Some users are seeing delayed Microsoft log data, delayed findings, and failed Microsoft response actions in Blumira and Hearth. The cause is a Microsoft outage that began around 12:20 PM ET on November 12, 2026 and includes these Microsoft services (according to incidents EX1550543 and MO1550821):
Exchange Online
Microsoft 365 suite
Microsoft Defender XDR
Microsoft Teams
SharePoint Online
Blumira and Hearth are available, and data from non-Microsoft sources is flowing normally. Below is a summary of what we know and what to do.
What you might notice in Blumira
Based on current information, we anticipate the following impacts to Blumira:
- Delayed Microsoft log data. Logs from Microsoft 365, Entra ID, and Microsoft Defender integrations may arrive late until Microsoft recovers. Azure logs might also be delayed if Azure services are affected.
- Delayed or fewer Microsoft findings. Detections that rely on Microsoft logs will fire late. Fewer Microsoft 365 findings than usual during the outage does not mean nothing is happening.
- A "Potential Issue with Microsoft to Blumira Log Flow" finding. This finding is expected during the outage if Blumira cannot receive logs.
- More sign-in failure findings. As users and email clients keep retrying Microsoft sign-ins, you may see more failed-authentication or account lockout findings. Compare their timing to the outage before escalating, and still investigate anything that looks unusual.
- Microsoft 365 Threat Response actions may fail. Actions such as Disable User & Revoke Sessions depend on Microsoft's services. They may fail or time out until Microsoft recovers.
- Email notifications you cannot open until Exchange recovers. Blumira is still sending notifications. If your mailbox is in Microsoft 365, you may not be able to read them until Microsoft restores mailbox access.
What you might notice in Hearth
Based on current information, we anticipate the following impacts to Hearth:
- Sync alerts on Microsoft integrations. Hearth might report sync issues with your Microsoft 365, Azure, or Microsoft Sentinel integrations. These alerts are expected during the outage, and you do not need to reconnect anything.
- Incomplete or out-of-date Microsoft data. Answers and dashboards that use Microsoft data may be missing recent activity. If Hearth reports no suspicious Microsoft 365 activity during the outage, that may reflect missing data rather than a clean result.
What to do during the outage
You can track Microsoft's service health updates in the Microsoft 365 admin center (on the Service health page, look for incidents EX1550543 and MO1550821). If you cannot reach the admin center, check status.cloud.microsoft.
Until resolution, do the following:
- Leave your Microsoft integrations as they are. Deleting, reconnecting, or re-entering credentials won't speed up recovery and may cause setup problems later.
- Watch your Blumira findings in the app. If your email is down, check the Blumira app directly for new findings.
- Have a backup plan for account containment. If a Microsoft 365 Threat Response action fails, note the user and retry after Microsoft recovers. If a device is involved, you can still isolate it with Blumira Agent host isolation.
What to expect when Microsoft recovers
After services return to healthy, you might see the following:
- Delayed logs will arrive in a burst. You may see a wave of Microsoft findings whose events happened hours before the finding was created. Check each finding's event time, not just when it appeared.
- Review response actions taken during the outage. In the Microsoft Entra admin center, confirm that any users you disabled or sessions you revoked show the expected state.
- Recheck Hearth results that covered the outage window. Re-run questions and refresh dashboards that used Microsoft data from that period.
- Sync alerts and log flow findings should clear. Once Microsoft data is flowing again, Hearth sync alerts should stop, and you can resolve any "Potential Issue with Microsoft to Blumira Log Flow" findings from the outage.