Microsoft PKI Services: Firewall log data retention

Microsoft reported a compliance issue involving firewall log data retention for its DSRE PKI-managed issuing CAs. Microsoft said the problem was identified on 2020-07-29 20:03 UTC during a manual log file review, covering a missing firewall log data gap from 2020-07-21 15:23 UTC to 2020-07-21 17:04 UTC. Microsoft stated it did not meet the 7-year retention requirement for these firewall logs, and that this was a compliance-only issue that did not directly impact certificates; it also stated there were no problematic certificates. Microsoft confirmed on 2020-08-06 20:44 UTC that the missing logs were rolled and not recoverable, and later confirmed there were no incidents during the time window of the missing logs. Microsoft attributed the log loss to limited monitoring sensitivity and a limited recovery window after the issue was identified, and stated it was adding more sensitive monitoring tools and increasing storage to improve future log recovery. The bug was marked RESOLVED with resolution FIXED, and Mozilla indicated it could be closed unless additional questions or issues remained.

1. 2020-07-21 Firewall log data gap began and ended for the affected DSRE PKI environment.
2. 2020-07-29 Microsoft identified the missing firewall log files during a manual log review.
3. 2020-08-06 Microsoft confirmed the missing logs were rolled and not recoverable.
4. 2020-08-13 Microsoft confirmed security log reviewing software was in place and reported no incidents during the missing-log window.
5. 2020-08-28 Microsoft provided further details on monitoring sensitivity and recovery limitations and described mitigations.
6. 2020-09-15 Mozilla scheduled the bug for closure unless further issues were raised.

1. 2020-08-13 Disabled representative — Opened the case describing a firewall log retention compliance failure, stating the logs were not retained but were reviewed and that there were no problematic certificates.
2. 2020-08-28 Disabled representative — Explained the main factors causing the log loss (monitoring sensitivity and limited recovery window) and described added monitoring and storage changes, stating the issue was mitigated.
3. 2020-09-15 Mozilla representative — Requested closure of the bug on 21-Sept-2020 unless additional questions or remediation remained.
4. 2021-01-05 Community commenter — Updated the summary wording to reflect one organization (Microsoft) rather than internal divisions.