Microsoft confirms that it lost weeks of data for its Cloud customers: “A bug in one of Microsoft’s…… resulted in malfunction”

Microsoft has informed customers that it lost more than two weeks of security logs for several of its cloud products due to a software bug, potentially impacting customers’ ability to detect security threats.
The logging outage affected key Microsoft products including Entra, Sentinel, Defender for Cloud, and Purview between September 2 and September 19, 2024.
According to a notification sent to affected customers, the issue was caused by “a bug in one of Microsoft’s internal monitoring agents resulted in a malfunction in some of the agents when uploading log data to our internal logging platform.”
Security logs are critical for tracking events within products, such as user sign-ins and failed access attempts. The absence of these logs could make it challenging for network defenders to identify unauthorised access during the affected period.
TechCrunch reports that Microsoft executive John Sheehan confirmed the incident was caused by an “operational bug within our internal monitoring agent.” The company has since mitigated the issue by rolling back a service change.
According to Business Insider, Microsoft stated in the customer notification that the problem “only affected the collection of log events” and was not related to any security compromise. However, the company acknowledged that customers may have experienced gaps in security-related logs or events, potentially affecting their ability to analyse data, detect threats, or generate security alerts.
This incident comes at a sensitive time for Microsoft, which has been emphasising security as a top priority following previous security incidents. The company recently introduced a Security Futures Initiative in response to past mishandlings, including a 2023 breach that allowed Chinese hackers to access thousands of cloud customer emails.
Microsoft has communicated with impacted customers and stated it will provide support as needed. The company did not respond to multiple requests for comment from Business Insider regarding this incident.