Microsoft 365 authentication failure
SEV 1 · CRITICALMI000001State: Mitigating
Approximately 2,000 users cannot authenticate. Email, Teams and SharePoint are affected across all locations.
ELAPSED01:08:13
AFFECTED USERS~2,000all locations
LINKED INCIDENTS14auto-correlated
TIME TO DETECT00:04from first alert
SERVICES DOWN3Email, Teams, SharePoint
Timeline
8 entries- 08:37Entra ID token signing certificate rolledAutomated change
- 08:40First authentication failures observedAzure Monitor
- 08:41INC0001047 raised by Nina AlvarezRequester
- 08:42AI correlated 6 incidents to one signatureTDGDC AI
- 08:47SEV 1 declared, MI000001 openedMike Keller
- 08:49Identity team engaged via on-callEscalation policy
- 08:55Root cause confirmed as certificate rollSarah Vance
- 09:03Rollback started on the signing certificateIdentity team
Responders
- Mike KellerIncident commanderAcknowledged
- Sarah VanceTechnical lead · IdentityAcknowledged
- Dev PatelApplicationsAcknowledged
- Lena OrtizCommunications leadAcknowledged
- Priya MenonVendor liaisonPaged
Affected services
- Teams
- SharePoint
- Single sign-on
14 incidents linked · 3 business services degraded · stakeholder update sent 09:15
Post-incident review
AI drafts the PIR from the timeline, linked incidents and monitoring data. A human reviews before it publishes. In this demo the draft is pre-written sample text.