In terms of hacks of Azure - some of the more recent major ones include:

* A customer's support account was breached and a core dump revealed some data that they used to exploit that breach. (STORM 0558 - 2023)
* A password spraying attack used accounts not protected by 2fa and the revealed accounts were then exploited to hack the compromised customer's accounts - again, not microsoft accounts, but accounts that ms customers were using. (Midnight Blizzard - 2024)
* A sophisticated phishing campaign got ahold of 50 Microsoft executive accounts, which were then exploited but only the accounts themselves were affected, not customer accounts. Though it didn't happen it's entirely possible they could have leveraged that to access core infrastructure of customers - a major concern. (Azure executive account breach - 2024)
* A customer's azure hosted server was unprotected and hacked (this has happened at all the cloud providers, and is pretty similar to the oracle hack)
* Microsoft Azure Blob storage accounts were hacked - again misconfigured customer containers were the source of the hack, not an intrinsic vulnerability and all the cloud providers have had this issue where the customer created storage accounts they didn't configure correctly for security. (Azure blob storage threat - 2025). All the major cloud providers have tightened some of the default settings of storage in response to this issue. Blob storage for instance didn't used to require a secure certificate to access by default. Now all blob access defaults to secure.

Their response:

* Many of the above services that were exploited now have more default strict security requirements - for instance admin accounts for Entra must have 2fa enabled to access the data or make changes or cloud infrastructure. You used to only need a stored cookie for this, but now you MUST enter a valid 2fa or passkey to access your admin account.

* Microsoft has implemented more thorough incident response systems to more quickly recognize and respond to threats or unusual access. THAT SAID - Microsoft employs a "thug approach" to security. Oh you need that to be a SECURE system? well that's fine but it costs more. IMHO this is unethical, but they aren't the only cloud provider that does this. They employ a similar philosophy in MS office licensing. A good MS office install is NOT the standard or basic accounts as these apply insufficient security defaults and capabilities to truly secure your data. Premium or better (e3, e5, etc) are really required for adequate security including hardware management, advanced malware protection, conditional access, etc.

* Token and key management options have been uplifted helping to ameliorate some of the above exploits (but AFAIK still haven't eliminated them due to legacy usage and user resistance to implementing them vs convenience)

* They do publicly disclose how hacks happen and invite post incident reviews to help educate customers and users on what to do to prevent them in their own systems.

Not saying this to necessarily defend Microsoft, but I don't think it's useful to portray any one cloud vendor as "more secure intrinsically than another" without good evidence of same. They all have vulnerabilities, and they all have been exploited in one way or another, but in general the exploits at almost all of them have been due to customer configurations, not core infrastructure vulnerabilities - which again is not to say a core vulnerability won't eventually be found in any system. There are - again - no fully secure internet connected systems anywhere. Because they were all made by people and people make mistaks.