Azure: a DDoS attack, then its own protection, disrupt Front Door and the portal

2024-07-30 · Publisher : Microsoft · Domain : Cloud & DevOps

On 30 July 2024, a DDoS attack on Azure triggers Microsoft's defences, which amplify the incident because of a configuration defect. Front Door, CDN, the portal and part of Microsoft 365 are hit for up to 8 hours.

### Background On 30 July 2024, Azure customers saw connection errors, timeouts and latency spikes in several regions. Microsoft's post-incident review (PIR) describes a volumetric **TCP SYN flood** DDoS attack between 10:15 and 10:45 UTC, which triggered mitigation procedures. The main impact starts at 11:45 UTC and full mitigation is reached at 19:43 UTC. ### Key facts - First defect: when the protection was disengaged, network routes could not be updated at one European site, because of control plane failures linked to a power outage. - Second defect: a latent network configuration error, unrelated to the attack, routed non-European traffic through the European DDoS protection system, causing local congestion. - Services affected: Azure Front Door, Azure CDN, the Azure portal, part of Microsoft 365 and Microsoft Purview. - Impact was reduced around 13:58 UTC; a subset of customers kept low-rate timeouts until 19:43 UTC. Customers without retry logic were most exposed. ### Why it matters Here, attack protection produced part of the damage: a poorly isolated defence mechanism becomes a failure risk. For operations teams, two concrete conclusions: implement retries with backoff in applications, and do not concentrate traffic ingress on a single edge service without a bypass plan. ### Takeaway An attack that was short in duration was enough to trigger a failure lasting several hours, exposed by a dormant configuration defect.

Tags : Incident, Azure, Edge, Sécurité