log data to our internal logging platform”.
It affected key Microsoft products, including Entra, Defender for Cloud, Purview and Sentinel between September 2 and September 19.
According to TechCrunch’s report, Microsoft executive confirmed that the incident was caused by an “operational bug within our internal monitoring agent.”
What is Logging?
Security logs are vital for monitoring events within a product, such as user sign-ins and failed login attempts. The absence of such proper logs makes it difficult to detect unauthorized access to customer networks.
According to Business Insider, Microsoft emphasized that the logging outrage “only affected the collection of log events.”
However, the tech giant also acknowledged that users “may have experienced potential gaps in security related logs or events, possibly affecting customers’ ability to analyse data, detect threats, or generate security alerts.”
Why does it matter?
The incident comes at a sensitive time for Microsoft, which has been under criticism over the past year due to several security incidents. The company has been emphasizing security as a top priority as of late, introducing Security Futures Initiative in response to several attacks, primarily a 2023 breach by Chinese hackers known Storm-0558 that gave them unrestricted access to thousands of Cloud customer emails, including that of the American government.
John Sheehan, a Microsoft corporate vice president, said, “We have mitigated the issue by rolling back a service change. We have communicated to all impacted customers and will provide support as needed.”
Leave feedback about this