Microsoft 365 Alert : Service Degradation – Exchange Online – Some users are unexpectedly receiving spam email messages in their Exchange Online inbox – RESOLVED

11/10/2022 08:35:00 AM (BST)

Issue Reported : 10/10/2022 15:40:00 PM

NHSmail Reference : INC32069821 

Microsoft Reference : EX444758

Issue Status : RESOLVED

Issue Description : Users may have been receiving some spam email messages in their inboxes or email with ICS file attachments are being quarantined.

More info : Users had also reported spam email being directed to their inboxes would see this issue coming from outlook.com email addresses.

Scope of impact : Some users may have been receiving spam email from Outlook.com addresses in their inboxes, though potentially any user sending or receiving ICS attachments in email messages may encounter their email being quarantined.

Final Update : 13/10/2022 14:48:00 PM – After investigating the reports of continued impact, they have determined that these reports were unfounded and impact is completely remediated for all users after our new rules blocked the offending email. They have also identified that a recent change to anti-spam quarantine rules was mistakenly placing quarantined email messages containing .ICS attachments on affected users’ calendars. This change was reverted, preventing future impact.

Root cause : An influx of spam email messages containing .ICS attachments, along with a misconfiguration within a recent quarantine rules change, resulted in impact.

Next steps : Microsoft is reviewing their anti-spam update procedure to better identify similar quarantine misconfigurations in the future and to better establish how the problem wasn’t caught prior to impact.