azure
Root cause
Azure Active Directory (now Entra ID) is the front door to the entire Microsoft cloud. When you sign in to Outlook, open the Azure portal, or launch a line-of-business app wired to corporate single sign-on, Azure AD is what issues the token that proves who you are, and it is also what validates that token on the way back in. Both halves of that loop rely on cryptographic signing keys, and those keys are rotated on a schedule for security hygiene.
On March 15, 2021, an automated key rotation process behaved incorrectly. A signing key was moved out of an operation that still depended on it, which left Azure AD in a state where it could no longer validate a class of tokens it had issued. The failure signature was the worst kind for an identity platform: not a slow degradation, but a hard stop on the one function that gates everything else. Starting around 19:00 UTC, sign-in requests began failing worldwide.
Recovery followed the identity-incident playbook. Microsoft identified the offending key change, reverted it, and let the corrected key state propagate across the identity infrastructure. The rollback was conceptually simple, but propagation across a globally distributed authentication service is not instant, and token caches meant different tenants recovered at slightly different times. Microsoft declared mitigation complete around midnight UTC.
This is the second major Azure AD authentication event of its era, and it rhymes with a later identity incident. Compare it with the June 2023 layer-7 DDoS attacks, where the identity experience broke because attackers flooded the web front ends rather than because the token machinery itself failed. Same symptom to a user (I cannot sign in), very different cause.
Business impact
An Azure AD outage is uniquely disruptive because it is a single point of failure for authentication, and authentication is upstream of nearly everything.
Redundancy did not help. A customer running highly available workloads across multiple regions still authenticated through the same global identity plane. There is no paired-region failover for sign-in when the identity service itself is the thing that is broken. This is the same lesson the global WAN outage of January 2023 taught about the network fabric: some layers sit beneath your architecture and cannot be worked around from inside your own subscription.
The blast radius was the whole Microsoft estate plus everything federated to it. Because so many enterprises use Azure AD as their central identity provider for third-party SaaS, the failure did not stop at Microsoft 365. Any application configured for Azure AD single sign-on inherited the outage. For a lot of organizations, this incident was the moment they discovered exactly how many tools sat behind that one login.
Cached tokens created a confusing, uneven experience. Users who already held valid, unexpired tokens sometimes kept working until their next refresh, while colleagues next to them were fully locked out. That unevenness slowed diagnosis: help desks fielded reports of a service being both up and down at the same time.
Prevention and lessons
You cannot fix Microsoft's key rotation logic. You can decide, in advance, how much of your operation grinds to a halt the moment sign-in does.
- Design break-glass access that does not depend on the failing plane. Every critical system should have at least one emergency access path that survives an identity outage: a local admin account, an emergency access account excluded from conditional access, or an out-of-band console login. Store the credentials securely offline and rehearse using them.
- Understand and tune token lifetimes deliberately. Longer access-token and refresh-token lifetimes increase the odds that in-flight sessions ride through a short identity blip, at a security cost. Shorter lifetimes are safer but make you re-authenticate more often, which is exactly what fails during an event like this. Choose the tradeoff on purpose rather than by default, and document it in your business-continuity plan.
- Inventory what actually federates to Azure AD. Most teams underestimate this. Build the list before an incident so that when sign-in dies you already know the full set of affected tools and which ones have alternate local logins.
- Instrument sign-in health as a first-class signal. Region status pages under-report identity-plane failures. Watch Azure AD sign-in success as its own metric, correlate it with a live status board, and alert on it independently of any single application.
If a covered outage crossed your SLA thresholds, quantify it before you file. Run the affected window through the Azure SLA credit calculator, then follow the Azure credit-claim playbook to package the evidence. For continuous, service-level monitoring that flags identity-plane failures the moment they start, Next Signal watches the sign-in path so you find out before your users do.