The most expensive sentence Microsoft can write is 'no customer action required'

Three layers stack on this advisory and each one reduces the perceived urgency without reducing the actual obligation.

The first layer is the phrase “no customer action required.” It is true at the patch layer — Microsoft has shipped the server-side fix, no admin work is authorized for the operator to perform on this CVE. It is not true at the compliance layer, where the controller’s independent assessment obligation under GDPR Article 33 and a covered entity’s risk assessment under HIPAA do not transfer to the processor.

The second layer is score deflation. The 9.6 base score does not survive a temporal pass: exploit-code maturity is UNPROVEN (0.91 multiplier) and Microsoft’s server-side fix counts as Official Fix (0.87 multiplier), pulling the adjusted score to roughly 8.4–8.5. Scanner dashboards that filter on Critical (≥9.0) by temporal or environmental score will surface this as High, not Critical. Triage queues sort by severity band; the deprioritization is automatic and silent.

The third layer is the audit gap. The Microsoft 365 Unified Audit Log captures MeetingDetail and MeetingParticipantDetail. It does not capture reads against the Events Portal’s API surface. There is no documented audit operation name for “Events Portal API call.” A tenant that hosted board meetings, M&A discussions, or NDA-bound customer events through the portal during the vulnerable window cannot use Microsoft’s own logs to demonstrate that no improper read occurred. They can show who attended. They cannot show who looked.

What an honest assessment looks like: pull the meeting operations for a defensible review window, cross-reference attendee email addresses against expected invitee lists for high-sensitivity events, check Entra ID sign-in logs for anomalous OAuth grants tied to the Events Portal, and document the methodology — including the gap that portal-layer reads are not logged — as audit evidence. The output is not “we know nothing happened.” The output is “we did the assessment we were obligated to do with the evidence the platform exposes.”

“No customer action required” describes the patch, not the CVE. Treating those as the same sentence is how compliance debt accrues quietly until somebody asks for it in writing.