On June 21, 2023, Microsoft experienced a global disruption affecting access to the Azure portal, Microsoft Intune, Entra administration surfaces and Windows 365. Microsoft initially described an unusual traffic surge and later identified the trigger as a Layer 7, or application-layer, distributed denial-of-service (DDoS) attack. Load-balancing changes and continued telemetry monitoring restored service. The incident affected management access; it did not establish that every Azure workload, enrolled device or Microsoft 365 service stopped working.
What happened on June 21, 2023
Administrators reported errors, failed loads and intermittent access when opening the Azure portal, Intune admin center, Entra-related administration surfaces and Windows 365 portal. Azure publicly listed an issue involving errors accessing the Azure portal, and contemporary coverage described the scope as global rather than confined to one tenant or region. The incident was later marked fixed after Microsoft applied mitigations and monitored recovery. The contemporary account is documented at AnooP Nair.
As an Amazon Associate I earn from qualifying purchases.
This was not evidence that the entire Azure cloud went offline. Azure has separate services and control planes, and a portal-access failure does not by itself prove that virtual machines, storage, customer applications or every API failed.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMicrosoft’s explanation changed as the incident was investigated
- Initial reports: Users could not reliably reach several Microsoft administration portals.
- Operational finding: Microsoft described a sudden influx of traffic that reduced the effective capacity of request-management systems.
- Root-cause update: Microsoft identified the trigger as a Layer 7 DDoS attack.
- Mitigation: Microsoft applied load-balancing remediations and continued examining telemetry.
- Recovery: Service indicators showed recovery, although individual users could have recovered at different times depending on region, network path, cached sessions and the specific portal operation.
The useful postmortem distinction is that the DDoS was the trigger, while the traffic-management and request-management path influenced how severely access was degraded. The available material does not establish a responsible attacker, a data breach or compromised customer tenants.
#1 Best Overall
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
What a Layer 7 DDoS means
A distributed denial-of-service attack sends traffic from many sources to exhaust a target’s capacity. A Layer 7 attack operates at the application layer: it can generate large numbers of HTTP requests, sessions, API calls or other requests that look closer to normal application activity than a simple flood of network bandwidth.
That distinction matters for administration portals. Even when network links and underlying workloads remain reachable, application gateways, authentication flows, request queues and management services can become overloaded. Microsoft’s description of reduced request-management effectiveness and subsequent load-balancing changes is consistent with an availability event in that path. It does not mean Microsoft’s DDoS defenses were absent, nor does it prove that all defenses failed.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Which services were affected?
| Category | Services or surfaces |
|---|---|
| Clearly reported as affected | Azure Portal, Microsoft Intune admin center, Entra-related administration portals and Windows 365 portal |
| Reported as available in contemporary coverage | Microsoft 365 admin center and Microsoft Defender portal |
| Potentially indirectly affected | Administrative workflows that required portal authentication, management-plane access or shared Microsoft front-end infrastructure |
Contemporary reporting also referenced Microsoft incident IT579104, describing users as potentially unable to access the Intune service and portal. That identifier is attributed to the contemporaneous report rather than presented as a directly verified Microsoft Service Health record.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A portal outage and a service-plane outage are different events. Existing Conditional Access behavior, device check-in, previously configured policy enforcement and application deployment may continue, stop or be delayed depending on the affected service, authentication path, cached state and timing. There is no evidence here that all Intune devices stopped receiving policies or that every Intune operation failed.
Rank #3
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
What “fixed” meant
“Fixed” meant Microsoft had applied mitigations and its telemetry indicated recovery. It did not guarantee that every user saw identical recovery at the same moment. A landing page could load while a blade, API call or management action remained degraded. Administrators should therefore verify the operation they actually need, not rely only on a successful page refresh.
What administrators should do during a similar outage
- Check public status: Use the Azure status page. It is useful for broad incidents but may not show tenant-specific, government-cloud, regional or portal-only failures.
- Check tenant-specific health: If the Microsoft 365 admin center is available, review Service Health there; use Azure Service Health for Azure subscriptions.
- Separate access from operation: Test one narrowly scoped, low-risk action or inspect device check-in and policy status only when doing so will not create additional risk.
- Use existing automation carefully: Approved Microsoft Graph, Azure CLI, PowerShell or infrastructure-as-code workflows may provide another path. Do not assume an API is healthy simply because the portal is unavailable, and do not start broad changes during an uncertain control-plane incident.
- Avoid destructive retries: A request may have succeeded even when the portal failed to display its result. Repeating enrollment, policy or configuration actions can create duplicates or inconsistent state.
- Preserve evidence: Record UTC time, tenant, region, endpoint, browser, error code and whether the problem affected sign-in, portal loading, a specific blade or the underlying operation.
- Verify recovery: Wait for official recovery information, then confirm critical administrative actions and reports work normally.
Do not confuse this incident with later Microsoft outages
| Date | Incident | How it differs |
|---|---|---|
| June 21, 2023 | Azure, Intune, Entra and Windows 365 portal disruption | Layer 7 DDoS trigger; this is the incident covered here. |
| July 30–31, 2024 | Broader Azure and Microsoft 365 disruption | A separate DDoS-triggered event; Microsoft said an error in its defensive implementation amplified the impact. BleepingComputer |
| October 29, 2025 | Azure Front Door-related disruption | A separate incident associated with a configuration change, not the 2023 DDoS event. Build5Nines |
What organizations can prepare in advance
- Subscribe to Microsoft 365 and Azure Service Health notifications and define an internal escalation path.
- Document low-risk break-glass procedures and keep tested Graph or PowerShell automation for approved, repeatable tasks.
- Protect and monitor your own Azure-hosted applications with services such as Azure DDoS Protection, Azure Front Door and Azure Monitor. These protect customer workloads; they cannot restore Microsoft-operated Intune or Azure portals.
- Use Service Health documentation to distinguish local workload failures from platform incidents.
- Treat Microsoft Graph Intune automation as a controlled fallback, not a guaranteed bypass: APIs may share dependencies with an affected control plane.
Pricing for Azure DDoS Protection and Front Door varies by region, tier, protection level, data processing and usage. Consult the official DDoS Protection pricing and Front Door pricing pages rather than relying on an undated figure.
Rank #4
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
The bottom line
The June 21, 2023 event was a global management-plane availability disruption affecting several Microsoft administration portals. Microsoft later confirmed an application-layer DDoS trigger and reported load-balancing remediation and telemetry-based recovery. It was not proof that all Azure workloads or Intune device operations stopped, and nothing in the available incident material establishes data theft, credential compromise or unauthorized tenant access.
Quick Recap
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
