Microsoft is investigating a significant Multi-Factor Authentication (MFA) service degradation impacting users across the United States.
Organizations attempting to authenticate into Microsoft 365 services are encountering 504 Gateway Timeout errors, preventing users from completing MFA challenges and effectively locking them out of protected systems.
The issue is being tracked under incident ID MO1237461 and remains under active investigation.
What’s Happening?
The incident began around 2:52 PM UTC (February 23, 2026) and primarily affects users in the North America region.
Users attempting to log in to MFA-protected services are receiving:
504 Gateway Timeout errors
A 504 error typically indicates that an upstream authentication component failed to respond within the expected time window. In this case, the disruption appears to be occurring within Microsoft’s identity infrastructure.
Microsoft classified the event as a service degradation, meaning some users may authenticate intermittently depending on routing and backend load conditions.
Services Potentially Impacted
Because MFA is integrated deeply across Microsoft’s identity ecosystem, the disruption likely affects:
- Microsoft 365 applications (Outlook, Teams, SharePoint)
- Azure-integrated services
- VPN authentication tied to Entra ID
- Conditional Access policy enforcement
- Third-party SaaS apps federated through Entra
The issue is reportedly centered within Microsoft Entra ID, formerly known as Azure Active Directory, which serves as Microsoft’s core identity and access management backbone.
Authentication gateway or backend processing components within Entra’s infrastructure are suspected as possible root causes.
Operational Risk for Enterprises
MFA outages create a complex security dilemma:
🔒 Keep MFA enforced → Users locked out of critical systems
⚠️ Disable MFA → Increased identity compromise risk
For security leaders, this highlights the importance of:
- Resilient authentication architecture
- Break-glass emergency accounts
- Business continuity planning for identity outages
Organizations heavily reliant on Microsoft 365 and federated authentication models may experience widespread productivity disruption during such incidents.
Microsoft’s Response
Microsoft confirmed the issue within the Microsoft 365 Admin Center and is actively reviewing:
- Entra authentication logs
- Network telemetry signals
- Gateway and backend processing components
Multiple status updates were issued, but no estimated time to resolution has been provided at this stage.
The public status page may show all systems operational, but detailed updates are available to tenant administrators through the Microsoft 365 Service Health dashboard under MO1237461.
What Admins Should Do
While awaiting resolution, organizations can:
- Monitor the Microsoft 365 Service Health dashboard (MO1237461).
- Test authentication from alternate networks or devices.
- Review Conditional Access and MFA enforcement policies.
- Avoid disabling MFA globally unless business continuity requires controlled, temporary adjustments.
- Engage Microsoft Support if critical systems remain inaccessible.
Maintaining strong identity controls while balancing operational continuity is critical during authentication-layer outages.
Broader Implications
This incident underscores a critical reality:
Identity infrastructure is now the single point of failure for modern enterprises.
As organizations consolidate authentication through centralized identity providers, outages at that layer can cascade across:
- Collaboration tools
- Cloud workloads
- Remote access
- Third-party SaaS platforms
Even without a security breach, availability failures in MFA systems can create enterprise-wide disruption.
Key Takeaways
- U.S. users are experiencing MFA-related 504 errors.
- Incident tracked as MO1237461.
- Likely rooted in authentication infrastructure within Entra.
- No confirmed security compromise at this time.
- Organizations should prioritize monitoring and contingency planning.
Conclusion
While Microsoft continues investigating the root cause, this event highlights the operational sensitivity of centralized MFA and identity systems.
For security and IT leaders, the lesson is clear:
Identity resilience must be treated as mission-critical infrastructure.
Further updates are expected as Microsoft engineering teams continue reviewing telemetry and authentication services.
