Microsoft fails to collect critical security logs, exposing customers to risks

Widespread impact on security monitoring

Microsoft admitted that the logging failure affected a range of critical services. Microsoft Sentinel, a widely used security tool, encountered gaps in its logs, making it difficult for customers to detect threats and create alerts. Azure Monitor, another key security analysis tool, also faced incomplete log data, potentially leading to missed actions for enterprise alerts.

Microsoft Entra experienced issues with login and activity logs, while Azure Logic Apps saw disruptions to telemetry data. While the core functions of these services remain unaffected, the inability to capture critical log data greatly weakens customers’ ability to monitor security events. The company noted that the logs were lost due to a bug in the telemetry agent, which caused backups to be held intermittently before data was overwritten when the cache limit was reached.

However, the company said the issue “did not impact the performance of any customer-facing services” and only affected the collection of log events. “Furthermore, this issue is not related to any security compromise.”