“Microsoft has notified customers that it’s missing more than two weeks of security logs for some of its cloud products, leaving network defenders without critical data for detecting possible intrusions.”
From September 2 to September 19, Entra, Sentinel, Defender for Cloud and Purview silently dropped log data. The notice went to a handful of tenant admins, and Microsoft would not answer questions. A year ago the State Department caught Storm-0558 only because it paid for premium logging. Microsoft sells you the security product and then loses the evidence it was supposed to collect.