A new wave of scam emails is making its way into business inboxes — and what makes this one particularly dangerous is that it arrives looking exactly like a genuine Microsoft Azure alerts notification. It comes from a real Microsoft domain, passes through most email security filters without a flag, and is designed to make you act before you think.

If your business uses Microsoft cloud services — or even if you simply use Microsoft 365 — this is something you and your team need to know about.

What Is Microsoft Azure and Why Does It Send Alerts?

Microsoft Azure is a cloud computing platform used by businesses of all sizes to host data, run software, and manage their IT infrastructure. Built into Azure is a tool called Azure Monitor, which keeps an eye on system performance and account activity. When something changes — a new invoice is generated, unusual activity is detected, or a threshold is crossed — Azure Monitor sends an automatic email notification to let you know.

These Microsoft Azure alerts are a completely routine part of managing cloud-based systems. For businesses running services in the cloud, receiving them is entirely normal. And that’s precisely what scammers are exploiting.

How the Scam Works: Microsoft Azure Alerts Used as a Delivery Tool

Azure Monitor allows users to create custom alerts that trigger under specific conditions. When an alert fires, the system sends an email — and whoever set up the alert can write whatever message they like to go alongside it.

Attackers have found a way to misuse this feature. Here’s what’s happening:

• A criminal sets up an Azure account and creates an alert with a basic trigger — for example, any account activity.
• They write a fake warning message to go with it. This might claim there’s a billing problem, unexpected charges, or that your account has been suspended.
• They send this alert to a mailing list of businesses they’re targeting.
• The email arrives from a genuine Microsoft domain and passes through email security checks without being flagged.
• The message creates urgency and directs the recipient to call a phone number to “resolve” the issue — a number that connects directly to the scammer.

The critical point here is that this is not a spoofed email pretending to be Microsoft. The email is actually sent through Microsoft’s own infrastructure. That’s why it looks so convincing and why so many security tools are letting it through.

Why This Attack Is Harder to Spot Than Most Phishing Emails

Most people have learned to look for the tell-tale signs of a phishing attempt — poor spelling, suspicious-looking sender addresses, links to unfamiliar websites. Security software has become good at catching these too.

This attack sidesteps all of those signals. The sender address is a legitimate Microsoft domain. The email format looks like a real system notification. There’s no strange link to an unknown website. The only unusual element is the content of the message itself — and if someone receives what looks like a genuine billing alert and isn’t aware this scam exists, they may not question it.

This isn’t the first time criminals have taken this approach. Similar tactics have been used with PayPal and Google tools in the past. The method is always the same: find a trusted platform, use its own systems to deliver the scam, and benefit from the credibility that comes with it.

For businesses in Sussex and the wider South East that have moved systems into the cloud in recent years, this is a timely reminder that technical controls alone are never enough. The human element matters just as much.

What This Means For Businesses

The people most likely to receive one of these emails are those who handle finance, procurement, or administration. They’re used to receiving billing notifications and account alerts — which is exactly why the scam is targeted in this way.

If someone calls the number in the email, the scammer on the other end will attempt to extract account credentials, payment information, or remote access to business systems. The consequences can range from financial loss to a serious security breach.

Every business that uses Microsoft cloud services — large or small — is a potential target. The good news is that awareness and a few sensible habits go a long way towards preventing this kind of attack from succeeding.

Practical Steps to Protect Your Business

Here’s what we recommend for any business that wants to stay protected:

Pause before you act

If an email is pushing you to do something urgently — especially to call a number or click a link — that pressure itself is a warning sign. Legitimate systems do not demand immediate action under threat of account suspension. Take a breath before you do anything.

Never call a number from within an email

If you believe there may genuinely be an issue with a Microsoft account, find the correct contact number yourself using the official Microsoft website. Do not use any number provided in an email you weren’t expecting.

Check your account directly

Open your browser, navigate directly to the Microsoft Azure portal or your Microsoft account page — not using any link in the email — and look for the alert there. If the issue is genuine, it will be visible inside your account. If nothing shows up, the email is almost certainly a scam.

Brief your team

Make sure the people most likely to receive these emails — your finance team, office manager, or anyone who handles IT-related correspondence — know this scam exists. A quick conversation could prevent a costly mistake. For a broader look at what every business should know about phishing, it’s worth sharing that resource with your team too.

Enable multi-factor authentication

Multi-factor authentication — often called MFA — requires a second form of verification when someone logs into an account, such as a code sent to a mobile phone. Even if an attacker somehow obtains a password, MFA prevents them from getting any further. If your Microsoft accounts don’t have MFA enabled, making that change should be a priority. Our blog on simple ways to strengthen your business security covers this in more detail.

Ask your IT support provider

If something arrives in your inbox and you’re not sure whether it’s genuine, contact your IT support provider before taking any action. That’s exactly what they’re there for. Acting on a suspicious email and then reporting it is the wrong way round — always check first.

Final Thoughts

This particular scam is a clear sign of how cybercriminals continue to adapt. As businesses and security tools get better at catching traditional phishing emails, attackers look for new ways around those defences. Using Microsoft’s own infrastructure to send fraudulent Microsoft Azure alerts is a clever move — and it is working on businesses right now.

The best protection will always be a combination of good awareness and solid technical safeguards. Staff who know what to look for, a culture where it’s safe to pause and double-check, and the right tools in place — these things together make a real difference.

Phishing is no longer just badly written emails from unknown senders. Today’s attacks are polished, well-timed, and delivered through systems your business already trusts. Staying one step ahead means staying informed.

Frequently Asked Questions

What are Microsoft Azure alerts?

Microsoft Azure alerts are automated email notifications sent by a tool called Azure Monitor, which is built into Microsoft’s cloud platform. Businesses use them to stay informed about activity on their accounts, such as new invoices being raised or unusual system behaviour. They’re a standard part of cloud management for companies using Microsoft services.

How can I tell if an Azure alert email is genuine?

The most reliable approach is to ignore the email entirely and log into your Microsoft Azure account directly through your browser. Any genuine alerts will be visible inside your account dashboard. Be particularly cautious if the email is pushing you to call a phone number or act urgently — neither is typical of a legitimate system notification.

Why isn’t my email security software catching these scam emails?

Because the emails are sent through genuine Microsoft infrastructure, they arrive from a real Microsoft domain. Most email security tools assess whether an email comes from a legitimate source — and in this case, it does. The fraudulent content is in the message itself, which is much harder for automated tools to detect. This makes human awareness all the more important.

What should I do if someone in my business already called the number?

Contact your IT support provider straight away. If any account details, passwords, or personal information were shared during the call, those accounts need to be secured immediately — starting with changing passwords and reviewing access. Your IT team can assess what may have been exposed and help limit any further risk.

Does my business need to use Microsoft Azure to be at risk?

Not necessarily. While the scam is designed to target businesses that use Azure or Microsoft cloud services, anyone could receive one of these emails if their address ends up on a mailing list. Even if you don’t use Azure, a member of your team may not know that — which is why briefing your staff on this kind of scam is valuable regardless of which platforms your business uses.