Back

Not sure how well this is known as the notification and press coverage has been paywalled -

Microsoft had a gaffe and lost some security logs for Microsoft Entra, Microsoft Defender for Cloud and Microsoft Purview for several weeks in September. So if you built detections on these, they may be missing.

It looks like notification was in Microsoft 365 portal, which needs tenant admin rights so sec teams likely don’t know.

Also, MS apparently refused to comment to press. https://www.businessinsider.com/microsoft-tells-customers-it-lost-log-data-key-security-products-2024-10