Title: Some users may have received an unexpected high volume of Pass-the-Ticket alerts in Microsoft Defender for Identity
User impact: Users may have received an unexpected high volume of Pass-the-Ticket alerts in Microsoft Defender for Identity.
Final status: We’ve identified that impact was caused by a recent service change related to a migration process, during which a specific feature settings was inadvertently activated and resulted in an unexpected high volume of Pass-the-Ticket alerts. We’ve reverted this change and confirmed the issue is resolved.
Scope of impact: Impact was specific to some users who were served through the affected infrastructure.
Start time: Tuesday, September 19, 2023, at 12:49 PM UTC
End time: Thursday, September 21, 2023, at 6:12 PM UTC
Root cause: A recent service change related to a migration process, during which a specific feature settings was inadvertently activated and resulted in an unexpected high volume of Pass-the-Ticket alerts.
Next steps:
– We’re reviewing our service update and migration procedures to prevent this issue from happening again.
This is the final update for the event.
