Inside the federal government’s sprawling technology bureaucracy, a group of cybersecurity experts reviewed Microsoft’s cloud infrastructure and arrived at a blunt, profane assessment: it was, in their words, “a pile of shit.” Then they approved it for government use.
That revelation, surfaced through internal communications obtained and reported by Slashdot, captures a dysfunction at the heart of how the U.S. government procures and authorizes cloud computing services. The experts charged with evaluating security knew the product had serious problems. They said so in unambiguous terms. And the system moved forward regardless.
This isn’t a story about one bad decision. It’s a story about structural incentives that override technical judgment — about what happens when the people who understand risk are subordinate to the people who manage contracts and timelines.
The Authorization Machine That Can’t Say No
The federal government’s process for approving cloud services is called FedRAMP — the Federal Risk and Authorization Management Program. Established in 2011, FedRAMP was designed to create a standardized security assessment framework so agencies wouldn’t each have to independently evaluate every cloud vendor. In theory, a rigorous process. In practice, something else entirely.
FedRAMP authorization has become, for major vendors, less a genuine security gate and more a procedural checkpoint. The program assesses cloud offerings against NIST security controls, and vendors must demonstrate compliance through documentation and third-party audits. But the process has long been criticized for being slow, bureaucratic, and — most damningly — susceptible to pressure from vendors with deep government relationships and enormous lobbying operations.
Microsoft is the largest cloud provider to the federal government. Its Azure platform, Microsoft 365 suite, and related services underpin operations across dozens of agencies, from the Department of Defense to the IRS. The company’s federal contracts are worth billions annually. That scale creates a gravitational pull that’s difficult for any authorization body to resist.
When cybersecurity reviewers flagged Microsoft’s cloud infrastructure with that profane assessment, they were identifying what they saw as fundamental architectural and security shortcomings. Not minor configuration issues. Not paperwork gaps. The language suggests they believed the product itself was inadequate for the sensitivity of government workloads it would carry.
But the authorization went through.
The dynamic will be familiar to anyone who has worked in large organizations where technical staff and decision-makers operate on different planes. Engineers raise red flags. Management weighs those flags against budget cycles, political relationships, migration costs, and the sheer inertia of existing contracts. The flags get noted. Then filed.
Microsoft’s Security Record Under Fire
The internal criticism didn’t emerge in a vacuum. Microsoft’s security track record over the past two years has been, by any objective measure, terrible.
In mid-2023, Chinese state-sponsored hackers breached Microsoft’s cloud email infrastructure, gaining access to the accounts of senior U.S. officials including Commerce Secretary Gina Raimondo and State Department personnel. The attackers exploited a stolen Microsoft signing key — a catastrophic failure that a subsequent Cyber Safety Review Board investigation called “preventable” and attributed to a “cascade of Microsoft’s avoidable errors.”
That CSRB report, published in early 2024, was scathing. It found that Microsoft had not prioritized security investments, that the company’s security culture was “inadequate,” and that Microsoft had made inaccurate public statements about the incident. The board recommended sweeping reforms.
Then came the Midnight Blizzard attack. Russian intelligence hackers — the same group behind the SolarWinds breach — compromised Microsoft’s own corporate email systems in late 2023, accessing communications of senior Microsoft executives and cybersecurity staff. Microsoft disclosed the breach in January 2024, and subsequent revelations showed the attackers had also accessed source code repositories.
So within a single year, the company entrusted with protecting the most sensitive communications in the U.S. government was itself breached by both Chinese and Russian intelligence services. Not exactly confidence-inspiring.
Microsoft CEO Satya Nadella responded by launching the Secure Future Initiative, pledging to make security the company’s top priority. The company tied executive compensation to security metrics and reorganized internal teams. But critics have argued these moves came years too late and only after public embarrassment forced the company’s hand.
The tension between Microsoft’s market dominance and its security failures creates an almost impossible situation for federal procurement officials. Migrating away from Microsoft would be enormously expensive and disruptive. Many agencies lack the technical capacity to even evaluate alternatives, let alone implement them. And Microsoft’s lobbying operation — one of the largest in Washington — ensures that political pressure flows in only one direction.
This is the context in which federal cyber experts looked at Microsoft’s cloud and called it what they called it. They weren’t being gratuitously vulgar. They were expressing, in the most direct terms available, a professional judgment that the system they were evaluating didn’t meet the standard it needed to meet.
And they were overruled.
The episode raises uncomfortable questions about the entire FedRAMP apparatus. If the program can’t reject or meaningfully condition the authorization of a product its own reviewers consider fundamentally flawed, what is it actually doing? The charitable interpretation is that FedRAMP serves as a documentation and compliance framework that raises the baseline for all vendors, even if it can’t block the biggest ones. The less charitable interpretation is that it’s theater — a process that creates the appearance of rigorous security review while the actual decisions are made elsewhere, by people with different priorities.
Former federal CISO Chris DeRusha, who led cybersecurity policy at the Office of Management and Budget during the Biden administration, had pushed for greater accountability in cloud authorizations. But even under that more security-focused regime, the structural pressures remained. Agencies need cloud services. Microsoft provides them at scale. The switching costs are astronomical. And so the machine keeps running.
What makes the current moment particularly fraught is the rapid contraction of federal cybersecurity capacity under the current administration. The Cybersecurity and Infrastructure Security Agency has seen significant staff reductions in 2025, with experienced personnel departing or being pushed out. The very experts who might push back on inadequate cloud security assessments are leaving government in droves.
Fewer watchdogs means less scrutiny. Less scrutiny means more latitude for vendors to push through products that might not withstand rigorous evaluation. It’s a feedback loop that benefits incumbents — especially the largest incumbent of all.
Microsoft, for its part, has consistently maintained that it takes government security obligations seriously and has invested heavily in meeting federal requirements. The company points to its Secure Future Initiative, its cooperation with government investigations, and its ongoing investments in security engineering. A Microsoft spokesperson has previously said the company is committed to transparency and continuous improvement in its security practices.
But transparency and continuous improvement are process commitments, not outcome guarantees. The federal cyber reviewers who assessed Microsoft’s cloud weren’t evaluating the company’s intentions. They were evaluating its product. And they found it wanting.
The Vendor Lock-In Problem Nobody Wants to Solve
At the root of this dysfunction is a problem the federal government has been unwilling to confront: vendor lock-in at civilizational scale.
Microsoft’s grip on federal IT isn’t just about cloud services. It extends to desktop operating systems, productivity software, identity management, email, collaboration tools, and endpoint security. Many agencies run their entire technology stack on Microsoft products. This creates dependencies so deep that even discussing alternatives becomes politically and operationally impractical.
The result is a market that doesn’t function like a market. When a single vendor is so embedded that switching is effectively impossible, the normal dynamics of competition — where a damning security review might actually cost a company business — break down. Microsoft doesn’t need to be the best option. It just needs to be the existing option.
Some in Congress have pushed for greater cloud diversification in federal IT. The argument is straightforward: concentrating so much of the government’s digital infrastructure in a single vendor creates systemic risk. If Microsoft is compromised — as it has been, repeatedly — the blast radius encompasses the entire federal enterprise. But diversification requires money, expertise, and political will. All three are in short supply.
Meanwhile, Microsoft continues to win new federal contracts. The Department of Defense’s JEDI cloud contract, after years of legal wrangling, was replaced by the multi-vendor JWCC program — but Microsoft remains one of only a handful of authorized providers. The company’s position in federal IT isn’t eroding. It’s consolidating.
The profane assessment from federal cyber experts is, in some ways, the most honest artifact to emerge from the federal cloud authorization process in years. It strips away the euphemisms and procedural language that typically obscure these evaluations. It says what many in the federal cybersecurity community have been thinking but rarely say on the record: that the government is building its digital infrastructure on a foundation that its own experts don’t trust.
That the authorization proceeded anyway tells you everything you need to know about where power actually resides in federal technology procurement. Not with the experts. Not with the security reviewers. Not with the people who understand the technical risk.
With the vendor. With the contract. With the inertia of a system too large and too entangled to change course, even when its own people are shouting that the course is wrong.
The question isn’t whether federal officials knew about Microsoft’s security shortcomings. They clearly did. The question is whether knowing — and saying so, loudly and profanely — makes any difference at all.
So far, the answer is no.
WebProNews is an iEntry Publication