Microsoft Whistleblower Alleges Foreign Engineer Was Approved to Access U.S. Government Cloud Logs

What happened?

A claimed Microsoft whistleblower has raised concerns about government cloud security after screenshots appeared to show approval for an engineer, allegedly based in India, to receive logs from a U.S. government cloud environment through Microsoft’s escort process. The documents raise questions about access controls but do not establish unauthorized access or a breach. The allegations, shared by Conspiracookie on X, identify Microsoft engineer Viraj Chokhany as the requester. The account says an unnamed whistleblower supplied the images and alleges that Chokhany is not a U.S. citizen.

Key details

• A Microsoft whistleblower shared screenshots alleging an India-based engineer was approved to view U.S. government cloud logs via the escort process.
• The screenshots show an internal SPO Environments page listing DProdMgd151 under GCC-Moderate, separate from Department of Defense infrastructure.
• Incident 815678445 titled "Escort Request: GCCM- Request to view GCC-M logs" names Viraj Chokhany as creator and shows approval for his account alias.
• A further image shows a request to share Geneva logs for two incidents referencing environment dprodmgd151 and SharePoint job definitions, but no returned log contents are visible.
• Microsoft's GCC service description requires U.S. citizenship verification and background checks for staff seeking temporary elevated permissions to customer content.
• The same GCC document states customer support carries no general assurance about an agent's physical location or citizenship.
• ProPublica's investigation found some digital escorts lacked technical skills to supervise overseas engineers, weakening oversight.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.