Microsoft Nightmare - Data Protection team

Hi AEIi_819,

Thanks so much for reaching out and letting us know. I am so sorry about the issue with the phone support system. That said, I know that doesn't make up for the revenue you lost and may not get back. I completely understand you could have lost business because of this issue, and that's not acceptable.

Therefore, may l know what kind of issue are you facing now? Is there any error message? If you would like, could you please kindly provide us screenshot of error code? We will try our best to offer feasible workarounds or suggestions. In the meantime, you can wait for Data Protection Team's call back.

We would like to let you know that Microsoft takes customer feedback very seriously as we are always striving to improve our services. We welcome any additional feedback you may have. Thank you for your understanding.

Sincerely,

Tammy | Microsoft Community Moderator.

Hi Tammy,

Thanks for your reply.

I was setting up Conditional Access for a new (in preview) MFA Strength Authentication that has an option for Passwordless login. Sadly this method has a serious bug, and it locked everyone out. I didn’t expect such a big flaw on a production-level feature at Microsoft. 

See here video recording when I try to log in with SMS: 

And see here a video recording where I try to log in with Authenticator App:

To clarify, both methods work fine meaning I enter the correct password and have MFA configured correctly. But due to the bug in your system, it goes into an infinite loop. Data Protection team emailed me with the same comment that I answered to them at least 5 times to 5 different people in 5 different time points over 4 days! I am really shocked that no one takes proper noted or don't read case information.

This is a bug as you can see from screen recording above. But the Data Protection Team is asking me to contact third-party provider or find someone with global admin rights. Obviously, these options don't work, and they asked me about these over the phone 5 times, an eventually said we get an engineer to contact you, that has not happened.

The case number I have with them is 34xxxx20. They escalated to Data Protection Team, and they follow the same exact procedure that is identical to a black hole.

No one has access to, OneDrive, Emails, Slack (SSO config), ClickUp (SSO config), Password Manager (SSO config) and essentially the business is fully down. I talked to a senior supervisor this morning over the phone, and she confirmed that this is a bug and escalated to another team. As of now, all my systems are down, but I am hoping to hear back from someone.

Update on this. I talked to 4 more poople today at Microsoft. All 4 promised a call back today from someone who can do something. No one has called and it is now 21:00. My new employees who were supposed to start tomorrow had to be delayed as all systems are down. Microsoft is totally incompetent in dealing with highly urgent situations. I have at least 4 different case numbers and not a single person has ever called!

Update, it is end of day 5 that my business is fully down. I received multiple calls today, to try to login again etc, which obviously hasn’t been possible. They promised to restore my access tomorrow. Every hour that this is delayed is costing me, but sadly Microsoft is really incompetent in handling urgent situations, considering this is bug from Microsoft not my fault!

Update: the issue was resolved on day 6.

Lessons for people with same MFA / authentication problem:

1. I called Microsoft and they logged tickets for 4 days, and no one called back despite this a the most urgent situation (business was shut completely)
2. Every time you call, they create a new ticket to nudge the original person responsible for ticket to call you
3. None of the employees were capable to do anything aside from logging ticket, the only reason my case got resolved in 6 days, is because I insisted to the operator to connect me to his manager. The manager shared screen and logged information properly (after talking to 8 other people at Microsoft)
4. If your problem is with MFA, you probably don't need to talk to Data Protection Team! The manager told me this, and she created a case for me with Azure MFA Team, they called me in 24 hours and were on it until resolved, which took 48 hrs.

Lessons for Microsoft

1. When someone's account is locked out, you should not email the person to the same organisational email that is locked! Multiple people were emailing me to the account that I was unable to access and expected a response. But no one called in the first 4 days
2. You must put a mechanism in place for situations where a business is completely shut due to your services. It is costing them every hour. You must call them at least within a window of 4 to 6 hrs to at least update them about what is going on. I received no call for 4 days and had to keep calling back, and every time they created a new ticket!
3. Your operator, ask the exact same questions, despite the client is saying I answered these at least 4 times and without thinking they repeat the same thing again and again and when asked to connect to manager or supervisor, they refuse to do so. So me as the client had no way to talk to someone who thinks outside the box and doesn't just follow the procedure without thinking. I got really lucky that eventually someone did that, and that is how my issue was resolved.
4. After almost 7 days since I logged the ticket, I receive called from Data Protection Team that calling to help with locked out account! This is ridiculous that they picked up such an urgent ticket after such a long wait of days not hours.
5. I received at least 7 calls in one day to answer security questions. These took da full working day and by the end of the day our achievement was we managed to answer 7 security questions. This is extremely inefficient, this should had happened in one phone call that takes 30 minutes, then the case should had been handed to backend dev to make the change which would take him another 30 minutes. Worst case scenario it would be resolved in 4 hrs. But multiple calls, multiple communications, different people and different teams, makes the whole thing chaotic.

Anyway, I am grateful that you resolved the issue eventually, otherwise I would potentially file for bankruptcy. But I am very disappointed with how the case was handled. Your products are the best, you are one of the best, it is a shame if you don't resolve this internally.