Microsoft experienced a broad service disruption that affected SharePoint, Teams, Excel, the Microsoft 365 Admin Center, and Azure-hosted workloads, with users also reporting failures in Dynamics 365, Dataverse, Entra join operations, and administrative portals. Administrators said SharePoint timeouts, Teams image-loading failures, and unreachable Azure virtual machines were especially visible in West US, Canada West, and parts of US East, while Downdetector recorded a sharp spike in complaints. Microsoft acknowledged the incident and directed customers to service health alert MO1437424, saying it was investigating increased reports and reviewing telemetry to determine scope and impact.
The disruption appeared to extend beyond core collaboration services into dependent platforms and Microsoft-backed update infrastructure. Sysadmins reported Windows Media Creation Tool failures with error 0x80072EE4 - 0x20000, Windows feature enablement errors such as 0x80244022, and Windows Update failures returning 0x801901f7 on newly imaged systems. A separate outage report also indicated KaseyaOne login issues that users linked to the Azure problems, suggesting downstream impact on third-party services hosted on Microsoft infrastructure as customers saw intermittent outages, degraded functionality, and some signs of partial recovery.

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Microsoft said the Microsoft 365 outage tracked as MO1437424 was likely caused by a recent network configuration change affecting primarily North America-routed traffic. The company mitigated the incident by rolling back the change and rerouting traffic across alternate network paths, then reported telemetry showed recovery and marked the service restored.
Users reported Windows Update returning error 0x801901f7 when newly imaged systems attempted to update directly from Microsoft Update. Multiple commenters confirmed the same behavior, indicating a likely service-side disruption rather than isolated local issues.
Reddit users reported Windows Media Creation Tool failures with error 0x80072EE4 - 0x20000, along with Windows feature enablement error 0x80244022 and Windows Update error 0x801901f7. Participants suggested the problems were related to the broader Microsoft or Azure backend outage.
Users reported that images in Microsoft Teams chat were appearing as white boxes instead of loading properly. Commenters tied the issue to active Microsoft service health incident MO1437424 and said clearing the Teams cache did not resolve it.
A Reddit user reported KaseyaOne had been inaccessible for at least an hour in the EU/Merlot region, and a commenter said Kaseya was experiencing an outage. The thread attributed the login-access issue to the ongoing Azure outage, and the original poster later confirmed seeing Kaseya's status page.
Reddit users reported Azure virtual machines in West US were running according to boot diagnostics but were unreachable over RDP, with commenters suggesting broader network connectivity issues. The discussion also mentioned possible impact extending to Azure US East and that Microsoft's status page did not yet reflect the outage.
Microsoft acknowledged the disruption and said it was investigating the outage, directing administrators to service health incident MO1437424 for updates. Reddit users also referenced the incident as covering Teams image-loading failures and broader Microsoft 365 problems.
Downdetector recorded a sharp increase in user reports at 11:11 a.m. ET, reaching 2,403 reports versus a normal baseline of 29. Most complaints involved SharePoint, followed by Excel and the Microsoft 365 Admin Center.
Microsoft later said in incident MO1437424 that it began investigating increased user reports of Microsoft 365 issues after the incident started at 10:06 AM CDT. User reports described impact to SharePoint, Teams, Dynamics 365, Dataverse, Azure-hosted applications, and administrative portals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcereddit.com
Open sourcebleepingcomputer.com
Open sourcereddit.com
Open sourcereddit.com
Open sourcereddit.com
Open sourcereddit.com
Open sourcereddit.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.