Our subscription is cancelled due to malicious activity and production is completely down.

Question

Our subscription is cancelled due to malicious activity and production is completely down.

Jagdish Mishra 0

We have created support request # <PII Removed> for production environment which is down as Azure has cancelled the subscription due to malicious activity.

Due to inactivity of production environment, our clients are not able to access the application and we have financial impact.

Please look into the issue urgently.

Shabana Sohail 331 Reputation points

2026-06-04T07:58:27.2133333+00:00
Here’s a practical, urgent recovery path:

Confirm Azure subscription status

Check if it is disabled, suspended, or fully terminated in the Azure Portal.

If disabled due to “malicious activity,” it usually requires Microsoft Support re-evaluation.

Immediately raise/upgrade Azure Support ticket

Use billing + subscription recovery category

Clearly state:

Business impact (production down, financial loss)

“False positive / compromised resource already contained (if applicable)”

Request emergency reactivation or soft delete restore

Secure the environment (important for reinstatement)

Reset all admin credentials

Rotate keys/secrets (Storage, App Services, Key Vault, etc.)

Review Azure Activity Logs for suspicious actions

Check for compromised resources (VMs, functions, API abuse)

Check subscription recovery options

If “soft-deleted,” Azure may allow reactivation within retention window

If fully closed, Microsoft may still restore within limited grace period (case-by-case)

Create temporary fallback environment

Deploy backup infrastructure (if available)

Restore from latest backups / snapshots

Point DNS to standby environment if possible

Prevent recurrence

Enable Azure Security Center / Defender alerts

Set budget + anomaly alerts

Apply RBAC least privilege

Enable activity monitoring and log alerts
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-06-04T08:02:16.1666667+00:00

Hello Jagdish Mishra, thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks
Jagdish Mishra 0 Reputation points

2026-06-04T08:36:55.3166667+00:00

Hi Bharat, Can we get on call? Please share contact details.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-06-04T08:41:22.36+00:00

Hello Jagdish Mishra ,We have reached out to you in Private messages for additional details, could you please look into it and share us the details? Thanks
Jagdish Mishra 0 Reputation points

2026-06-04T09:43:34.7533333+00:00

Hi Bharath,

I have provided you requested details and other issue details for better understanding.

Please note that our production is completely down and we need immediate attention to solve the issue.

Thanks,
Divjot Singh 0 Reputation points

2026-06-04T10:41:15.5266667+00:00

Hi Bharat,

When can we see the resolution?

The malicious attack from external resource. we are a mature organization and do not indulge ourselves in any activity that does not legal.

Looking for quick response and activation of our accounts.

Thanks.

Divjot Singh
Jagdish Mishra 0 Reputation points

2026-06-04T12:04:43.82+00:00

Incident is still open and no response from Azure team even if production environment is down which is quite weird. Still waiting response from Azure team.

Your answer

Shabana Sohail 331 Reputation points

2026-06-04T07:58:27.2133333+00:00

Here’s a practical, urgent recovery path:

Confirm Azure subscription status

Check if it is disabled, suspended, or fully terminated in the Azure Portal.

If disabled due to “malicious activity,” it usually requires Microsoft Support re-evaluation.

Immediately raise/upgrade Azure Support ticket

Use billing + subscription recovery category

Clearly state:

Business impact (production down, financial loss)

“False positive / compromised resource already contained (if applicable)”

Request emergency reactivation or soft delete restore

Secure the environment (important for reinstatement)

Reset all admin credentials

Rotate keys/secrets (Storage, App Services, Key Vault, etc.)

Review Azure Activity Logs for suspicious actions

Check for compromised resources (VMs, functions, API abuse)

Check subscription recovery options

If “soft-deleted,” Azure may allow reactivation within retention window

If fully closed, Microsoft may still restore within limited grace period (case-by-case)

Create temporary fallback environment

Deploy backup infrastructure (if available)

Restore from latest backups / snapshots

Point DNS to standby environment if possible

Prevent recurrence

Enable Azure Security Center / Defender alerts

Set budget + anomaly alerts

Apply RBAC least privilege

Enable activity monitoring and log alerts
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-06-04T08:02:16.1666667+00:00

Hello Jagdish Mishra, thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks
Jagdish Mishra 0 Reputation points

2026-06-04T08:36:55.3166667+00:00

Hi Bharat, Can we get on call? Please share contact details.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-06-04T08:41:22.36+00:00

Hello Jagdish Mishra ,We have reached out to you in Private messages for additional details, could you please look into it and share us the details? Thanks
Jagdish Mishra 0 Reputation points

2026-06-04T09:43:34.7533333+00:00

Hi Bharath,

I have provided you requested details and other issue details for better understanding.

Please note that our production is completely down and we need immediate attention to solve the issue.

Thanks,
Divjot Singh 0 Reputation points

2026-06-04T10:41:15.5266667+00:00

Hi Bharat,

When can we see the resolution?

The malicious attack from external resource. we are a mature organization and do not indulge ourselves in any activity that does not legal.

Looking for quick response and activation of our accounts.

Thanks.

Divjot Singh
Jagdish Mishra 0 Reputation points

2026-06-04T12:04:43.82+00:00

Incident is still open and no response from Azure team even if production environment is down which is quite weird. Still waiting response from Azure team.