{"id":279175,"date":"2023-03-30T07:48:08","date_gmt":"2023-03-30T05:48:08","guid":{"rendered":"https:\/\/www.borncity.com\/blog\/?p=279175"},"modified":"2023-03-30T08:14:52","modified_gmt":"2023-03-30T06:14:52","slug":"strung-ex534197-bei-exchange-online-28-29-mrz-2023","status":"publish","type":"post","link":"https:\/\/borncity.com\/blog\/2023\/03\/30\/strung-ex534197-bei-exchange-online-28-29-mrz-2023\/","title":{"rendered":"Störung EX534197 bei Exchange Online (28.\/29. März 2023)"},"content":{"rendered":"

\"Stop[English<\/a>]Microsofts Cloud-Dienst Exchange Online ist vorgestern und gestern (28.\/29. M\u00e4rz 2023) wohl gest\u00f6rt gewesen. Die St\u00f6rung begann bereits am 28. M\u00e4rz 2023 um ca. 14:00 Uhr, als Nutzer sich nicht mit anmelden konnten. Microsoft hat das best\u00e4tigt und schreibt, dass es wohl auch eine Dienstbeeintr\u00e4chtigung gebe, so das E-Mails auf Exchange Online in Quarant\u00e4ne geschoben werden. Blog-Oser Andreas P. hat mich per Mail informiert und die MS-Status-Informationen zukommen lassen (danke daf\u00fcr). Hier ein schneller \u00dcberblick, was Sache ist.<\/p>\n

<\/p>\n

\"\"Es ging bereits am 28.03.2023 um 14:51:55 Uhr los, als Microsoft ein Problem feststellte. Eingehende E-Mails von Benutzern wurden in Exchange Online gelegentlich und unerwartet unter Quarant\u00e4ne gestellt.\u00a0 Microsoft vermutete abld, dass dieses Problem durch Restauswirkungen eines fr\u00fcheren Azure Active Directory (Azure AD)-Problems verursacht wird, bei dem Benutzer mit geolokalisierungsbasierten Richtlinien f\u00fcr den bedingten Zugriff betroffen waren.\u00a0 Ich hatte \u00fcber dieses Problem im Blog-Beitrag Microsoft 365: Nutzer versehentlich per Geo-Location ausgesperrt (23. M\u00e4rz 2023)<\/a> berichtet. Diese Ursache hat Microsoft dann in weiteren Statusmeldungen best\u00e4tigt.<\/p>\n

Wir haben eine Reihe von betroffenen IPs mit falschen Geolokalisierungs-Klassifizierern best\u00e4tigt und sind dabei, eine Regel anzuwenden, die sicherstellt, dass alle neuen Nachrichten \u00fcber die erwartete Geolokalisierung geleitet und zugestellt werden. Sobald dieser Prozess abgeschlossen ist, werden wir uns darauf konzentrieren, die zuvor betroffenen Nachrichten erneut abzuspielen, um sie aus der Quarant\u00e4ne zu befreien und das Problem vollst\u00e4ndig zu l\u00f6sen.<\/p><\/blockquote>\n

Ursache war wohl ein Fehler bei der Markierung der Geolokalisierungsdaten, der dazu f\u00fchrte, dass einer Reihe von betroffenen IPs falsche Geolokalisierungsklassifizierer zugewiesen wurden. Microsoft hat dann Backups zur\u00fcckgerollt, um den Fehler zu beheben. Hier noch die betreffenden Status-Mitteilungen zum Vorfall.<\/p>\n

Vorfall: EX534197, betroffener Dienst: Exchange Online, betroffenes Feature: signin, aktueller Status: Service degradation<\/p>\n

Published Time: 29.03.2023 11:09:30
\nTitle: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online
\nUser impact: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online.
\nCurrent status: The deployment of the fix is taking longer than expected due to additional validation steps. We're continuing to monitor the progress of the fix as it deploys to all affected environments. We anticipate its completion time by our next scheduled update.
\nScope of impact: Your organization is affected by this event and any user may notice that some email that they view as legitimate are quarantined.
\nStart time: Tuesday, March 28, 2023, at 10:00 AM UTC
\nRoot cause: A recent issue affecting our geolocation data marking resulted in a range of affected IPs being assigned incorrect geolocation classifiers, resulting in impact.
\nNext update by: Wednesday, March 29, 2023, at 10:00 PM UTC
\nPublished Time: 29.03.2023 06:23:28
\nTitle: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online
\nUser impact: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online.
\nCurrent status: We're continuing to monitor the progress of the fix and we anticipate its completion by the next scheduled update.
\nScope of impact: Your organization is affected by this event and any user may notice that some email that they view as legitimate are quarantined.
\nStart time: Tuesday, March 28, 2023, at 10:00 AM UTC
\nRoot cause: A recent issue affecting our geolocation data marking resulted in a range of affected IPs being assigned incorrect geolocation classifiers, resulting in impact.
\nNext update by: Wednesday, March 29, 2023, at 3:00 PM UTC
\nPublished Time: 28.03.2023 23:44:28
\nTitle: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online
\nUser impact: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online.
\nCurrent status: We've successfully gathered the full list of affected IPs and initiated the process of replaying the impacted messages, which will release the incorrectly sorted email from quarantine. We're expecting this process to fully resolve the impact of this issue, and it may complete as early as the time of our next scheduled update.
\nScope of impact: Your organization is affected by this event and any user may notice that some email that they view as legitimate are quarantined.
\nStart time: Tuesday, March 28, 2023, at 10:00 AM UTC
\nRoot cause: A recent issue affecting our geolocation data marking resulted in a range of affected IPs being assigned incorrect geolocation classifiers, resulting in impact.
\nNext update by: Wednesday, March 29, 2023, at 10:00 AM UTC
\nPublished Time: 28.03.2023 21:19:34
\nTitle: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online
\nUser impact: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online.
\nCurrent status: We've utilized a recent backup of our IP geolocation data to restore the affected IPs' incorrect geolocation classifiers, preventing further impact from the issue. Going forward, we're currently working to gather a full list of affected IPs so we can replay the impacted messages, releasing incorrectly sorted email from quarantine. We're aiming to begin the process by the time of our next scheduled update, at which point we should be able to provide a timeline for full remediation of the impact.
\nScope of impact: Your organization is affected by this event and any user may notice that some email that they view as legitimate are quarantined.
\nRoot cause: A recent issue affecting our geolocation data marking resulted in a range of affected IPs being assigned incorrect geolocation classifiers, resulting in impact.
\nNext update by: Wednesday, March 29, 2023, at 4:00 AM UTC
\nPublished Time: 28.03.2023 19:04:37
\nTitle: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online
\nUser impact: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online.
\nCurrent status: We've confirmed a range of affected IPs with incorrect geolocation classifiers, and we're in the process of applying a rule to ensure any new messages are routed through the expected geolocation and delivered. Once this process is complete, we will focus on replaying the previously affected messages to release them from quarantine and fully resolve this issue. We anticipate having a better estimation for impact resolution by our next update.
\nScope of impact: Your organization is affected by this event and any user may notice that some email that they view as legitimate are quarantined.
\nNext update by: Wednesday, March 29, 2023, at 12:30 AM UTC
\nPublished Time: 28.03.2023 17:18:21
\nTitle: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online
\nUser impact: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online.
\nCurrent status: We suspect that this issue is caused by residual impact from a previous Azure Active Directory (Azure AD) issue in which users with geolocation-based conditional access policies were impacted. We're reviewing samples of affected users to investigate the affected API calls, confirm our hypothesis, and determine our next troubleshooting steps.
\nScope of impact: Your organization is affected by this event and any user may notice that some email that they view as legitimate are quarantined.
\nNext update by: Tuesday, March 28, 2023, at 10:30 PM UTC
\nPublished Time: 28.03.2023 15:19:58
\nTitle: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online
\nUser impact: Users' incoming email is intermittently and unexpectedly quarantined in Exchange Online.
\nCurrent status: We're reviewing system logs and samples of affected messaged to isolate the origin of this issue.
\nScope of impact: Your organization is affected by this event and any user may notice that some email that they view as legitimate are quarantined.
\nNext update by: Tuesday, March 28, 2023, at 8:30 PM UTC
\nPublished Time: 28.03.2023 14:51:55
\nTitle: We're looking into a potential problem
\nUser impact: We're checking for potential impact to your users.
\nCurrent status: We're investigating a potential issue and checking for impact to your organization. We'll provide an update within 30 minutes.<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

[English]Microsofts Cloud-Dienst Exchange Online ist vorgestern und gestern (28.\/29. M\u00e4rz 2023) wohl gest\u00f6rt gewesen. Die St\u00f6rung begann bereits am 28. M\u00e4rz 2023 um ca. 14:00 Uhr, als Nutzer sich nicht mit anmelden konnten. Microsoft hat das best\u00e4tigt und schreibt, dass … Weiterlesen →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7263,7862],"tags":[1171,987],"class_list":["post-279175","post","type-post","status-publish","format-standard","hentry","category-cloud","category-stoerung","tag-cloud","tag-storung"],"_links":{"self":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/279175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/comments?post=279175"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/279175\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/media?parent=279175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/categories?post=279175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/tags?post=279175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}