Anything that affects the availability of your apps, the integrity of your data, or the confidentiality of your account -- from a degraded service to a confirmed security issue. Minor, fully-transparent hiccups that don't touch your data or access are tracked internally rather than treated as a formal incident, but the status page reflects real availability either way.

A public status page tells you something's wrong; it doesn't tell you whether it touched your specific data. Affected tenant admins get a direct notification precisely because a generic status update isn't enough when the question is 'was my account impacted' -- that answer is specific to you, so we give it to you specifically.

Getting told something happened is only half the point -- the follow-up summary explains what changed as a result, so the same class of issue is less likely to recur. That's the standard we hold ourselves to: not just detect and notify, but actually close the loop on why it happened.