[BUG] Get-PnPServiceHealthIssue returns a null reference error when trying to get all issues: continued

[stvpwrs]

Reporting an Issue or Missing Feature

This bug is in reference to #3284

Expected behavior

A fix was merged #3286 however I am still seeing this issue in 2.2.26.

Actual behavior

ErrorRecord                 : Object reference not set to an instance of an object.
WasThrownFromThrowStatement : False
TargetSite                  : System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject] Invoke(System.Collections.IEnumerable)
Message                     : Object reference not set to an instance of an object.
Data                        : {[System.Management.Automation.Interpreter.InterpretedFrameInfo, System.Management.Automation.Interpreter.InterpretedFrameInfo[]]}
InnerException              : System.Management.Automation.PSInvalidOperationException: Object reference not set to an instance of an object.
                                 at PnP.PowerShell.Commands.Base.PnPConnectedCmdlet.ProcessRecord() in D:\a\powershell\powershell\src\Commands\Base\PnPConnectedCmdlet.cs:line 101
                                 at System.Management.Automation.CommandProcessor.ProcessRecord()
HelpLink                    : 
Source                      : System.Management.Automation
HResult                     : -2146233087
StackTrace                  :    at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
                                 at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
                                 at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
                                 at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
                                 at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
                                 at System.Management.Automation.PowerShell.Invoke[T](IEnumerable input, PSInvocationSettings settings)
                                 at Microsoft.PowerShell.EditorServices.Services.PowerShell.Utility.PowerShellExtensions.InvokeAndClear[TResult](PowerShell pwsh, PSInvocationSettings invocationSettings) in
                              D:\a\_work\1\s\src\PowerShellEditorServices\Services\PowerShell\Utility\PowerShellExtensions.cs:line 76
                                 at Microsoft.PowerShell.EditorServices.Services.PowerShell.Utility.PowerShellExtensions.InvokeCommand[TResult](PowerShell pwsh, PSCommand psCommand, PSInvocationSettings invocationSettings) in
                              D:\a\_work\1\s\src\PowerShellEditorServices\Services\PowerShell\Utility\PowerShellExtensions.cs:line 99
                                 at Microsoft.PowerShell.EditorServices.Services.PowerShell.Execution.SynchronousPowerShellTask`1.ExecuteNormally(CancellationToken cancellationToken) in
                              D:\a\_work\1\s\src\PowerShellEditorServices\Services\PowerShell\Execution\SynchronousPowerShellTask.cs:line 132

Steps to reproduce behavior

$forPnPPowerShell = @{
    Force           = $true
    Name            = 'PnP.PowerShell'
    RequiredVersion = '2.2.26'
}
Import-Module @forPnPPowerShell

$withAppPermissions = @{
    ClientID         = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
    ReturnConnection = $true
    Tenant           = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
    Thumbprint       = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
    Url              = 'https://<tenant>-admin.sharepoint.com'
}
$connection = Connect-PnPOnline @withAppPermissions

$issues = Get-PnPServiceHealthIssue -Connection $connection

# This will work
# $issues = @(Get-PnPServiceHealthIssue -Connection $connection -Identity 'TM649896')

$issues.Count

What is the version of the Cmdlet module you are running?

Loaded:

oduleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Manifest   7.0.0.0               Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear-ItemProperty…}
Manifest   7.0.0.0               Microsoft.PowerShell.Security       {ConvertFrom-SecureString, ConvertTo-SecureString, Get-Acl, Get-AuthenticodeSignature…}
Manifest   7.0.0.0               Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Object…}
Manifest   2.2.26     nightly    PnP.PowerShell                      {Add-PnPAlert, Add-PnPApp, Add-PnPApplicationCustomizer, Add-PnPAvailableSiteClassification…}
Script     0.2.0                 PowerShellEditorServices.Commands   {Clear-Host, ConvertFrom-ScriptExtent, ConvertTo-ScriptExtent, Find-Ast…}
Binary     0.2.0                 PowerShellEditorServices.VSCode     {Close-VSCodeHtmlContentView, New-VSCodeHtmlContentView, Set-VSCodeHtmlContentView, Show-VSCodeHtmlContentView…}
Script     2.2.6                 PSReadLine                          {Get-PSReadLineKeyHandler, Get-PSReadLineOption, Remove-PSReadLineKeyHandler, Set-PSReadLineKeyHandler…}

Available:

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Manifest   2.2.26     nightly    PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}
Manifest   2.2.25     nightly    PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}
Manifest   2.2.21     nightly    PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}
Manifest   2.2.0                 PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}
Manifest   2.1.1                 PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}

    Directory: C:\Program Files\WindowsPowerShell\Modules

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Manifest   1.12.0                PnP.PowerShell                      Core,Desk {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}
Manifest   1.11.0                PnP.PowerShell                      Core,Desk {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}
Manifest   1.10.0                PnP.PowerShell                      Core,Desk {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Copy-PnPFolder, Export-PnPClientSidePage…}

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[gautamdsheth]

@stvpwrs - can't reproduce this now, maybe you can delete the old versions of this module and then try ? Or maybe try on a different machine ?

[stvpwrs]

@gautamdsheth this is also happening on a new VM with a brand new install of PowerShell 7.3.6.

I went ahead and grabbed all of the issues I could see directly against the Graph REST API and then tried enumerating through the collection manually. I ran into the following error on DZ534539.

ErrorRecord                 : The property 'Classification' cannot be found on this object. Verify that the property exists.
WasThrownFromThrowStatement : False
TargetSite                  : System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject] Invoke(System.Collections.IEnumerable)
Message                     : The property 'Classification' cannot be found on this object. Verify that the property exists.
Data                        : {[System.Management.Automation.Interpreter.InterpretedFrameInfo, System.Management.Automation.Interpreter.InterpretedFrameInfo[]]}
InnerException              :
HelpLink                    :
Source                      : System.Management.Automation
HResult                     : -2146233087
StackTrace                  :    at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
                                 at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
                                 at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
                                 at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
                                 at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
                                 at System.Management.Automation.PowerShell.Invoke[T](IEnumerable input, PSInvocationSettings settings)
                                 at Microsoft.PowerShell.EditorServices.Services.PowerShell.Utility.PowerShellExtensions.InvokeAndClear[TResult](PowerShell pwsh, PSInvocationSettings invocationSettings) in
                              D:\a\_work\1\s\src\PowerShellEditorServices\Services\PowerShell\Utility\PowerShellExtensions.cs:line 82
                                 at Microsoft.PowerShell.EditorServices.Services.PowerShell.Execution.SynchronousPowerShellTask`1.ExecuteNormally(CancellationToken cancellationToken) in
                              D:\a\_work\1\s\src\PowerShellEditorServices\Services\PowerShell\Execution\SynchronousPowerShellTask.cs:line 194

New code

$forPnPPowerShell = @{
    Force           = $true
    Name            = 'PnP.PowerShell'
    RequiredVersion = '2.2.27'
}
Import-Module @forPnPPowerShell

$withAppPermissions = @{
    ClientID         = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
    ReturnConnection = $true
    Tenant           = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
    Thumbprint       = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
    Url              = 'https://<tenant>-admin.sharepoint.com'
}
$connection = Connect-PnPOnline @withAppPermissions

$issue = Get-PnPServiceHealthIssue -Connection $connection -Identity 'DZ534539'

$issue.Classification

The overall troubleshooting code I ran is as follows with DZ534539 being the first encountered error:

$forPnPPowerShell = @{
    Force           = $true
    Name            = 'PnP.PowerShell'
    RequiredVersion = '2.2.27'
}
Import-Module @forPnPPowerShell

$withAppPermissions = @{
    ClientID         = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
    ReturnConnection = $true
    Tenant           = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
    Thumbprint       = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
    Url              = 'https://<tenant>-admin.sharepoint.com'
}
$connection = Connect-PnPOnline @withAppPermissions

$ids = @(
    'AH550094'
    'AH554246'
    'AH567271'
    'CR513511'
    'CR532710'
    'CR556051'
    'CR560950'
    'CR574556'
    'CS563098'
    'CS589110'
    'CS608511'
    'CS612997'
    'CS637057'
    'CS646823'
    'CS649207'
    'CS661704'
    'DZ509792'
    'DZ509838'
    'DZ510128'
    'DZ510134'
    'DZ510387'
    'DZ510559'
    'DZ512889'
    'DZ513313'
    'DZ515739'
    'DZ518851'
    'DZ522243'
    'DZ522273'
    'DZ522284'
    'DZ523615'
    'DZ524550'
    'DZ524937'
    'DZ525672'
    'DZ526060'
    'DZ527905'
    'DZ534539'
    'DZ534548'
    'DZ534562'
    'DZ534798'
    'DZ537309'
    'DZ541393'
    'DZ543693'
    'DZ552560'
    'DZ553019'
    'DZ559822'
    'DZ562493'
    'DZ565818'
    'DZ588862'
    'DZ598280'
    'DZ615064'
    'DZ621981'
    'DZ623722'
    'DZ625152'
    'DZ627359'
    'DZ629463'
    'DZ646643'
    'DZ649064'
    'EX496574'
    'EX505293'
    'EX509554'
    'EX512238'
    'EX513457'
    'EX516750'
    'EX518886'
    'EX522020'
    'EX522674'
    'EX522882'
    'EX522975'
    'EX523372'
    'EX525309'
    'EX526419'
    'EX527428'
    'EX527972'
    'EX528773'
    'EX528891'
    'EX530405'
    'EX531842'
    'EX533537'
    'EX534197'
    'EX534645'
    'EX535069'
    'EX536634'
    'EX537209'
    'EX537848'
    'EX539594'
    'EX540503'
    'EX540990'
    'EX541106'
    'EX543234'
    'EX543659'
    'EX544221'
    'EX544330'
    'EX545565'
    'EX545580'
    'EX546390'
    'EX547111'
    'EX547161'
    'EX547588'
    'EX547730'
    'EX550453'
)

$ids | ForEach-Object {

    Write-Host "-----------------------------------------------------------"
    Write-Host "Begin $_"
    Write-Host "-----------------------------------------------------------"

    $issue = Get-PnPServiceHealthIssue -Connection $connection -Identity $_

    $issue.Classification
    $issue.Details
    $issue.EndDateTime
    $issue.Feature
    $issue.FeatureGroup
    $issue.HighImpact
    $issue.Id
    $issue.ImpactDescription
    $issue.IsResolved
    $issue.LastModifiedDateTime
    $issue.Origin
    $issue.Posts
    $issue.Service
    $issue.StartDateTime
    $issue.Status
    $issue.Title
}

Currently Loaded Modules:

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Manifest   7.0.0.0               Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear-ItemProperty…}
Manifest   7.0.0.0               Microsoft.PowerShell.Security       {ConvertFrom-SecureString, ConvertTo-SecureString, Get-Acl, Get-AuthenticodeSignature…}
Manifest   7.0.0.0               Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Object…}
Manifest   2.2.27     nightly    PnP.PowerShell                      {Add-PnPAlert, Add-PnPApp, Add-PnPApplicationCustomizer, Add-PnPAvailableSiteClassification…}
Script     0.2.0                 PowerShellEditorServices.Commands   {Clear-Host, ConvertFrom-ScriptExtent, ConvertTo-ScriptExtent, Find-Ast…}
Binary     0.2.0                 PowerShellEditorServices.VSCode     {Close-VSCodeHtmlContentView, New-VSCodeHtmlContentView, Set-VSCodeHtmlContentView, Show-VSCodeHtmlContentView…}
Script     2.2.6                 PSReadLine                          {Get-PSReadLineKeyHandler, Get-PSReadLineOption, Remove-PSReadLineKeyHandler, Set-PSReadLineKeyHandler…}

Currently Installed PnP.PowerShell Modules:

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Manifest   2.2.27     nightly    PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder…}

[stvpwrs]

@gautamdsheth so the plot thickens. Get-PnPServiceHealthIssue works in a different tenant. In another test tenant we have it returns Incident correctly for DZ534539.

From the same PC/VM we can run code that succeeds on one tenant and fails on another on the same Issue ID.

[gautamdsheth]

Awesome investigation !!
Unfortunately can't repro at all for that particular incident, not sure what we can do about it:

Maybe for the one failing tenant, you can grab the Graph response and post it here ?

[stvpwrs]

Thanks @gautamdsheth. Yeah, I'm at a loss here too. Below is some code I ran to hit the Microsoft Graph API with a manual web request and it works. The response looks normal to me.

The only things that stand out to me are:

1. HighImpact is in the PnP.PowerShell object, but isn't in the Graph Model.
2. When running Get-PnPServiceHealthIssue -Connection $connection -Identity 'DZ534539' the object never gets created. I don't know if that helps, but catching it in a variable will stop an error, but the object is null. Classification is alphabetically the first property, so it seems like it's failing there, but it appears to be failing to instantiate the PnP object at all.

$appId = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
$tenantId = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
$appSecret = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'

$tokenUri = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"

$body = @{
     client_id     = $appId
     scope         = 'https://graph.microsoft.com/.default'
     client_secret = $appSecret
     grant_type    = "client_credentials"
}

$forToken = @{
    Body            = $body
    ContentType     = 'application/x-www-form-urlencoded'
    Method          = 'Post'
    Uri             = $tokenUri
    UseBasicParsing = $true
}
$tokenRequest = Invoke-WebRequest @forToken

$token = ($tokenRequest.Content | ConvertFrom-Json).access_token

$headers = @{Authorization = "Bearer $token"}

$requestUri= 'https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues/DZ534539'

$forServiceAnnouncement = @{
    ContentType = 'application/json'
    Headers     = $headers
    Method      = 'Get'
    Uri         = $requestUri
}

$response = (Invoke-WebRequest @forServiceAnnouncement).Content | ConvertTo-Json -Depth 5

$response

This is the response I got. It looks normal to me:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#admin/serviceAnnouncement/issues/$entity",
    "startDateTime": "2023-03-29T07:00:00Z",
    "endDateTime": "2023-03-29T17:15:00Z",
    "lastModifiedDateTime": "2023-04-05T21:49:14.68Z",
    "title": "Admins received false alerts of user click activity for malicious URL links",
    "id": "DZ534539",
    "impactDescription": "Admins received false alerts of user click activity for malicious URL links.",
    "classification": "incident",
    "origin": "microsoft",
    "status": "postIncidentReviewPublished",
    "service": "Microsoft 365 Defender",
    "feature": "MDO",
    "featureGroup": "Microsoft Defender for Office 365",
    "isResolved": true,
    "details": [],
    "posts": [
        {
            "createdDateTime": "2023-03-29T11:16:31.383Z",
            "postType": "regular",
            "description": {
                "contentType": "html",
                "content": "Title: Admins may be receiving an unexpected amount of high severity alert email messages\n\nUser impact: Admins may be receiving an unexpected amount of high severity alert email messages.\n\nMore info: The high severity alert emails refer to 'A potentially malicious URL click was detected'. Additionally, admins may be unable to view alert details using the 'View alerts' link in the emails.\n \nCurrent status: We're reviewing service monitoring telemetry to isolate the root cause and develop a remediation plan.\n \nScope of impact: Impact is specific to any admin served through the affected infrastructure.\n \nNext update by: Wednesday, March 29, 2023, at 1:30 PM UTC"
            }
        },
        {
            "createdDateTime": "2023-03-29T12:10:25.94Z",
            "postType": "regular",
            "description": {
                "contentType": "html",
                "content": "Title: Admins are receiving false alerts that malicious URLs have been clicked\n\nUser impact: Admins may be receiving false alerts that malicious URLs have been clicked.\n\nMore info: Specifically, the alert emails refer to 'A potentially malicious URL click was detected'. Additionally, admins may be unable to view alert details using the 'View alerts' link in the emails or in the Microsoft Defender portal.\n\nCurrent status: Our initial investigation suggests that the notifications are false alerts. We\u2019re investigating further to verify and we\u2019re continuing to review service telemetry logs to identify the root cause and determine our next steps.\n\nScope of impact: Impact is specific to any admin served through the affected infrastructure.\n\nNext update by: Wednesday, March 29, 2023, at 1:30 PM UTC"
            }
        },
        {
            "createdDateTime": "2023-03-29T12:33:09.76Z",
            "postType": "quick",
            "description": {
                "contentType": "html",
                "content": "We've confirmed the alerts admins are receiving are false positives. We're investigating further to isolate the root cause and determine remediation steps.\n\nThis quick update is designed to give the latest information on this issue."
            }
        },
        {
            "createdDateTime": "2023-03-29T13:30:45.847Z",
            "postType": "regular",
            "description": {
                "contentType": "html",
                "content": "Title: Admins are receiving false alerts that malicious URLs have been clicked\n\nUser impact: Admins may be receiving false alerts that malicious URLs have been clicked.\n\nMore info: Specifically, the alert emails refer to 'A potentially malicious URL click was detected'. Additionally, admins may be unable to view alert details using the 'View alerts' link in the emails or in the Microsoft Defender portal. \n\nThis issue does not prevent the user from accessing the legitimate URL.\n\nCurrent status: We've confirmed that the false positive alerts are generated when a user clicks on a legitimate URL, as the legitimate link is being incorrectly marked as a malicious. This issue does not prevent the user from accessing the legitimate URL. We're reviewing network trace logs and diagnostic data related to URL reputation, to better understand which part of the service is incorrectly identifying the URL as malicious.\n\nScope of impact: Impact is specific to any admin served through the affected infrastructure.\n\nNext update by: Wednesday, March 29, 2023, at 3:30 PM UTC"
            }
        },
        {
            "createdDateTime": "2023-03-29T14:22:35.08Z",
            "postType": "quick",
            "description": {
                "contentType": "html",
                "content": "We've identified a backend service which may not be processing requests as expected, resulting in the missing information in the email alerts. We've also identified a potential root cause scenario which may be causing the legitimate URLs to be incorrectly identified as malicious, therefore generating the false positive alerts. We're investigating further to verify and determine our next steps.\n\nThis quick update is designed to give the latest information on this issue."
            }
        },
        {
            "createdDateTime": "2023-03-29T15:12:49.697Z",
            "postType": "quick",
            "description": {
                "contentType": "html",
                "content": "We're reviewing service telemetry logs to verify the identified potential root cause scenario. Additionally, we're continuing to find out why the service may not be processing requests as expected.\n\nThis quick update is designed to give the latest information on this issue."
            }
        },
        {
            "createdDateTime": "2023-03-29T15:36:18.23Z",
            "postType": "regular",
            "description": {
                "contentType": "html",
                "content": "Title: Admins are receiving false alerts that malicious URLs have been clicked\n\nUser impact: Admins may be receiving false alerts that malicious URLs have been clicked.\n\nMore info: Specifically, the alert emails refer to 'A potentially malicious URL click was detected'. Additionally, admins may be unable to view alert details using the 'View alerts' link in the emails or in the Microsoft Defender portal.\n\nThis issue does not prevent the user from accessing the legitimate URL.\n\nCurrent status: We're reviewing network telemetry data to verify the identified potential root cause scenario which may be responsible for causing clicks on legitimate URLs to generate false positive alerts. We're also investigating further to determine why the backend service is not processing requests as expected.\n\nScope of impact: Impact is specific to any admin served through the affected infrastructure.\n\nNext update by: Wednesday, March 29, 2023, at 5:30 PM UTC"
            }
        },
        {
            "createdDateTime": "2023-03-29T16:23:56.64Z",
            "postType": "strategic",
            "description": {
                "contentType": "html",
                "content": "We\u2019ve confirmed that the false positive alerts are received within the same queue as genuine alerts and there is no way to distinguish between them currently, so we do not recommend that admins dismiss any alerts at this time due to the potential impact from inadvertently dismissing a genuine alert.\u00a0\n\nWe're continuing to collect and review network telemetry data to verify the identified potential root cause scenario and determine our remediation plan.\n\nThis update is designed to give additional details on our remediation effort."
            }
        },
        {
            "createdDateTime": "2023-03-29T18:23:04.02Z",
            "postType": "regular",
            "description": {
                "contentType": "html",
                "content": "Title: Admins received false alerts of user click activity for malicious URL links\n\nUser impact: Admins received false alerts of user click activity for malicious URL links.\n\nMore info: Admins received a significant increase in the volume of Exchange Online Protection (EOP) Safe Links detection alerts via email and the Microsoft Defender admin center. The increased alert traffic occurred from a system issue that inadvertently began generating false alerts stating that \u201cA potentially malicious URL click was detected\u201d when a user clicked a link resolving to a known-safe domain.  \n\nThere was no impact to end user activity due to this problem; however, admins may have been prevented from isolating true alerts during the impact window, as these alerts were indistinguishable from genuine detections and delivered to the same queue and thus could not be dismissed.  \n\nWe previously reported through this notification an issue in which admins were intermittently unable to access additional details for URL click alerts from the \u2018View alerts\u2019 link within an alert email or in the Microsoft Defender admin center. Further details around this impact scenario may be found under DZ534548.\n\nFinal status: We\u2019ve identified that the recent addition of known-safe URL domains to the Safe Links time-of-click log processor service as domains in a goods state inadvertently caused the service to reprocess these URLs upon user click actions and falsely generating alerting events. These alerts were then delivered to admins as notifications of a potentially malicious URL click action from a user.\n\nWe\u2019ve reverted these additions and confirmed that admins are no longer receiving the false activity alerts. We\u2019re working to mark all false positive alerts as resolved and are building a full list of URLs associated with these alerts; however, we\u2019ve found that a large amount of them originated from URL clicks directing to Zoom.us domains. Admins may dismiss any of the alerts from this domain.\n\nStart time: Wednesday, March 29, 2023, at 7:00 AM UTC\n\nEnd time: Wednesday, March 29, 2023, at 5:15 PM UTC\n\nScope of impact: Impact was specific to any admin served through the affected infrastructure.\n\nRoot cause: The Safe Links time-of-click log processor identifies URLs that have changed from a good state to a bad state, generates an event when a URL click validation confirms this state change. The alerting service ingests these events and delivers a notification of the related activity to admins via email and Microsoft Defender admin center. A small number of known-safe URL domains were recently added by manual action as domains in a good state, and user clicks on links to these domains caused them to be reprocessed. When events were subsequently generated for these clicks, the state did not change from good to bad, but the alerting system was incorrectly configured to alert on all events, causing an influx of false positive alert traffic delivered to admins.\n\n\nNext steps:\n-Please refer to the attached Post-Incident Report for this event for a comprehensive list of next steps.\n\nWe've published a Post-Incident Report for this event."
            }
        },
        {
            "createdDateTime": "2023-03-31T22:08:09.117Z",
            "postType": "regular",
            "description": {
                "contentType": "html",
                "content": "A post-incident report has been published."
            }
        },
        {
            "createdDateTime": "2023-04-05T21:44:59.263Z",
            "postType": "regular",
            "description": {
                "contentType": "html",
                "content": "A post-incident report has been published."
            }
        }
    ]
}

[gautamdsheth]

Can't reproduce this , will close it now since it works in your another tenant.
Please do open a new issue if you are able to reproduce this with more information.