Feds to Microsoft: Clean Up Your Cloud Security Act Now

The DHS Cyber Safety Review Board concluded that Microsoft’s security failures enabled China-based Storm-0558 to breach Microsoft 365 accounts by using a compromised Microsoft consumer signing key to forge Azure AD tokens, affecting email accounts across ~25 government agencies; the board calls for Microsoft to prioritize cloud security, remove paywalled logging, hold leadership accountable, and publish a timeline for security-focused reforms while Microsoft announces a "Secure Future Initiative."