Updated October 2026: This post has been expanded from its original July 2023 version with a full account of the Storm-0558 email intrusion, the free logging changes Microsoft made in response, the federal review that followed, and practical steps for organizations using Microsoft 365. It is a historical account; details describe the time it covers, not today.
On July 19, 2023, Microsoft said it would give far more of its cloud customers free access to detailed security logs, including records of who accessed which mailbox and when. The announcement came about a week after the company disclosed that a hacking group it believed was based in China had broken into the email accounts of roughly 25 organizations, including U.S. government agencies, by forging the digital tokens Microsoft's services use to confirm a user's identity.
The two events were closely linked. The intrusion had been spotted by a government customer that paid for Microsoft's premium logging tier, and security experts quickly asked why the evidence needed to catch a nation-state attack should cost extra. This post explains what happened in the breach, what Microsoft changed about logging, what a federal review board later concluded, and what organizations can still learn from it.
How the Storm-0558 intrusion worked
Microsoft tracks unnamed threat groups with temporary labels, and it called this one Storm-0558. According to Microsoft's own analysis, published July 14, 2023, the group began using forged authentication tokens to read email on May 15, 2023. A customer reported unusual mailbox access on June 16, which led to the investigation.
A stolen signing key
When you sign in to a Microsoft service, the system issues a token, a digitally signed pass that other Microsoft systems trust without asking for your password again. Those signatures are created with secret signing keys. Storm-0558 had obtained one of them: an inactive Microsoft account (MSA) consumer signing key, the kind used for personal services such as Outlook.com.
That alone should not have exposed business and government mail, which runs on Microsoft's separate enterprise identity system, then called Azure Active Directory. But Microsoft found a validation error in its code that allowed the consumer key to be trusted for signing enterprise tokens as well. With that key, the attackers could create tokens that let them into Outlook Web Access in Exchange Online, as well as Outlook.com, for accounts they targeted.
Who was affected
Microsoft said about 25 organizations were affected, including government agencies, along with a small number of related consumer accounts. Later reporting and the federal review identified the U.S. State Department, the Commerce Department and the House of Representatives among the victims, along with targets in the United Kingdom. How the key was originally stolen was still unknown when the review board reported in 2024.
Microsoft blocked the attack in stages over late June and early July 2023. It stopped accepting tokens signed with the stolen key, replaced all consumer signing keys that were valid at the time and moved them to a hardened key store, and fixed the validation flaw.
Why logging became the story
The State Department detected the intrusion, not Microsoft. It could do so because it had access to detailed mailbox-access records, which in 2023 came only with Microsoft's higher-priced Purview Audit (Premium) tier. Customers on the standard tier did not get those records, which meant many organizations would have had no way to see the same activity in their own environments.
Microsoft's practice of charging for these logs drew sharp criticism from security researchers, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had been pressing the industry on the issue as part of its "Secure by Design" campaign, which argues that basic security features should be included at no extra cost.
What Microsoft changed
In its July 19, 2023 announcement, Microsoft said that customers on Purview Audit (Standard) would get:
- Detailed logs of email access, plus more than 30 other types of log data that had been limited to the Premium tier.
- A longer default retention period for audit logs: 180 days instead of 90.
The company said it would begin rolling out the changes in September 2023 for government and commercial customers worldwide, with the full expansion arriving over the following months. CISA Director Jen Easterly welcomed the decision, calling it "truly a step in the right direction" toward more companies adopting Secure by Design principles, while noting it would take time to deploy.
| Feature | Audit (Standard), before July 2023 | Audit (Standard), after the change |
|---|---|---|
| Detailed mailbox-access logs | Not included (Premium only) | Included |
| Other advanced log types | Not included | More than 30 added |
| Default log retention | 90 days | 180 days |
| Extra cost | Premium license required | No extra charge |
Source: Microsoft Security blog, "Expanding cloud logging to give customers deeper security visibility" (July 19, 2023).
What happened next
- May 15, 2023
Storm-0558 begins using forged tokens to access email - June 16, 2023
A customer reports anomalous mailbox access to Microsoft - Late June to July 4, 2023
Microsoft blocks the stolen key, rotates signing keys and shuts down the attackers' infrastructure - July 2023
Microsoft discloses the intrusion; its technical analysis follows on July 14 - July 19, 2023
Microsoft announces expanded free logging for Audit (Standard) customers - September 2023
The logging rollout begins - November 2023
Microsoft launches its Secure Future Initiative - March 2024
The Cyber Safety Review Board publishes its report on the intrusion - May 3, 2024
Satya Nadella tells staff to prioritize security above all else
A blunt federal review
The Department of Homeland Security's Cyber Safety Review Board, a panel of government and private-sector experts, examined the intrusion. Its report, published in 2024, concluded that Microsoft's security culture was inadequate and required an overhaul. The board said the company had failed to detect the theft of what it called its cryptographic crown jewels on its own, relying instead on a customer to notice. Coverage of the report summed up its findings as a cascade of security failures. The board also recommended practices for cloud providers and government to prevent similar attacks.
Microsoft's response
Microsoft had already launched the Secure Future Initiative in November 2023, built on three principles: secure by design, secure by default, and secure operations. After the board's report, CEO Satya Nadella sent a memo to employees, later published on May 3, 2024, telling them to put security ahead of other priorities, including new features and support for legacy systems. He said part of senior leaders' pay would be tied to progress on the company's security plans.
The board itself did not last. In January 2025 the new administration dismissed all of its members while it was still investigating Salt Typhoon, a separate Chinese intrusion into U.S. telecommunications networks.
Lessons that still apply
For organizations that use Microsoft 365 or any cloud email service, the Storm-0558 case left several practical lessons:
- Confirm auditing is on. In the Microsoft Purview portal, check that audit log recording is enabled for your tenant. Logs you never collected cannot help an investigation.
- Know which events you can see. Check whether your license includes mailbox-access events, and learn how to search for them. Practice before you need them.
- Keep logs longer, somewhere else. Even 180 days can be too short for a slow-moving intrusion. Export audit data to a separate log store or security information and event management (SIEM) system with its own retention.
- Alert on unusual access. The State Department caught this attack because someone was watching for odd mailbox activity. Set alerts for access from unfamiliar apps, locations or clients.
- Ask vendors what logging costs. When choosing a cloud service, treat security logging as a core feature and ask what is included at your tier.
For individuals, there is little to do about a stolen signing key at a cloud provider. The broader lesson is that even strong passwords and multifactor authentication depend on the provider's own security, which is why the industry push for free, default logging matters to everyone.
Sources
- Microsoft Threat Intelligence: Analysis of Storm-0558 techniques for unauthorized email access (July 14, 2023)
- Microsoft Security: Expanding cloud logging to give customers deeper security visibility (July 19, 2023)
- CISA: Cyber Safety Review Board review of the Summer 2023 Microsoft Exchange Online intrusion
- Official Microsoft Blog: Prioritizing security above all else (May 3, 2024)
- Wikipedia: Cyber Safety Review Board
Top image: "Building92microsoft" by Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments