Loading story…
Microsoft restored access to the My Sign-Ins portal at mysignins.microsoft.com after an outage blocked some users from setting up or changing multi-factor authentication settings and triggered 504 Gateway Timeout errors. The company tracked the disruption under incident MO1329260, publicly acknowledged the issue through Microsoft 365 status channels, and initially attempted to mitigate impact by failing over the service to alternate infrastructure while monitoring telemetry as elevated error rates continued.
Microsoft later said the outage was caused by a recent cache configuration change. During the failover, high CPU and memory utilization coincided with peak European traffic and prevented the service from handling request volume, prompting Microsoft to roll back the mitigation and return traffic to the original infrastructure. The incident disrupted MFA enrollment, self-service sign-in management, onboarding, account recovery, and organizations enforcing Conditional Access policies that require MFA registration, creating a risk of temporary user lockouts until service was stabilized.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft later said access to the My Sign-Ins service had been restored and attributed the disruption to a recent cache configuration change. The company said high CPU and memory utilization during peak EU traffic contributed to the failed mitigation, after which it rolled back the mitigation actions and restored traffic to the original infrastructure.
As part of mitigation efforts, Microsoft failed over the affected service to alternate healthy infrastructure while monitoring telemetry and evaluating further stabilization steps because elevated error rates persisted.
Microsoft publicly confirmed an ongoing incident affecting some customers' ability to set up multi-factor authentication and access the My Sign-Ins portal, with impacted users seeing 504 Gateway Timeout errors. The company tracked the issue under incident MO1329260.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is enforcing mandatory multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center, with the policy taking full effect on February 9, 2026. This move follows a phased rollout that began in February 2025 and targets key administrative portals, including `portal.office.com/adminportal/home`, `admin.cloud.microsoft`, and `admin.microsoft.com`. Administrators without MFA enabled will be blocked from signing in, and Microsoft urges organizations to act immediately to avoid disruptions to IT operations and administrative functions. The enforcement is part of Microsoft's broader strategy to combat credential-based attacks, which remain a leading cause of security breaches. By requiring MFA, Microsoft aims to significantly reduce the risk of account compromise, prevent unauthorized access, and safeguard sensitive data managed through the admin center. The company highlights that MFA is a critical defense against phishing, credential stuffing, brute-force attacks, and password reuse. Administrators are advised to use the MFA Wizard or official documentation to configure organization-wide MFA, while individual users can verify or add authentication methods through the designated setup portal. This policy aligns with Microsoft's ongoing efforts to strengthen identity security, including previous enforcement of MFA for Azure Portal sign-ins across all tenants.
Jun 29, 2026
Microsoft confirmed a Microsoft 365 service-degradation incident, tracked as **MO1472904**, after users worldwide reported being unable to access core applications and receiving HTTP **502** and **503** errors. The disruption began at approximately 7:17 PM GMT+5:30 on September 16. Microsoft engineering teams are reviewing telemetry and customer reports to identify the affected fault domain, root cause, and remediation; no recovery timeline or attack attribution was available. Administrators should monitor the Microsoft 365 admin center for updates and avoid unnecessary password resets or configuration changes while the investigation continues.
Sep 16, 2026
ANY.RUN reported that the **Mirage2FA** phishing-as-a-service platform has been targeting **Microsoft 365** and **Entra ID** users with an adversary-in-the-middle reverse-proxy setup that captures credentials, MFA codes, and authenticated session cookies in real time. The operation, attributed to **LinX Coders**, has been active since September 2024 and remained operational through July 2026, targeting **9,426** email accounts across **3,518** organizational domains in **94 countries**; **4,532** addresses showed indicators of potential compromise, and **63.7%** of identified victims were in the United States. The phishing chain used malicious `.htm`, `.xhtml`, and `.svg` attachments, QR-code links, HTML smuggling, obfuscated JavaScript, and WebSocket relays to legitimate Microsoft services to let users complete MFA before stealing their live sessions. Researchers linked the activity to infrastructure in the `185.174.100.0/24` subnet and to operator markers including `LINXCODERSEMAIL`, Telegram branding, and bot naming conventions. Because the attackers primarily hijack active sessions rather than just passwords, defenders were urged to **revoke active sessions and refresh tokens** in addition to resetting credentials and to use the published indicators and ATT&CK mappings for detection and response.
Aug 20, 2026