email from Azure Monitor Security alert

Question

email from Azure Monitor Security alert

janice barrett 55

I received an email from Azure Monitor Security alert sent to my personal account, but I do not have this software on my personal email account.

The email states that they have found an unauthorized charge and to call a number listed in the message. Should I call 1-812-589-8460?

HSR AR 15 Reputation points

2026-03-11T04:08:15.7166667+00:00

Received same azure alert 3-10-26. All looks very real from Microsoft. DON'T click or phone¡!!!!!!!!!!
Steve Wiseman 5 Reputation points

2026-03-17T18:25:56.0966667+00:00

I've been receiving these for about a week. They come in pairs; alert activated, alert deactivated. There is no email address for a reply, I won't click on a link or call a number, I have no relationship with Azure so I can't contact support, I opened a MS ticket and am waiting for a call back. The email references a product and a dollar amount. I checked my credit card and bank account using online banking and there has been no activity. I used outlook to report and block but that did not stop the emails.
Jay Marcum 5 Reputation points

2026-03-18T00:32:32.6033333+00:00

Microsoft in their infinite wisdom allows Azure Alert Rules to email any random email address, which further let's attackers use the Azure platform to send phishing emails via a Microsoft domain and avoid phishing filters and basic SLAM practices.

This is not a user issue and is entirely a Microsoft problem that enables and allows attackers to utilize certain features of their cloud platform to email and attack random people en masse, with zero validation or verification of the email address being sent to. Which allows attackers to format the email sent in anyway they want, and while preventing users from having any access to the rules or resources being used to send them malicious emails through alert rules.
Trevor Shand 0 Reputation points

2026-03-18T08:15:10.75+00:00

I have had the same email. This is a phishing scam setup by someone using an Azure alert rule called "Thank You for Your Payment-21020662" which then sends the alert description (which has the phishing phone number). This comes from Azure itself so is not marked as suspicious but it is being send by a scammer.

Alert rule description

MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE (REF: MS-FRA-6673829-KP). Our system has detected a potentially unauthorized charge on your account. Transaction Details: Merchant: Windows Defender. Transaction ID: PP456-887A-22B. Amount: 459.90 USD. Date: 03/06/2026. For your protection, this transaction has been temporarily placed on hold by our Fraud Detection Team. To prevent possible account suspension or additional fees, please verify this transaction immediately. If you did NOT authorize this payment, contact our 24/7 Microsoft Account Security Support at +...... or ....... We apologize for any inconvenience and appreciate your prompt response. Microsoft Account Security Team.

Answer accepted by question author

4 additional answers

Your answer

HSR AR 15 Reputation points

2026-03-11T04:08:15.7166667+00:00

Received same azure alert 3-10-26. All looks very real from Microsoft. DON'T click or phone¡!!!!!!!!!!
Steve Wiseman 5 Reputation points

2026-03-17T18:25:56.0966667+00:00

I've been receiving these for about a week. They come in pairs; alert activated, alert deactivated. There is no email address for a reply, I won't click on a link or call a number, I have no relationship with Azure so I can't contact support, I opened a MS ticket and am waiting for a call back. The email references a product and a dollar amount. I checked my credit card and bank account using online banking and there has been no activity. I used outlook to report and block but that did not stop the emails.
Jay Marcum 5 Reputation points

2026-03-18T00:32:32.6033333+00:00

Microsoft in their infinite wisdom allows Azure Alert Rules to email any random email address, which further let's attackers use the Azure platform to send phishing emails via a Microsoft domain and avoid phishing filters and basic SLAM practices.

This is not a user issue and is entirely a Microsoft problem that enables and allows attackers to utilize certain features of their cloud platform to email and attack random people en masse, with zero validation or verification of the email address being sent to. Which allows attackers to format the email sent in anyway they want, and while preventing users from having any access to the rules or resources being used to send them malicious emails through alert rules.
Trevor Shand 0 Reputation points

2026-03-18T08:15:10.75+00:00

I have had the same email. This is a phishing scam setup by someone using an Azure alert rule called "Thank You for Your Payment-21020662" which then sends the alert description (which has the phishing phone number). This comes from Azure itself so is not marked as suspicious but it is being send by a scammer.

Alert rule description

MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE (REF: MS-FRA-6673829-KP). Our system has detected a potentially unauthorized charge on your account. Transaction Details: Merchant: Windows Defender. Transaction ID: PP456-887A-22B. Amount: 459.90 USD. Date: 03/06/2026. For your protection, this transaction has been temporarily placed on hold by our Fraud Detection Team. To prevent possible account suspension or additional fees, please verify this transaction immediately. If you did NOT authorize this payment, contact our 24/7 Microsoft Account Security Support at +...... or ....... We apologize for any inconvenience and appreciate your prompt response. Microsoft Account Security Team.

Answer 1

Marcin Policht 86,845 MVP Volunteer Moderator

Do not call that number. This is almost certainly a phishing or tech support scam.

Azure Monitor does not send “unauthorized charge” alerts asking you to call a random phone number, especially to a personal email account that is not associated with an Azure subscription. Scammers commonly send fake security or billing alerts to create urgency and trick people into calling a number where they will attempt to steal personal information, credit card details, or remote access to your computer.

Legitimate Microsoft or Azure billing notifications will direct you to sign in to your official Microsoft account through the normal website, not by calling a phone number in the email. If you are concerned, open a new browser window and manually type https://account.microsoft.com or https://portal.azure.com and check your account there. Do not click any links in the suspicious email.

You should delete the email or mark it as phishing.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

janice barrett 55 Reputation points

2026-02-26T22:19:45.2966667+00:00

Please note the email account address is was sent from is: azure-noreply@microsoft.com

How can a scammer use the microsoft.com address?

I received an email from Azure Monitor Security alert sent to my personal account, but I do not have this software on my personal email account.

The email states that they have found an unauthorized charge and to call a number listed in the message. Should I call 1-812-589-8460?
janice barrett 55 Reputation points

2026-02-26T22:21:17.0466667+00:00

Please note the email account address is was sent from is: azure-noreply@microsoft.com

How can a scammer use the microsoft.com address?
Marcin Policht 86,845 Reputation points MVP Volunteer Moderator

2026-02-26T22:26:57.13+00:00

Scammers can make an email appear to come from azure-noreply@microsoft.com by spoofing the “From” address, which is just a text field that can be forged unless the receiving mail server strictly enforces authentication checks like SPF, DKIM, and DMARC; in many phishing campaigns, attackers either manipulate email headers so the visible sender looks legitimate, exploit misconfigured mail servers, or use lookalike techniques where the display name shows “Microsoft” while the actual underlying address is different, so the only reliable way to verify is to inspect the full email headers and authentication results rather than trusting the visible sender name alone.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Just Me 0

I got the same email!! On 2.26.2026!

Thank you Ms. Barrett for asking the question about the "From Address" Because I had the same question.

I wanted to share, that this is the main message I received.

MICROSOFT CORPORATION BILLING DEPARTMENT ACCOUNT SECURITY ALERT (REF: MS-FRA-6673829-KP) We have detected an unauthorized transaction . Transaction Details: Merchant: Windows Defender Transaction ID: PP456-887A-22B Amount: 499.99USD Date: 02-26-2026 at 04:47 AM EST Our Fraud Prevention System has automatically placed a hold on these funds. To prevent account suspension and reverse any potential fees, you must verify this transaction immediately. If you did NOT authorize this purchase, please contact our 24/7 Microsoft Fraud Resolution Hotline at : +1 (812)589-8460 . We apologize for any inconvenience. Sincerely,The Microsoft Account Security Team

Trevor Shand 0 Reputation points

2026-03-06T19:34:45.7833333+00:00

I have had the same email. This is a phishing scam setup by someone using an Azure alert rule called "Thank You for Your Payment-21020662" which then sends the alert description (which has the phishing phone number). This comes from Azure itself so is not marked as suspicious but it is being send by a scammer.

Alert rule description

MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE (REF: MS-FRA-6673829-KP). Our system has detected a potentially unauthorized charge on your account. Transaction Details: Merchant: Windows Defender. Transaction ID: PP456-887A-22B. Amount: 459.90 USD. Date: 03/06/2026. For your protection, this transaction has been temporarily placed on hold by our Fraud Detection Team. To prevent possible account suspension or additional fees, please verify this transaction immediately. If you did NOT authorize this payment, contact our 24/7 Microsoft Account Security Support at +...... or ....... We apologize for any inconvenience and appreciate your prompt response. Microsoft Account Security Team.

Answer 2

Richard Aylmer-Hall 10

I have been getting similar emails for the past couple of weeks. After going through a couple of MS support sessions I eventually got the agent to investigate properly and they conceded that these are phishing emails being generated by a scammer abusing the Azure Alert Group automation. Looking back through the emails I can see a few different Alert Groups being used. As I do not have an Azure admin account I can't go into the system to see which Azure Alert Groups my email address has been added to, or do anything to remove my email.

Richard Aylmer-Hall 10 Reputation points

2026-03-19T09:42:19.18+00:00

...but if you look at the bottom of the emails there is an "Unsubscribe" button, which will remove you from that Alert Group. The MS agent assured me it was safe to do that.

Answer 3

Dale Gavlak 5

Microsoft's Azure Security warning saying that my account was used to purchase Microsoft Defender on Mar. 18 for $459.90 I did NOT do this. I have phoned the number provided for this warning twice and no one answers. Apparently this is phishing scheme for an unauthorized purchase. I do not have an Azure account.

0 comments

Answer 4

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 5

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

email from Azure Monitor Security alert

4 additional answers

Your answer