That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather ser

That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc. For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix". Last time I checked, both vulnerabilities still exist.