User impact: Users may have been unable to view incident and alert details in the Microsoft 365 Defender portal.

More info: Users may have also been unable to view email and collaboration tables in the Microsoft 365 Defender portal.

Final status: We’ve disabled the offending change and verified through our test environment and monitoring that the issue is resolved. 

Scope of impact: Impact was specific to some users who were served through the affected infrastructure.

Start time: Tuesday, February 28, 2023, at 2:00 AM UTC

End time: Thursday, March 2, 2023, at 6:20 PM UTC

Root cause: A recent change, intended to redirect traffic to an improved SQL database infrastructure, contained an issue that prevented the infrastructure from properly assessing Azure AD roles and resulted in impact. 

Next steps:
– We’re reviewing the recent change in full to fully understand how impact occurred and why this issue wasn’t identified during our pre-deployment process to ensure this problem doesn’t reoccur in the future.

This is the final update for the event.