Title: Users may be intermittently unable to access specific pages of Automated investigation and response (AIR)
User impact: Users may have been unable to access quarantine and submissions of AIR in Microsoft Defender for Office 365.
Final status: We’ve confirmed that our process of reallocating the service load across the affected infrastructure is complete and the impact is remediated.
Scope of impact: Any user that attempted to access the quarantine and submissions page of AIR in Microsoft Defender for Office 365 may have been impacted.
Start time: Tuesday, January 23, 2024, at 8:00 AM UTC
End time: Friday, March 29, 2024, at 11:17 PM UTC
Root cause: A component of Microsoft Defender AIR infrastructure responsible for facilitating access to the quarantine and submissions pages was encountering an unusual increase in traffic that was causing the component to operate below expected performance thresholds and resulted in impact.
Next steps:
– We’re further investigating the component of Microsoft Defender AIR infrastructure to understand what caused the increase in traffic, and to implement strategies to better process any future sudden increases in traffic to prevent impact from reoccurring.
This is the final update for the event.
