Loading story…
Microsoft is investigating a Microsoft 365 Copilot availability incident tracked as CP1470554. Affected users may be unable to open Copilot or may receive errors while accessing or interacting with the service, including through Copilot-integrated Microsoft 365 applications.
Microsoft had not disclosed the root cause, affected regions, or an estimated recovery time. The company has not identified the incident as a breach or cyberattack; tenant administrators should monitor the Microsoft 365 admin center Service Health Dashboard and avoid unnecessary endpoint, credential, or client-configuration changes while the cloud-service disruption remains active.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft began investigating CP1470554, an availability incident in which users may be unable to open Microsoft 365 Copilot or encounter errors interacting with it, including through Microsoft 365 integrations. The company had not disclosed a root cause, affected regions, or recovery estimate and directed administrators to the Service Health Dashboard.
Microsoft reported mitigating a separate issue affecting access to Microsoft Copilot on the web on September 10.
Microsoft restored Copilot Chat after a configuration change on September 5 caused some queries to return a “Something went wrong” error.
A late-August Microsoft 365 outage tied to a core authentication configuration caused Copilot prompts requiring Microsoft 365 grounding, including email content, to fail.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed an incident affecting search functionality across several Microsoft 365 services, including **Outlook on the web**, **Outlook desktop**, **SharePoint Online**, and **OneDrive**. The company said a recent deployment introduced a resource-utilization inefficiency on affected infrastructure, causing some users to experience degraded service. Microsoft tracked the issue as **`MO1456424`** in the Microsoft 365 Admin Center and said it developed and deployed a fix to reduce resource pressure and restore normal operation. User reports aligned with Microsoft's notice, with administrators describing failures opening SharePoint and OneDrive files, intermittent access to some SharePoint resources, Outlook connectivity issues, and related errors involving Copilot and slow Entra Conditional Access behavior. Reports suggested the disruption was partial rather than global, with symptoms concentrated in some environments and regions, including anecdotal reports from the Central and East US, while other users said their tenants were unaffected.
Aug 18, 2026
Microsoft confirmed a **Microsoft 365 Copilot Chat** bug that caused the Copilot *work tab* to incorrectly read and summarize users’ emails from **Sent Items** and **Drafts**, even when those messages had **confidential sensitivity labels** and organizations had **data loss prevention (DLP)** policies intended to prevent such processing. The issue was tracked as admin-visible incident `CW1226324`, first detected in late January, and was attributed to an unspecified **code error** that allowed labeled items to be picked up by Copilot despite protections being in place. Microsoft said it began rolling out a fix in early February and was still monitoring deployment while validating remediation with a subset of affected users; the company did not disclose how many customers were impacted or provide a firm timeline for full resolution. Separate reporting noted heightened institutional concern about built-in AI features handling sensitive correspondence (e.g., the European Parliament IT department blocking AI features on work devices), underscoring governance and data-handling risk when AI assistants can process content contrary to configured controls.
Jun 29, 2026
Microsoft is tightening and clarifying how **Copilot** can access and process user and organizational data across the Microsoft ecosystem. Microsoft is expanding **Purview Data Loss Prevention (DLP)** enforcement so policies that block Copilot from processing restricted/sensitivity-labeled content will apply not only to files in **SharePoint** and **OneDrive**, but also to **locally stored** Word, Excel, and PowerPoint documents. The change is planned for deployment via the *Augmentation Loop (AugLoop)* Office component between late March and late April 2026, and is expected to be automatically enabled for organizations already configured to block Copilot from processing labeled content; Microsoft says the update works by allowing the Office client/AugLoop to read sensitivity labels directly rather than relying on Microsoft Graph calls tied to SharePoint/OneDrive URLs. Separately, a Copilot “Memory” setting labeled **“Microsoft usage data”** has been reported as enabling Copilot to reference data from other Microsoft products (including **Bing, MSN, and Edge**) to personalize conversations, with an option for users to disable it if they have privacy concerns. A third, unrelated Microsoft 365 issue—an acknowledged bug in **classic Outlook** that can cause the mouse pointer to disappear—does not materially relate to Copilot data access or DLP controls and appears to be a usability defect rather than a security event.
Jun 29, 2026