Loading story…
Microsoft confirmed a Microsoft 365 service-degradation incident, tracked as MO1472904, after users worldwide reported being unable to access core applications and receiving HTTP 502 and 503 errors. The disruption began at approximately 7:17 PM GMT+5:30 on September 16.
Microsoft engineering teams are reviewing telemetry and customer reports to identify the affected fault domain, root cause, and remediation; no recovery timeline or attack attribution was available. Administrators should monitor the Microsoft 365 admin center for updates and avoid unnecessary password resets or configuration changes while the investigation continues.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft confirmed service-degradation incident MO1472904 after users worldwide lost access to core Microsoft 365 applications and encountered HTTP 502 and 503 errors. Engineering teams began reviewing telemetry and customer reports; no root cause, resolution timeline, or connection to prior incidents had been identified.
Exchange Online experienced a multi-day authentication failure.
A networking misconfiguration disrupted Microsoft Teams and SharePoint services in North America.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported multiple **service-impacting incidents** across its cloud ecosystem. Administrators in **North America and Canada** experienced an outage and degraded performance in the **Microsoft 365 admin center**, with some users also unable to access the *M365 app* or raise support tickets; Microsoft said it was analyzing telemetry, usage patterns, and **CPU utilization**, and reviewing user-provided **HAR files** to isolate the root cause. Separately, **Exchange Online** quarantined legitimate messages after an updated **URL rule** incorrectly marked some URLs as phishing, disrupting email flow for affected customers while Microsoft worked to release quarantined mail and unblock legitimate URLs. In another disruption, Microsoft attributed **Windows Update** and **Microsoft Store** failures/timeouts (notably impacting Windows 11 users) to a **utility power interruption** at a **West US datacenter**, which cascaded into issues with **Azure storage clusters** supporting content delivery; backup power engaged and power was later stabilized, but service recovery required additional remediation beyond restoring electricity.
Jun 29, 2026
Microsoft experienced a broad service disruption that affected **SharePoint**, **Teams**, **Excel**, the **Microsoft 365 Admin Center**, and Azure-hosted workloads, with users also reporting failures in **Dynamics 365**, **Dataverse**, Entra join operations, and administrative portals. Administrators said SharePoint timeouts, Teams image-loading failures, and unreachable Azure virtual machines were especially visible in **West US**, **Canada West**, and parts of **US East**, while Downdetector recorded a sharp spike in complaints. Microsoft acknowledged the incident and directed customers to service health alert `MO1437424`, saying it was investigating increased reports and reviewing telemetry to determine scope and impact. The disruption appeared to extend beyond core collaboration services into dependent platforms and Microsoft-backed update infrastructure. Sysadmins reported **Windows Media Creation Tool** failures with error `0x80072EE4 - 0x20000`, Windows feature enablement errors such as `0x80244022`, and **Windows Update** failures returning `0x801901f7` on newly imaged systems. A separate outage report also indicated **KaseyaOne** login issues that users linked to the Azure problems, suggesting downstream impact on third-party services hosted on Microsoft infrastructure as customers saw intermittent outages, degraded functionality, and some signs of partial recovery.
Jul 24, 2026
Microsoft Teams experienced widespread outages, with users across the United States, Europe, and other regions reporting delays in sending messages and problems with other service functions. Microsoft acknowledged the issue publicly, stating that they were investigating the cause and observing signs of recovery, but did not initially provide a root cause or timeline for full restoration. The outage disrupted communication for many organizations relying on Teams for collaboration and messaging. Separately, a significant outage affected Microsoft 365 services—including Teams, Outlook, OneDrive, and the Copilot AI assistant—in Japan and China. This disruption was traced to a critical routing misconfiguration in Microsoft's infrastructure, which isolated healthy systems and led to intermittent login failures, degraded performance, and app loading errors. Microsoft confirmed that the incident was not the result of a cyberattack and reported that engineers had rebalanced traffic to restore service, with no data loss or security breaches identified. The outages caused notable business disruption in the affected regions, particularly for organizations dependent on Microsoft’s cloud ecosystem for daily operations.
Jun 29, 2026