If you run a workshop, a manufacturing unit, a garage or any kind of hands-on business, you know that the last thing you need is something knocking your systems offline when you’ve got orders to fill, jobs on the ramp and deadlines to hit. You rely on your IT to work quietly in the background: email flowing, invoices going out, orders coming in, machines talking to each other.
So when a professional-looking email lands in your inbox warning you about a billing problem with your Microsoft account, or flagging suspicious activity on your systems, your first instinct is probably to deal with it. Fast. Get it sorted, get back to work.
That instinct is exactly what a new wave of scammers is banking on.
There’s a phishing scam doing the rounds right now that uses Microsoft Azure Monitor, a genuine Microsoft tool, to send fake alert emails. These are not your usual dodgy-looking spam messages. They are sent through Microsoft’s own system, from a real Microsoft domain, and they land in your inbox without being flagged as junk. Your email filters probably will not stop them because, technically, the email is real. It is the message inside that is the lie.
What Is Azure Monitor and Why Should You Care?
Azure Monitor is part of Microsoft’s cloud platform. It is a tool that businesses use to keep an eye on their systems: tracking performance, flagging problems and sending automatic notifications when something needs attention. If your business uses any Microsoft cloud services, these kinds of alerts are a normal part of day-to-day IT management.
The key point is that Azure Monitor lets whoever sets up an alert write their own message. Normally, that is your IT team or your IT support provider writing something useful like “server response time is slow” or “storage is nearly full.” But attackers have worked out that they can set up their own Azure alerts, write whatever message they want and send them to email addresses they’ve collected.
The result? An email that genuinely comes from Microsoft’s infrastructure, formatted like a proper Azure notification, but carrying a completely made-up warning about your account. It might say you’ve got an unpaid invoice, suspicious charges on your account, or that your account is about to be suspended. Then it tells you to call a phone number to sort it out. That phone number connects you to the scammer. From there, they will try to get your login details, payment information or remote access to your computer. If they get in, they can lock you out of your own systems, steal data, or run up charges; any of which could halt your operation dead. We covered a related trend in our recent post on how next-generation phishing is changing the rules; the old warning signs are disappearing and businesses need to adapt.
Why Your Email Security Probably Will Not Catch This
Most businesses have some form of email filtering in place: spam filters, virus scanning, maybe some link checking. These tools do a solid job of catching the obvious stuff: emails from fake domains, messages with dodgy attachments, links to known scam sites.
But this Azure scam gets around all of that. The email is sent from a genuine Microsoft address. It passes all the standard authentication checks (SPF, DKIM, DMARC all of the technical standards that prove an email really came from where it says it did). And because the call to action is a phone number rather than a clickable link, there is no malicious URL for the filter to spot.
In practical terms, this means the email arrives looking exactly like any other Azure notification. If your staff have seen genuine Azure alerts before, they have no reason to question this one. If they have never seen one before, the professional formatting and Microsoft branding make it look trustworthy.
Either way, the scam is designed to get past both your technology and your people and for a busy workshop or factory floor, where nobody has time to stop and analyse every email, that is a real risk.
This Is Not a New Trick, Just a More Convincing Version
Scammers have been using trusted platforms to send phishing emails for a while. PayPal invoicing, Google Forms, calendar invitations. The pattern is always the same. Find a service that people trust, use its own email system to send the scam, and let the platform’s reputation do the heavy lifting.
What makes the Azure version especially effective is the business context. Azure alerts relate to your systems, your billing, your infrastructure. They feel operational. Ignoring them feels risky. And for a business where any IT disruption means work grinds to a halt, the pressure to respond quickly is intense.
That pressure is exactly what the scammer is counting on. They do not need you to be careless. They just need you to be busy and to trust that an email from Microsoft is what it claims to be.
What to Do When You Get a Suspicious Alert
The single most important thing you can do is pause. Do not call the number in the email. Do not click any links. Do not forward it to your bank or accounts team with a note saying “can you deal with this?”
Instead, take these steps:
1. Go directly to the source
Open your web browser and go to the Azure portal (portal.azure.com) or your Microsoft 365 admin centre directly, not by clicking anything in the email. Log in and check for any alerts, billing notifications or account issues. If the alert is real, it will show up there. If it does not, the email is a scam.
2. Check with your IT support
If you are not sure, forward the email to your IT support provider and ask them to verify it. A good IT partner will be able to tell you within minutes whether it is genuine. Do not act on the email until you have that confirmation.
3. Tell your team
If you have office staff, accounts people, or anyone else who handles email, make sure they know about this scam. A quick five-minute briefing could prevent a costly mistake. Print out a notice for the office if it helps, whatever works for your environment.
4. Make sure multi-factor authentication is switched on
MFA (multi-factor authentication) means that even if someone does get hold of a password, they cannot log in without a second verification step, usually a code on a phone. If you do not have MFA turned on for your Microsoft accounts, get it done now. It is one of the simplest and most effective protections available. Understanding why MFA is so critical has never been more important, our post on why MFA matters more than ever breaks down the real-world risks of leaving accounts unprotected.
5. Report the email
Forward suspicious emails to the National Cyber Security Centre’s reporting service at report@phishing.gov.uk. It takes seconds and helps security organisations track and shut down active scams.
Protecting Your Business Without Slowing It Down
We know that for workshops, garages, manufacturers and other hands-on businesses, security can sometimes feel like it gets in the way of getting work done. You do not want to be jumping through hoops every time you open an email. You need things to be simple, practical and fast.
The good news is that protecting yourself against scams like this does not require complicated technology or expensive overhauls. It comes down to a few sensible habits:
- Never act on urgency alone. Any email pushing you to do something immediately, especially calling a number or sharing login details, deserves a second look.
- Verify independently. Always go to the source directly rather than following links or numbers in an email.
- Keep your security basics up to date. MFA, up-to-date software, and regular password changes go a long way.
- Talk to your team. The more people who know what to look for, the harder it is for a scam to succeed.
These are small steps that fit around a working day, not complicated IT projects. And they make a genuine difference. Your browser is another area that often gets overlooked, it quietly stores and shares more data than most people realise. We looked at this in detail in our article on why browser security is important for your business, and it is well worth a read alongside this one.
The Bigger Picture, Scams Are Getting Smarter
This Azure Monitor scam is not a one-off. It is part of a clear trend where phishing attacks are becoming more polished, more targeted and harder to spot. The days of laughably bad scam emails are not over, you will still get those, but alongside them there is now a tier of sophisticated attacks that would fool most people most of the time.
For businesses that depend on their IT to keep the operation flowing, whether that is a CNC machine talking to a design file, an invoicing system sending quotes, or a booking calendar managing jobs the stakes are real. A successful phishing attack can lead to locked-out systems, financial loss, stolen customer data and days of downtime while everything gets sorted.
The good news is that awareness is your strongest defence. Now that you know how this scam works, you are far less likely to fall for it. Share this article with your team, put a quick verification step in place, and make sure your basic security measures are solid.
How EC Computers Can Help
At EC Computers, we support workshops, manufacturers, garages and hands-on businesses across Bristol and the South West with straightforward, practical IT security. We can check your email security setup, make sure MFA is properly configured, and help you put simple processes in place so your team knows exactly what to do when a suspicious email arrives.
If you are not sure whether your business would catch a scam like this, or you just want a quick health check on your email security, give us a call. We will keep it simple, keep it practical, and keep your operation moving.