Microsoft Sentinel API failures and delays in East US, East US 2, and West US regions

Incident Report for Kudelski Security

Resolved

The incident has been resolved and services are back to normal. We thank you for your patience and understanding.
Posted Nov 03, 2026 - 15:31 UTC

Monitoring

It seems that the issue has been fixed by Microsoft. We started to have again API access to Sentinel instance.
We will monitor the situation to confirm a full resolution.
Posted Nov 03, 2026 - 14:21 UTC

Update

Impacted regions has been update from Microsoft : Southeast Asia, East US, West US 2, West US 3, Canada Central, North Central US, Jio India West, Central US, Japan West, Australia Southeast, Qatar Central, Central India, East Asia, UAE Central, Canada East, West US, South Africa North, East US 2, Australia Central, Japan East, Korea South, Brazil South, West Central US, South Central US, Australia East, UAE North, Korea Central

The CFC continue to manually monitoring incidents in Sentinel console as API access is still not fixed by Microsoft and has extend this monitoring to the newly published list of impacted regions.

Last status from Microsoft :
We detected this issue through our automated service monitoring after identifying a significant increase in unsuccessful requests. Our investigation remains focused on a backend dependency that is not consistently starting and processing requests as expected, resulting in request failures and intermittent errors. We have applied several mitigation actions, including reverting a recent change, redeploying the affected components, and correcting supporting configuration; however, full recovery has not yet been confirmed. We are still validating the cause of the incident while working on mitigation workstreams to restore full service, including comparing diagnostic data from functioning and affected components and evaluating additional recovery actions.
Posted Nov 03, 2026 - 13:49 UTC

Update

Microsoft is still working on the issue, we will continue to monitor update from their side.

As a temporary solution, the CFC will start to monitor MS Sentinel incidents directly inside the MS Sentinel console for impacted clients.
This will allow to perform the monitoring in a best effort mode while MS fix this incident.
Posted Nov 03, 2026 - 09:09 UTC

Identified

Microsoft is currently experiencing Sentinel API failures and delays in East US, East US 2, and West US regions.
Microsoft EMEA customers are not impacted by this issue.

More information can be found here : https://app.azure.com/h/7H5N-XK8/d09a5a

We are currently following the incident and will update this page in the next 1 hour.
Posted Nov 03, 2026 - 07:51 UTC
This incident affected: Security Alert / Event Ingestion Pipeline / Managed System Access.