Last updated: 14 November 2026, 23:40 IST. You will find the sources at the end.
The Microsoft 365 outage of Thursday, 12 November 2026 lasted through the night and most of Friday in India. Outlook and Exchange Online mailboxes went first, and Teams, SharePoint Online, Copilot and Defender XDR followed. By Friday evening most of the service was back. On Saturday 14 November, at about 11:40 IST, Microsoft said it had restored service to the remaining customers and regions. That was about 38 hours after the first mailboxes failed. Microsoft says the problem was introduced during an earlier network capacity upgrade and showed up after a recent network change. It has promised a full post-incident report.
This Microsoft 365 outage came two days after Microsoft patched an Outlook bug that attackers were already using, so many people asked whether the two are connected. Microsoft has reported no malicious activity and has not linked them.
The short answer
- It was a failure inside Microsoft’s own service. Microsoft says a large number of its servers failed automated health checks and dropped out, and the servers that were left could not carry the load. It later said that the process which sets up secure connections on the affected servers was being overwhelmed. On Friday night it named the origin: an issue introduced during an earlier network capacity upgrade, which surfaced after a recent network change.
- Microsoft calls it “a technical issue not related to cyber or AI / agents” and says it found no evidence of malicious activity. It will publish a full post-incident report once its review is complete.
- Delayed mail should still arrive. On Friday Microsoft extended its email timeout window to 48 hours to preserve delayed messages.
- The incident IDs are EX1550543 (Exchange Online) and MO1550821 (Microsoft 365). Use them in Service health in the admin centre.
- During an outage like this, do not change MX records, connectors, mail flow rules or Conditional Access. The fault is on Microsoft’s side and your changes will only add new problems.
- Expect phishing emails that use the outage as the excuse. Treat any message that offers a link to “restore” or “re-verify” a mailbox as phishing.
What happened, in order
Times are IST, with UTC in brackets. They come from Microsoft’s status updates as reported by the sources below.
| Time | Event |
|---|---|
| Thu 12 Nov, 20:15 to 21:23 (14:45 to 15:53 UTC) | A separate Teams incident in North and South America. Microsoft said it had fixed it. |
| Thu 21:47 (16:17 UTC) | EX1550543 starts: users in the Americas cannot reach Exchange Online mailboxes. |
| Thu 23:56 (18:26 UTC) | MO1550821 opens for the wider Microsoft 365 impact. |
Friday 13 November: the slow recovery
| Time | Event |
|---|---|
| Fri 13 Nov, 00:23 (18:53 UTC) | Microsoft says the issue may affect Microsoft 365 connectivity “for users in any region”. |
| Fri 01:05 (19:35 UTC) | Microsoft pauses all deployments and configuration changes. |
| Fri 01:11 (19:41 UTC) | Microsoft says the load comes from servers being unexpectedly unavailable. Traffic had not increased. |
| Fri 02:04 (20:34 UTC) | Microsoft says the failed health checks may come from a component that processes server health, and looks into high processor usage. |
| Fri 03:00 (21:30 UTC) | A different health-check method brings a subset of servers back. |
| Fri 03:41 (22:11 UTC) | Microsoft says a core process on the affected servers was becoming overwhelmed. |
| Fri 06:20 (00:50 UTC) | Microsoft warns that recovered servers can become unresponsive again once they receive traffic, and limits traffic to them in some locations. |
| Fri 08:34 (03:04 UTC) | Downdetector still shows more than 25,000 Outlook reports, down from a peak of about 130,000. |
| Fri 10:06 (04:36 UTC) | Microsoft adjusts and redistributes traffic and blocks some of it on purpose. It reports partial recovery in the regions where it has done this. |
| Fri 14:54 (09:24 UTC) | Microsoft reports early stabilisation and extends the email timeout to 48 hours to preserve delayed mail. |
| Fri 15:58 (10:28 UTC) | Recovery continues in phases. Microsoft says service health is still variable and capacity is not back to its normal level. |
| Fri 19:02 (13:32 UTC) | Microsoft reports broader improvement in North America, sustained improvement across much of Europe and “encouraging recovery signals” in Asia Pacific. |
| Fri 19:47 (14:17 UTC) | Microsoft says email queues are “significantly reduced and approaching normal levels”. Some users may still have access problems or delayed mail. |
| Fri 22:10 (16:40 UTC) | Microsoft apologises and reports broad recovery. It gives a first cause: an issue introduced during an earlier network capacity upgrade, which surfaced after a recent network change. It promises a full post-incident report. |
Saturday 14 November: service restored
| Time | Event |
|---|---|
| Sat 14 Nov, 01:31 (20:01 UTC Fri) | Microsoft says its systems are stabilising and queued mail is still draining. Access can come back before mail flow does. It gives no time for full recovery. |
| Sat 03:30 (22:00 UTC Fri) | Microsoft reports sustained recovery. It keeps watching the mail backlog before it calls the incident resolved. |
| Sat 11:39 (06:09 UTC) | Microsoft says it has finished its work on the underlying issue and has restored service to the remaining customers and regions. |
Downdetector numbers are reports that users type in. They show the shape of an outage and say little about how many customers the outage hit.
What stopped working
The Exchange Online incident covered Outlook on the web, the Outlook desktop connection (MAPI), Exchange ActiveSync on phones and the REST API. By late Thursday UTC, Microsoft’s list for MO1550821 had grown to include:
- Exchange Online, Microsoft Teams and SharePoint Online
- Microsoft 365 Copilot
- Microsoft Defender XDR and Defender for Office 365
- Microsoft Intune
- Microsoft Purview features such as Data Loss Prevention and auto labelling
- Planner, To Do and some Power BI exports
The security tools on that list matter. If your alerts and email filtering run through Defender, an outage like this also reduces what you can see. TechCrunch reported that the Microsoft 365 admin centre itself was unreachable for part of the outage, so admins could not read the incident page they were told to check.
Was it a cyberattack?
No, according to Microsoft. On Friday it said it had no evidence of malicious activity. Later that day it described the outage as a technical issue with no link to a cyberattack or to AI agents. Microsoft’s explanation is about capacity: servers failed health checks, went out of rotation, and the remaining ones were overloaded. At first Microsoft said it found no recent change that lined up with the start of the problem. Early on Friday it began reverting a network configuration change that did line up with it. On Friday night it said the problem was introduced during an earlier network capacity upgrade and surfaced after a recent network change.
The Outlook zero-day patched on 10 November, CVE-2026-124194, is a different thing. That bug leaks a user’s NTLMv2 hash when the user opens a crafted message file in Outlook on a PC. It does not take Microsoft’s cloud servers offline. Our guide to the Outlook zero-day CVE-2026-124194 explains how to patch it, and you should still do that this week.
Microsoft has promised a full post-incident report and has given no date for it. Until then, tell your management that the cause above is Microsoft’s first statement and that the detailed report is still to come.
What to do during a Microsoft 365 outage
- Confirm it is Microsoft and not you. Check Service health in the admin centre and Microsoft’s public status page. If both are down, the Microsoft 365 Status account on X carries the same updates.
- Tell staff early, in one message, on a channel that does not depend on Microsoft 365. A phone group or SMS is enough.
- Leave your configuration alone. Changing MX records, connectors or Conditional Access in the middle of a provider outage creates a second incident that stays after Microsoft recovers.
- Try another way in before you give up. In partial outages, Outlook on a phone or Outlook on the web sometimes works when the desktop app does not.
- Do not ask staff to forward work email to personal accounts. Company data ends up in mailboxes you do not control, and it rarely comes back.
What to check after it recovers
- Mail that other servers tried to deliver to you normally waits on the sending server, which retries it. The SMTP standard asks senders to keep retrying for at least four to five days, so messages usually arrive late instead of being lost. Microsoft has not reported lost mail in this incident, and on Friday it extended its own email timeout window to 48 hours so that delayed messages are kept. If a customer says they wrote to you on Thursday night, ask them to check for a bounce message and resend.
- Look at mail your own systems send through Microsoft 365, such as invoices, alerts and website forms. Some applications give up after one failed attempt and never retry.
- Review sign-in logs for the outage window. Users who could not log in often retry many times, approve MFA prompts without thinking, or type their password into the first page that offers to fix the problem.
- Warn staff about outage-themed phishing. Our email security checker also shows whether someone else could send mail in your domain’s name.
Free tool: Check your domain’s SPF, DKIM and DMARC in a minute with our email security checker.
Prepare for the next one
This was not a one-off. TechCrunch points out that Microsoft 365 also had an outage lasting days at the start of September, which Microsoft blamed on a core authentication configuration. A small office can prepare in an afternoon:
- Write down who tells staff, on which channel, and who talks to customers.
- Keep an offline copy of key contacts: customers, vendors, your bank, your IT support.
- Know which business processes stop without email, and what the manual version of each one is.
- Keep one admin account’s recovery details on paper in a safe place. An outage is a bad time to discover that the password manager also needed Microsoft 365 sign-in.
- If email is how orders reach you, put a second contact method on your website and invoices.
Related guides
- Outlook Zero-Day CVE-2026-124194: November 2026 Patch Tuesday, What to Patch First
- October 2026 Patch Tuesday: Shell Zero-Day and Exchange Deadline
- ConnectWise Breach and Storm-0940: Microsoft 365 Tenant Takeover
- Your Vendor Had a Data Breach: What to Do in the First 48 Hours
Sources
- SecurityWeek: Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams, 12 Nov 2026
- TechCrunch: Microsoft’s Outlook email hit by new outage, 12 Nov 2026
- Tom’s Guide: live updates on the Outlook and Microsoft 365 outage
- StatusStack: Microsoft 365 and Exchange Online connectivity issues, 12 Nov 2026
- WindowsForum: MO1550821 hits Intune, Defender and Purview
- Digital Trends: Outlook is out, but it’s finally restoring slowly
- Microsoft 365 Status on X: recovery updates of 13 Nov 2026
- ABC News (Australia): Microsoft outage live blog, 13 Nov 2026
- WindowsForum: server health checks, network rollback and an unconfirmed root cause, 13 Nov 2026
- Cloud Admin Hub: MO1550821 service health updates, 13 Nov 2026
- Reuters, in The Express Tribune: Microsoft restores service to Outlook and Teams after global outage, 14 Nov 2026
- Digital Trends: Microsoft’s longest outage in years is finally over, 14 Nov 2026
- Daily Caller: time of Microsoft’s restoration post, 14 Nov 2026
- RFC 5321, Simple Mail Transfer Protocol, section 4.5.4.1 (retry strategy)
Want your Microsoft 365 setup reviewed? Our VAPT services cover mail, sign-in and sharing settings, and the free website safety check grades your site in seconds. Contact us for a quote.
