The load-bearing words in Microsoft's alert are narrow ones. Anti-spam protections "may be contributing to impact for a subset of users" [5]. That is a partial cause for part of the population, and Microsoft says it is still analysing behaviour and reviewing service telemetry to find the underlying one [6]. The company separately describes anti-spam protections as aggravating the delays for affected accounts [4]. It marks a contributor Microsoft has already located, one piece of the picture rather than the whole explanation for every message stuck at the boundary.
For anyone looking at a queue this morning, the useful thing the incident number does is close a line of investigation. The fault is in the service, and it is scoped to mail sent to and received from external domains [1], with intermittent "Server busy" errors across multiple mailboxes [3]. The fault sits in the service, so today's work is tracking the incident, leaving connectors, transport rules and sender authentication records that worked yesterday untouched.
What the alert will not give you is reach. No regions named, no user count [8]. The classification Microsoft applied, incident, usually means noticeable user impact [9], which describes severity rather than how much of your own tenant is affected. Internal comms have to be written from local queue depth, because that is the only measurement available.
The public record behind this one lists several disruptions: April's Exchange Online outage that blocked mailbox and calendar access through Outlook on the web, Outlook desktop and Exchange ActiveSync [10]; June's mail flow problem across North America, Asia-Pacific and Europe [11]; Thursday's Microsoft 365 outage that hit authentication and produced connection failures and service delays [12]; and now EX1467029. Four since April, two of them in mail flow specifically [14].
Nothing in Microsoft's alert or in BleepingComputer's reporting points to an attacker or to data compromise [15]. The security-relevant part of a mail flow outage is what gets done to controls while the queue grows. Microsoft has named its own anti-spam protections as a contributor [5], which makes filtering the obvious place a pressured admin reaches. A deferral that clears when Microsoft mitigates costs less than a bypass rule that survives the incident by six months.
Microsoft set no remediation timeline and said it would provide further details later the same day [7]. The only milestone Microsoft has committed to is an update, short of a fix, and BleepingComputer was still tracking the event as developing [13].
