Microsoft Corporation

ProxyLogon は、緊急 Exchange Server パッチの発行は修理の始まりに過ぎないことを示した。インターネットに面したオンプレミスのメールサーバーが大規模に悪用されると、公的機関、学校、中小企業、マネージドサービスプロバイダー、企業、ユーザーは、見出しとなるパッチウィンドウが過ぎた後でも、サーバーが発見され、更新され、調査され、クリーンアップされ、監視され、攻撃者の永続化から保護されたという証拠を必要としていた。

ProxyLogon showed that issuing emergency Exchange Server patches is only the beginning of repair. Once internet-facing on-premises email servers had been exploited at scale, public agencies, schools, small businesses, managed-service providers, enterprises, and users needed proof that servers were found, updated, investigated, cleaned, monitored, and protected against attacker persistence after the headline patch window had passed.

Microsoft is a risk and accountability case because the September 2020 Azure Active Directory authentication outage showed that identity is not a side function of cloud productivity. It is a control plane for Microsoft 365, administrator access, enterprise SaaS workflows, remote work, schools, public agencies, and security operations that need recovery evidence at the level of practical user access.

Microsoft Storm-0558 is a risk and accountability case because the accountability issue is that cloud customers cannot independently reconstruct provider-side token failures unless the provider preserves, exposes, and explains the logs needed for proof. The public record matters for government agencies, enterprise tenants, security teams, diplomats, auditors, and cloud buyers needed evidence that token compromise could be detected and scoped even when the root control sat inside the provider.

Storm-0558 was not only a story about a stolen Microsoft signing key and a token-validation defect. It tested whether a cloud provider that alone controls signing material, validation logic, service-side telemetry, mailbox-access logs, key rollover, and customer evidence can demonstrate operational control over harm after the trust decision has already failed.

A 2016 consumer signing key, an enterprise token-validation defect, premium-gated audit data, and an unresolved key-acquisition path combined to let a state-linked actor read government cloud mail. The incident shows why accountability in a shared cloud must follow control over identity infrastructure, evidence, and remediation rather than the visibility of the customer whose mailbox was opened.

Microsoft's moat is not a single software product. It's the compound dependency created when identity, collaboration, security, cloud capacity, procurement contracts, and AI infrastructure all sit inside the same enterprise account.