An outage that affected multiple Microsoft 365 services, blocking users from signing in to Exchange Online, Microsoft Teams, Outlook clients, and OneDrive for Business is the result of a firewall.
See also: Microsoft 365: Outage brings down admin center in North America
While Microsoft says this incident has only affected customers in the EMEA (Europe, Middle East, and Africa) region, users have reported server and login failures around the world.
"At this time, the impact appears to be specific to certain users served through the affected infrastructure in Europe, the Middle East, and Africa," the company said in a service warning.
«We are checking the system telemetry to isolate the source of the problem. Additionally, we are working with affected users to collect network trace log files to aid our investigation.»
While Microsoft says it is still investigating the issue, this ongoing outage is likely linked to a false positive IDR of the Cisco Meraki firewall blocking Microsoft 365 connections with “ Microsoft Windows IIS denial of service attempt ” notifications.
See also: Microsoft patches Windows DogWalk zero-day
“We would like to inform you of a vulnerability reported by Microsoft CVE-2022-35748, which triggers SNORT rule 1-60381,” a Cisco Meraki employee said on Wednesday.
“SNORT correctly protects your networks from a known vulnerability and therefore works as expected.“
“Our recommendation at this time is to follow Microsoft's guidance and ensure that your servers, operating system , and software are up to date with the latest security patches.“
As reported by multiple customers who have successfully resolved this issue, administrators who want to restore Microsoft 365 connectivity to affected systems can allow IPS rule ID list 1-60381 from the Meraki dashboard > Security & SD Wan > Threat Protection > Allow List.
See also: Microsoft Teams: Fully optimized for Mac with M1 or M2 chip
Microsoft confirmed that the outage was a result of Snort rule 1-60381 and says that Cisco Meraki disabled the affected rule, with the change propagating within 1-2 hours.
