Is the Midnight Blizzard Microsoft Data-Sharing Email Legitimate?
Question details
The user needs to determine the authenticity of a Microsoft data-sharing request email sent by mbsupport@microsoft.com.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Evaluating a suspicious email requesting sensitive organization details like tenant ID and access code via a Power Apps portal.
- Observed behavior
- An organization received an email related to the Midnight Blizzard attack asking for sensitive information and authorized reviewer emails.
Do not click on any portal links or provide sensitive information, such as your tenant ID, until you have independently verified the email's sender and intent.
Verify the Request via Microsoft 365 Admin Center
The safest way to confirm the legitimacy of the Midnight Blizzard email is by contacting Microsoft Support directly through your administrative portal.
While security communities note that mbsupport@microsoft.com is used for legitimate Microsoft communications regarding the Midnight Blizzard incident, emails can be easily spoofed. Independent verification ensures your tenant data remains secure.
Navigate to the Microsoft 365 Admin Center (admin.microsoft.com) and log in using your global administrator credentials.
Go to the 'Support' section on the left sidebar and select 'Help & support' to open the service request pane.
Describe the email you received from mbsupport@microsoft.com, including the requested tenant ID and access code, and ask the Microsoft representative to confirm if this data-sharing request is authentic.
Secure and Compatible Document Management with WPS Office
If you are evaluating your organization's software suite due to security or cost concerns, consider WPS Office as a free, lightweight, and highly compatible alternative to Microsoft Office.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Suite: Run the installer and follow the simple on-screen instructions to set up the software safely.
- 3. Manage Secure Documents: Open WPS Office to instantly view, edit, and secure your essential business documents without solely relying on cloud ecosystems.
Frequently Asked Questions
What is the Midnight Blizzard attack?
Midnight Blizzard is a known state-sponsored threat actor that compromised a specific set of Microsoft corporate email accounts. Microsoft sends notifications to organizations whose communications were exposed during this breach.
Should I submit my tenant ID to the linked Power Apps portal?
Only submit your tenant ID and access code after independently verifying the request through the official Microsoft 365 Admin Center. Phishing campaigns often use fake portals that mimic legitimate Microsoft services.
Is mbsupport@microsoft.com an official Microsoft email address?
Yes, security analysts have observed Microsoft using mbsupport@microsoft.com for Midnight Blizzard communications. However, always check the email headers to ensure the sender's address was not spoofed.
