azureRoot cause
Unlike most entries in our archive, this incident was not a misconfiguration or a software defect - it was an adversary. Across early June 2023, waves of layer-7 DDoS traffic hit the web front ends of Microsoft's flagship services: Outlook on the web around June 5–6, OneDrive on June 8, and the Azure Portal on June 9. Microsoft's Security Response Center later attributed the campaign to the actor it tracks as Storm-1359, operating rented botnets, open proxies, and virtual private servers.
Layer-7 attacks are qualitatively different from the volumetric floods most DDoS defenses are sized for. Rather than saturating network links (layers 3/4), they exhaust the application tier: floods of expensive HTTPS requests, cache-bypass patterns that force every request through to origin, and Slowloris-style connections that hold server resources open. The traffic looks superficially legitimate, which is why mitigation was iterative - WAF rate limits, traffic rebalancing, and protection tuning over several days rather than a single fix.
Why does a portal-and-webmail attack sit under Entra ID in our records? Because that is where the business felt it. The disrupted properties are the visible ends of Microsoft's identity-fronted web estate: users experienced failed sign-ins and admins experienced an unreachable management plane. Whether the bottleneck was the identity tier itself or the web tier in front of it, the enterprise symptom was "we cannot get in."
Business impact
The June 2023 campaign is the best available case study for a scenario most continuity plans skip: denial of access without loss of workloads. Azure VMs kept running, databases kept serving, and yet:
- Administrators lost their management plane. With the Azure Portal intermittently down, routine operations - scaling, diagnostics, incident response itself - stalled for teams without scripted alternatives. Teams comfortable with CLI, PowerShell, and infrastructure-as-code pipelines (which authenticate via tokens that were often still being issued) operated largely as normal; portal-dependent teams did not.
- The productivity layer took the visible hit. Outlook on the web failures generated executive-level attention within minutes, consuming incident-response bandwidth even at organizations whose Azure workloads were untouched.
- Security teams faced an attribution question. Availability incidents caused by threat actors trigger different obligations - security review, possible regulator notification under frameworks like DORA - than operational faults do. Organizations without a pre-agreed decision tree for "is this an outage or an attack?" lost time deciding whose playbook applied.
The saving grace: Microsoft reported no evidence of customer data access or compromise. The cost was time, trust, and operational friction - real, but recoverable.
Prevention and lessons
You cannot prevent someone else's botnet. You can make your organization indifferent to a few days of intermittent portal access.
- Script your management plane. If every operational task can be done through the portal and through automation (CLI/ARM/Bicep/Terraform via service principals), a portal disruption is an inconvenience. If the portal is your only path, it is an outage. This is a named gap in the BC/DR planning hub.
- Maintain break-glass identity paths. Emergency accounts excluded from Conditional Access, with credentials stored offline, exist precisely for identity-adjacent disruptions. Test them quarterly - an untested break-glass account is a hope, not a control.
- Pre-classify attack vs. fault. Write the decision tree now: who declares a security incident, what changes about communication, and which compliance clocks start. June 2023 showed the classification can take days to confirm publicly; your internal posture should not wait for attribution.
- Watch independent signals. During attack waves, first-party status pages update cautiously. Independent monitoring - like the live status board and instant alerts - gives your stakeholders an external timestamp for "it isn't just us," which is half of what an incident bridge spends its first thirty minutes establishing.