A DDoS attack was the cause of the major Azure outage on Tuesday. Microsoft admits that its security mechanisms did not do their job.

On Tuesday, several Azure portals, including Entra and Intune, went down for several hours. On the status page, Microsoft states that a DDoS attack was the cause. An “unexpected spike in usage” caused the CDN system to fill up, causing disruptions to the network. By Tuesday evening, the issues had been resolved.

Implementation errors

You would expect a company the size of Microsoft to be prepared for DDoS attacks. Microsoft says its security mechanisms were in action, but an unexplained “implementation error” amplified the attack rather than stopping it. An initial post-incident analysis is prepared within 72 hours, with the final report following after 14 days.

The perpetrators behind the attack have not yet been named. The group SN_blackmeta claims the scalp. SN_blackmeta has already made a name for itself with a DDoS attack on the social media platform Snapchat and an attack on an organization in the Middle East that lasted no less than six days. In the coming days it will become clear whether these are the perpetrators and what their motives were.

One mistake too many

Microsoft is being blamed for the bug. The outage occurred barely a week after the deadly Crowdstrike crash on Windows, from which not all affected companies have fully recovered, although Microsoft was not the main culprit.

The software giant has played a rather questionable role in other recent security incidents involving Microsoft services. Despite CEO Brad Smith’s personal promise, things went wrong again this time.