Title: Some users’ automated investigations may be failing in the Microsoft Defender for Endpoint portal
User impact: Users’ automated investigations may be failing in the Microsoft Defender for Endpoint portal.
More info: Users may see a status message for the failed automated investigations as “Terminated by System”.
Current status: Our investigation has determined that a recent configuration change caused some inter-service requests that automated investigations rely on to fail. We’ve corrected the misconfiguration and any new automated investigations won’t be affected. However, automated investigations from the period of Tuesday, January 16, 2024, at 8:00 AM UTC to Monday, January 22, 2024, at 6:00 PM UTC may still be affected. We’re re-running these automated investigations and fully remediate the impact. This process is expected to complete by our next update.
Scope of impact: Any Security Operations Center user attempting to view the status of automated investigations in Microsoft Defender for Endpoint may be impacted.
Start time: Tuesday, January 16, 2024, at 8:00 AM UTC
Root cause: A recent configuration change caused some inter-service requests that automated investigations rely on to fail.
Next update by: Tuesday, January 23, 2024, at 5:00 PM UTC
