A global Exchange Online failure took down Outlook and then other Microsoft 365 apps. Microsoft says there is no sign of a cyber attack, but it has not yet named a root cause. The outage started on Thursday 12 November and ran into Friday 13 November.
What happened
Outlook error reports began spiking around 12:39 p.m. ET on Thursday. At 12:54 p.m. Microsoft said it was investigating Exchange Online mailbox problems in the Americas. It then spread: Teams, SharePoint Online, Copilot and Defender XDR were affected too.
flowchart TD
A[1. Servers fail health checks<br/>Exchange Online, about 12:40 pm ET] --> B[2. Healthy servers overload<br/>same traffic, fewer servers]
B --> C[3. Impact spreads<br/>Teams, SharePoint, Copilot, Defender]
C --> D[4. First fixes fall short<br/>restarted servers crash under traffic]
D --> E[5. Config fix and revert<br/>gradual recovery by Friday]
The cause, as far as it is known
Microsoft’s explanation changed during the day.
- It first blamed elevated load, then said a surge in users was not responsible: many servers had become unavailable and their work shifted to the remaining machines.
- Affected servers were failing automated health checks and showing high processor usage.
- Microsoft later said a process responsible for establishing secure connections became overwhelmed, so servers stopped processing requests.
- Overnight, Microsoft began reverting a recent network configuration change that coincided with the start of the outage, but has not confirmed it as the root cause.
- The Verge reported, citing sources, that the problem was linked to Azure Virtual Network configuration changes. Microsoft has not confirmed this.
One academic suggested that a malfunctioning health-check system can switch off healthy servers and overload the rest. He stressed that this is an inference from Microsoft’s updates, not a confirmed finding. Treat any definite root cause you read today as speculation until Microsoft publishes its report.
How service came back
- Microsoft paused all deployments, moved traffic off affected infrastructure and restarted servers. Some steps did not give the expected relief.
- Around 6 p.m. ET it returned some servers to service, then warned they could become unresponsive once traffic hit them. Servers restored overnight did crash when traffic returned, and Microsoft admitted its changes were not taking as expected.
- By Friday morning Microsoft reported broader improvement in North America, sustained improvement in much of Europe and encouraging signs in Asia Pacific. Some users still had intermittent access or delayed email.
- As of Friday, Microsoft had not declared the incident resolved.
How big was it?
- It reached 74 countries and territories, and Downdetector logged nearly 140,000 Outlook reports. Reports peaked near 130,000 around 1:15 p.m. ET on Thursday and were under 10,000 by Friday morning.
- Downdetector counts reports, not users. Microsoft says more than 430 million people use its 365 apps.
- No official count of affected companies has been published. Reported impacts included UK GP practices, the Singaporean government and Australia’s intelligence agency. OpenAI and Anthropic both reported problems with their Microsoft 365 connections. New York City warned of delayed email from its agencies.
Was data lost, or was it an attack?
Nothing Microsoft has said suggests customer data has been exposed or lost. Microsoft said it has no indication of malicious activity. Still, check that important mail sent during the outage was delivered.
Takeaways for DevOps teams
- A health check that fails wrongly can remove healthy capacity and cause an outage on its own.
- Restarting servers into full traffic can crash them again. A gradual ramp-up matters.
- Recent configuration changes are usually the first thing to check or revert.
- Do not leave email or other business-critical channels without a fallback.
- This is the second time in 2026 that lost server capacity has taken down several Microsoft 365 services at once.
This post will be updated when Microsoft publishes its post-incident report. The company has promised a full report with the root cause once mitigation is complete. Figures and statements are as reported on 13 November 2026.