---
title: "Microsoft 365 Outage: Outlook Down, What Is Confirmed"
url: https://playciso.com/blog/microsoft-365-outage-november-2026
updated: 2026-11-13
section: Blog
publisher: PlayCISO
---

# Microsoft 365 Outage: Outlook Down, What Is Confirmed

> Microsoft 365 and Outlook outage from 12 Nov 2026: live timeline, what Microsoft has confirmed, claims checked, what to do now. Updated 13 Nov.

Source: https://playciso.com/blog/microsoft-365-outage-november-2026 · Published: 2026-11-13 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050

---

A global Microsoft 365 outage began at about **16:17 UTC on 12 November 2026** (8:17 AM Pacific) with Exchange Online mailbox connection failures in the Americas, then took down or degraded **Outlook, Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR** in all regions. Microsoft says restored servers kept stopping again when traffic returned. It says there is **no indication of malicious activity**, has not yet given a root cause, and will publish a Post-Incident Report. As of about 08:00 UTC on 13 November, more than 15 hours in, recovery was partial.

**Who this is for:** IT and security leaders running on Microsoft 365, and anyone asked by an executive "was this an attack, and what did it cost us?".

*Independent analysis. PlayCISO is not affiliated with Microsoft. Facts as of about 08:00 UTC on 13 November 2026; this is a live incident and details will change. Microsoft's status posts were read through a mirror of its service-health updates and quoted press; see Sources.*

Confirmed vs not yet known

**Confirmed by Microsoft:** incidents EX1550543 (Exchange Online) and MO1550821 (Microsoft 365 suite); the services affected; load caused by servers being unavailable, not by more traffic; a secure-connection process on the servers becoming overwhelmed; a recent network configuration change being reverted because it "correlates with the start of impact"; "no indication this is the result of malicious activity"; a Post-Incident Report to come.

**Speculation, not supported by any primary source:** that it was a DDoS or any cyberattack; that it is linked to the Outlook zero-day patched on 10 November.

**Not yet known:** the root cause; when full service returns; how many tenants or users were affected (Microsoft has given no count); whether the earlier Teams incident TM1550488 is related.

## Timeline

Microsoft's own times are Pacific; UTC added. Most rows come from a mirror of Microsoft's service-health posts; quoted rows come from ABC Australia's live blog, which quotes Microsoft word for word.

| UTC | What Microsoft said | Source |
| --- | --- | --- |
| 12 Nov 14:45-15:53 | Separate Teams incident TM1550488 in North and South America, put down to "resource contention"; resolved. Microsoft has not said it is related. | BleepingComputer |
| 12 Nov 16:17 | EX1550543 starts: users "may be unable to connect to their mailboxes in Exchange Online through multiple connection methods". | Microsoft, via ENow mirror |
| 12 Nov 18:19-18:29 | "Elevated load across multiple regions"; traffic redirected away from US infrastructure; MO1550821 opened for multiple Microsoft 365 services. | Microsoft, via ENow mirror |
| 12 Nov 19:06-19:30 | Deployments and configuration changes paused. | Microsoft, via ENow mirror |
| 12 Nov 19:18 | "The elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure." | @MSFT365Status (seen via search) |
| 12 Nov 19:43-20:38 | Servers failing automated health checks; a health-check component bypassed on some servers; many servers unresponsive and being restarted. | Microsoft, via ENow mirror |
| 12 Nov 22:00 | "Our actions taken thus far have not provided the anticipated relief… a core process on the affected servers is becoming overwhelmed." | Microsoft, quoted by ABC |
| 12 Nov 23:59 | Returned servers going unresponsive again under traffic; some traffic types limited. | Microsoft, via ENow mirror |
| 13 Nov 01:06 | "A process on the affected servers responsible for establishing secure connections… becomes overwhelmed… we've begun reverting a recent network configuration change that correlates with the start of impact." | Microsoft, quoted by ABC |
| 13 Nov 03:34 | "No indication this is the result of malicious activity." | Microsoft, via ENow mirror and ABC |
| 13 Nov 04:56 | A surge in outbound calls from routing services to backend servers; virtual machines being scaled; "machines stuck in a bad state". | Microsoft, via ENow mirror |
| 13 Nov 06:06 | "We are not aware of any malicious activity that is causing this incident." A Post-Incident Report will give "full details of the root cause, defense-in-depth repair items, and more". | Microsoft, quoted by ABC |
| 13 Nov 06:14-06:38 | Working to improve the recoverability of its frontend servers and evaluating traffic controls to raise capacity and stability in active regions: traffic throttling, protocol adjustments and failover routing. Expanding internal testing in a contained environment to improve traffic monitoring and issue detection. New impact note: on-premises mail flow to or from Exchange Online may be affected. Exchange Online remains a service degradation. "Not aware of any malicious activity"; Post-Incident Report after mitigation. Next updates due 07:00 UTC (MO1550821) and 07:30 UTC (EX1550543). | Microsoft bulletins MO1550821 (1:14 AM ET) and EX1550543 (1:38 AM ET), as summarised on social media; bulletins not opened |
| 13 Nov 07:45-07:50 | "Positive results for server stability" after a patch to part of the infrastructure, to be expanded to more regions; recovery continuing. The same update, as shared on social media, described "positive results in service stability and increased capacity" with the mitigations being applied across affected regions for a sustained recovery; status still service degradation. | Microsoft, quoted by ABC and ITdaily |
| 13 Nov 07:24-08:06 | A fix to an upstream component involved in authentication and routing configuration shows positive results on part of the infrastructure; at 08:06 Microsoft says stability is confirmed where the fix was applied and begins rolling it out, prioritising regions in or entering business hours. Not full recovery. | Microsoft updates, as reported by Data is CITY Media |
| 13 Nov 08:57 | Microsoft 365 (Business or Enterprise) update at 2:57 AM US Central: "Users still unable to connect to multiple Microsoft 365 services." | Microsoft status update, as shared on social media |
| 13 Nov 09:03 | "We are seeing early signs of stabilization, but service capacity has not yet returned to normal levels." Infrastructure is being cycled through traffic drain, restart, remediation and staged return to service. Microsoft is "extending the email timeout window to 48 hours to help protect delayed messages", still "not aware of any malicious activity". Next update 10:00 UTC. | Microsoft MO1550821 update, via University of Pennsylvania's mirror of Microsoft incident records |

### Fix, fail, repeat

A summary circulating on social media (all times Central, from an unnamed outlet) describes the pattern in four steps: servers restarted and some returned, then became unresponsive again under traffic; progress reported at 7:59 p.m. CT (01:59 UTC); an update at 9:13 p.m. CT (03:13 UTC) saying the latest fixes were not working as expected; partial recovery in some regions at 10:36 p.m. CT (04:36 UTC) while traffic was adjusted and redistributed; and an update at 11:01 p.m. CT (05:01 UTC) saying Microsoft was working on multiple fixes and returning parts of its infrastructure to a healthy state. Converted to UTC, those line up within about 15 to 25 minutes with the entries in the table above (positive results at 01:45, a change "not performing as expected" at 02:54, partial recovery at 04:10, and multiple fixes at 04:56), and the minute-level differences are most likely down to which timestamp each outlet used. A follow-up in the same series adds that Microsoft said at 8:29 p.m. CT (02:29 UTC) it was adding capacity to support regions coming back online, and at 9:13 p.m. CT that it was looking at other ways to increase capacity as traffic-management imbalances continued. It also cites Downdetector at about 22,800 Outlook problem reports at 9:14 p.m. CT (03:14 UTC on 13 November), against a peak above 131,000 around 12:15 p.m. CT (18:15 UTC on 12 November). That peak matches ITdaily's figure of more than 130,000 at about 18:00 UTC, and the fall to about 22,800 is a sign of partial recovery, not of resolution: Downdetector counts people reporting problems, so it does not measure how many were affected, and it is not a Microsoft figure. The summary's last point, no confirmed cause and no timeline for full restoration, was also true when we last checked.

## What was affected

**Latest bulletin (13 Nov, 06:38 UTC, 1:38 AM ET).** Microsoft's EX1550543 update says Exchange Online is still a service degradation: users may be unable to reach mailboxes through Outlook on the web, Outlook desktop (MAPI), ActiveSync or REST, and email delivery may be delayed. It added that **on-premises mail flow may be affected if it goes to or from Exchange Online**, which matters for hybrid organisations. Features that depend on Exchange or email remain affected, including some Microsoft 365 admin center pages, recently used files, Teams calendar and meeting scheduling, Copilot, SharePoint features that depend on Exchange, Defender, Purview, Intune, Microsoft Graph, Planner, To Do, Power BI and Fabric sensitivity-label exports, Universal Print, Windows 365 Cloud PCs that use Purview Customer Key, and Microsoft 365 Education features. Microsoft says Teams core calls, meetings, group chats and standard channel messages are not impacted, and files stored directly in SharePoint remain accessible. Microsoft says it is working to improve the recoverability of its frontend servers, evaluating traffic throttling, protocol adjustments and failover routing, and expanding contained internal testing to improve traffic monitoring and issue detection. We read this through a summary posted on social media, not the bulletins themselves.

Per Microsoft: Exchange Online across OWA, MAPI, ActiveSync and REST connections; Teams (Microsoft said core messaging and meetings remained largely functional at one point); SharePoint Online; Microsoft 365 Copilot; and **Microsoft Defender XDR**. Later updates added Planner, To Do, Purview, Intune, Power BI, Universal Print and Windows 365, and Defender for Office 365. It started in the Americas and spread to all regions. On scale, ITdaily reported more than 130,000 Outlook reports on Downdetector at around 18:00 UTC from 74 countries and territories, and ABC reported more than 11,000 reports a minute at 19:38 UTC, nearly 70% from the US. Microsoft has given no count of affected tenants or users. A widely shared post citing Reuters puts Outlook reports at around 140,000 at the peak; we could not open a Reuters article to check it, so treat the figures as approximate and from different moments.

## What it looked like on the ground

### Knock-on effects confirmed by the companies themselves

- OpenAI (ChatGPT): its status page reported "elevated errors affecting the Microsoft 365 connector" from 18:29 UTC on 12 November, saying new connections may be broken and tools not working as expected.

- Anthropic (Claude): its status page traced Microsoft 365 connector failures to "a Microsoft 365 service incident", with mail, calendar and search tools failing for most requests and Claude for Outlook affected.

- Autodesk: its health dashboard reported customers unable to log in to Autodesk products because one-time passcodes were not arriving, "caused by a third-party service provider, Microsoft", and pointed users to backup recovery codes.

- Workhorse Group: the US electric-vehicle maker postponed its third-quarter results from 12 to 16 November, saying in a press release that "the rescheduling is due to business disruptions caused by the global Microsoft outages taking place today".

- IndiGo: said its email support was affected and other support channels remained available (per The Tribune). A viral list also claims IndiGo and Virgin Atlantic passcodes stopped arriving; we found no statement from either airline supporting that.

The pattern is worth noting: anything that sends one-time passcodes or verification links through Exchange Online stops working when Exchange does, even for companies whose own systems are healthy. If your login flow emails a code, check what happens when your mail provider is down.

### Hospitals, schools and Japan

Data is CITY Media, a Japanese security outlet, reports that a hospital group in Toronto declared a "Code Grey" (an infrastructure failure alert) because email was unavailable, saying patient care was not affected; that some students at an Australian distance-education school could not join classes on Teams; and that Nikkei counted more than 300 Outlook reports from Japanese users on Downdetector by about 06:00 Japan time. It also notes that Azure's own status page showed no overall Azure outage: this is a Microsoft 365 incident, not all of Microsoft's cloud. We have not seen the hospital's or the school's own statements.

### Railways: communications, not trains

Notebookcheck reports that at Deutsche Bahn in Germany, Outlook became extremely slow and sending timetables for cancellations and reroutings was disrupted, with other rail operators also reporting effects, and that at VIA Rail in Canada train operations were unaffected but customer communications such as delay notifications were disrupted. We have not seen the operators' own statements. In Japan, we found no public report of rail cancellations or delays caused by the outage as of 13 November. The pattern matches everything else on this page: the risk sits in the coordination around operations (controller messages, crew changes, maintenance records, passenger notices) that has quietly moved onto email and chat.

### United Kingdom: police forms and a minister's frustration

Guido Fawkes reported on the morning of 13 November that police online forms were affected at the Metropolitan Police, Greater Manchester, North Yorkshire, South Wales and Dyfed-Powys, with the Met advising: "If your report is time-critical but not an emergency, please call 101." It said intelligence services were unaffected and that Manchester Airport was the only airport disrupted at that point. Defence Minister Luke Pollard told BBC Breakfast: "It's deeply frustrating when your tech doesn't work… we do need to make sure that these systems are more resilient and where there are problems, that they can recover faster." We have not seen the forces' own notices.

Other UK organisations posted the same kind of notice. Dorset Police told the public it could not be contacted through its website because of the Microsoft issue (as reported by Greatest Hits Radio), and at least one London secondary school told parents it could not see any emails and asked them to phone in absences, sickness and safeguarding concerns. That last one is the important lesson: safeguarding reports must never depend on a single channel.

### United States: bail by email

A notice attributed to the Arapahoe County Detention Facility in Colorado said jail staff were not receiving the email notifications needed to process online bond payments, so anyone posting bond for immediate release had to do it in person until Outlook email was restored. It is a small example of a big point: a process that quietly depends on an email arriving stops when email stops.

### Australia activates its Microsoft agreement

Reuters reported on 13 November that Australia's spy agency ASIO and the Australian Federal Police were among the organisations affected, and that Home Affairs Minister Tony Burke said Microsoft told him it did not believe the outage was caused by a cyber attack. Burke said "the government has activated an agreement to ensure Australia gets prioritised in restoring services", describing it as the first of his formal cyber agreements. That agreement is a memorandum of understanding Burke signed with Microsoft in June 2026; Microsoft's announcement of it covered critical-infrastructure resilience and threat sharing, and ABC reports it includes a pledge to prioritise recovery of Australia's digital economy from major Microsoft outages. ABC's Cam Wilson also reported that Home Affairs national security head Hamish Hansford warned on the InnovationAus podcast in August of a "disproportionate impact" if Microsoft suffered an outage, saying big tech providers "underpin our national security" and "underpin the functioning of the economy".

**Airlines in India.** Moneycontrol reported on 13 November that "at least three flights" were cancelled and several delayed at Delhi's Indira Gandhi International Airport. It attributes the detail to NDTV (we could not find that report to check it): SpiceJet cancelled three Delhi departures that morning (to Pune, Leh and Mumbai) and delayed two (to Darbhanga and Mumbai), "owing to the Microsoft glitches". The article carries no statement from SpiceJet or the airport operator and does not say how the outage disrupted flights. The airlines' own posts it embeds describe a narrower problem. IndiGo said that "due to a global Microsoft service disruption, our email support services are currently impacted, and we may not be able to receive your emails". Akasa Air said email support was delayed. Air India said "our flight operations remain unaffected, and there is currently no impact on any of our communication channels." Treat the cancellations as reported but unconfirmed, and the airline impact as mostly customer email and support. We found no source tying airline or airport disruption in any other country to this outage; coverage of airlines hit by a Microsoft-related outage from July 2024 (CrowdStrike) and October 2025 (Azure) is about different events.

A post shared from France on 13 November describes two accounts in ten minutes: a blood-testing laboratory that could no longer print or open its systems and was sending people home, and a higher-education institution where nobody could reach timetables or room bookings. These are first-hand social posts, not verified reports, and the organisations are not named. They match what Microsoft's own list implies: when email, files, identity-driven apps and printing (Universal Print was on the list) sit on one provider, an outage stops work that has nothing to do with email. The same post links the outage to the cyberattacks on supermarket freezers in Europe as a sign of fragility; those are a separate set of incidents (see our [fact-check of the freezer attacks](/blog/cyber-incidents-2-5-november-2026-whats-confirmed)), and Microsoft says this outage was not an attack.

## Claims going around, checked

- "Outlook won't come back for days or weeks, and users will lose data." No source supports this. Microsoft has given no restoration estimate and has said nothing about data loss; its updates describe servers being restarted, a configuration change being reverted and a patch being rolled out region by region. Mail sent during the outage may arrive late, but treat predictions of weeks of downtime or lost mailboxes as speculation until Microsoft says otherwise.

- "Google is next." Speculation. Nothing links this incident to any other provider. Independent outage maps such as ThousandEyes' are a reasonable way to watch for wider internet problems, but they are not evidence of a coming outage.

- "10+ hours, about 140,000 Outlook reports, no sign of a cyberattack." Broadly right, as of the morning of 13 November in Europe: Microsoft says there is no indication of malicious activity, the outage passed 15 hours, and Downdetector-based counts reported by outlets range from 130,000 to about 140,000 Outlook reports at the peak. A widely shared infographic with these figures is not a Microsoft source.

- "The fault seems to be an update to Microsoft's servers" and "millions of Australians" cannot reach email. The first part is close to what Microsoft has said, with a difference that matters: Microsoft said a recent network configuration change "correlates with the start of impact" and that it began reverting it, and later that the change was "not performing as expected". That is a correlation Microsoft is acting on, not a confirmed root cause, which it has promised in a Post-Incident Report. It has not said an update to the Outlook servers caused it. The "millions of Australians" figure is not from Microsoft, which has given no count of affected users or tenants anywhere, and we could not trace it to a source; Downdetector report counts, where outlets give them, measure people reporting problems, not people affected.

- A "Satya Nadella statement" saying Microsoft takes "full responsibility" and that the outage "has nothing to do with Jensen Huang". Treat it as fake. Techaeris reported that Nadella "has issued no statement on the incident through any channel", and we found none on Microsoft's channels or in any outlet. The only Microsoft executive statement we found is Charles Lamanna's on X at 03:37 UTC on 13 November: "We regret that today's outages caused disruptions for our customers, and we are working to address the issue. We will continue to share more information as soon as we have it, and for now I can confirm that there is no indication this is the result of malicious or cyber activity."

- A "Brad Smith statement" apologising for an attack and $125 million of losses. Treat it as fake. We found no such statement on Microsoft's channels or in any credible outlet; Brad Smith's newest post on Microsoft On the Issues predates the outage; his title is Vice Chair and President, not CEO; and the quote's talk of "bad actors behind this attack" contradicts every Microsoft update, which says there is no indication of malicious activity. The account that posted it has posted a similar "Bill Gates" apology, and the Greek outlet Proto Thema described another Smith quote circulating as fictional.

- "Hundreds of millions" or "billions" in lost productivity. No one has published a credible total for this outage. The "$300,000 or more per hour" figure often quoted comes from ITIC's 2024 Hourly Cost of Downtime survey, in which more than 90% of mid-size and large firms estimated that an hour of downtime costs them over $300,000; those are firms' own estimates for any kind of downtime, not a measure of an email outage. One risk adviser quoted by ABC put professional-services losses in Australia at more than $100,000 an hour. Multiplying a survey figure by "millions of organisations" produces a big number, not an estimate. The same goes for national figures such as "Outlook down for a day cost Portugal €40 to 100 million": 1 to 1.5 million office workers losing 2 to 4 hours at about €19 an hour does come to roughly €38 to 114 million, but the worker count and hours are assumptions, and much of that work is caught up later. The labour cost is close to Eurostat's figure for Portugal of €19.40 an hour in 2025, an average across all employees in industry and services, not office workers alone. Our [outage economic impact estimator](/tools/outage-economic-impact-estimator) runs the same sum with ranges and shows which assumption matters most. Our [cost calculator](/tools/m365-outage-cost-calculator) works out your own figure from your own users and hours.

- "Widespread disruptions across Microsoft, AWS, Google, Cloudflare, Zoom and Xfinity; possible cyberattack." A widely shared "threat advisory" from an account calling itself The 17th Perspective lists spikes in user reports across those platforms. We found no statement from AWS, Google, Cloudflare, Zoom or Comcast confirming an outage on 12 November; spikes in Downdetector reports can also come from users who blame the wrong service when Outlook or Teams fails. The advisory says Microsoft acknowledged "unexpected service traffic", which is the opposite of what Microsoft said: that the load was not driven by more traffic but by servers becoming unavailable. It names NoName057(16) and Z-Pentest, then says itself that neither has been linked to these outages, which is correct; their claims concerned other incidents, such as the European refrigeration attacks covered in our [fact-check](/blog/cyber-incidents-2-5-november-2026-whats-confirmed). Its defensive advice (phishing-resistant MFA, review sessions and privileged accounts, check backups, avoid unexpected login links) is sound in any week.

- "Microsoft, TSMC and Nvidia on the same day means a coordinated foreign campaign." No source links them. TSMC disclosed an employee-data exposure through an outside cloud provider, Nvidia announced its CEO's resignation, and Microsoft attributes its outage to its own servers and network, all on 12 November. We checked each in [TSMC, Nvidia and Microsoft on 12 November: not one campaign](/blog/tsmc-nvidia-microsoft-12-november-2026-not-one-campaign).

- "Microsoft hasn't attributed it to malicious activity, but that doesn't mean they've ruled it out." Fair as far as it goes. Microsoft's wording is "no indication this is the result of malicious activity" and "not aware of any malicious activity", which describes what it has found so far, not a final finding; the Post-Incident Report is where a cause will be stated. What Microsoft has described, servers failing health checks and a network change correlating with the start, points to an internal failure, and nobody credible has produced evidence of an attack.

- "New Windows security updates released amid the outage: check Windows Update now." The updates are real but unrelated. KB5132061 (OS builds 26300.9974, 26200.9974 and 26100.9974, for Windows 11 26H2, 25H2 and Enterprise/Education 24H2) and the Malicious Software Removal Tool KB890830 (version 5.147) are Microsoft's regular November Patch Tuesday releases of 10 November, two days before the outage began, and nothing on Microsoft's pages links them to it. Installing them is sensible; do it through Windows Update itself, never through a link in an email or post, because fake "urgent update" messages that quote real KB numbers are a common lure in a week like this.

- "The outage is now hitting Xbox players": sign-in failures, digital games not launching, cloud saves and Xbox Cloud Gaming. Reported by players and widely shared posts; we have not seen Xbox confirm a link. Xbox is not in Microsoft's list of services affected by MO1550821, and Xbox has its own status page, so check that before assuming one cause. The quote attached to these posts, "We've monitored the status of the changes applied to improve serviceability and confirmed that change is not taking as expected", is Microsoft's Microsoft 365 update from about 02:54 UTC on 13 November, not an Xbox statement.

- "Over 430 million users without access to Outlook." Microsoft has not given any count of affected users or tenants. A figure that size describes how many people use Outlook, not how many were cut off; the outage hit regions and features unevenly, and Teams core calls and SharePoint-stored files stayed available per Microsoft. Treat any headcount of the affected as a guess.

- "Is this Microsoft's longest outage ever?" Nobody keeps an authoritative ranking. By Microsoft's incident start time (about 16:17 UTC on 12 November) it had run for more than 16 hours by 08:30 UTC on 13 November, long for a global Microsoft 365 incident. Comparisons with earlier incidents ("a 19-hour Outlook outage in 2025", "Azure incidents of 24 to 50 hours") circulate without sources; we could not verify them and do not repeat them as fact.

- "The outage is disrupting international aviation." Not shown. The only concrete report we found is the Indian one above: three SpiceJet cancellations and two delays at Delhi, relayed from NDTV, while IndiGo and Akasa Air described email-support problems and Air India said flight operations were unaffected. Posts that describe airlines "relying on Microsoft for check-in, reservations and crew coordination" are describing what could happen, not what has been reported; no airline or airport operator we found has said check-in or departure control failed because of this outage. Wait for named statements before treating it as an aviation incident.

- Service coming back region by region. Consistent with Microsoft's updates, which describe a patch showing positive results and being expanded to more regions. Check [status.cloud.microsoft/m365](https://status.cloud.microsoft/m365/) or Service health for your tenant rather than relying on reports from other regions.

- Organisations switching to the phone. Local press reports disruption to businesses and schools in Lancashire, and at least one public disaster-management agency in Japan told the public it could not send or receive email and to phone it instead. That is the right move, and the reason every organisation should have a contact route that does not run through Microsoft 365.

## Has this happened before?

Yes, though each had a different cause, so past durations do not predict this one.

| When | What failed | How long | Cause, in Microsoft's words |
| --- | --- | --- | --- |
| 15-16 March 2021 | Azure AD sign-in errors hitting Teams, Exchange, SharePoint, the Azure portal and more | About 14 h 25 min (19:00 UTC to 09:25 UTC) | A key-rotation bug: automation "incorrectly ignored" a key marked "retain" and removed it (Microsoft status text, as kept on Microsoft Q&A) |
| 25 January 2023 | Network connectivity to Azure and Microsoft 365 worldwide | 5 h 35 min (07:08 to 12:43 UTC) | A router IP address change for new WAN capacity "added a command to purge the IGP database" (Microsoft Post Incident Review VSG1-B90) |
| 25-26 November 2024 | Exchange Online and Teams calendars (incident MO941162) | More than 24 hours, per later reports | "A change that caused an influx of retry requests routed through servers" (Microsoft, as quoted by BleepingComputer) |

The common thread is a change somewhere in Microsoft's own infrastructure that cascaded, which is also what Microsoft's updates point to this time. Whether this outage ends up longer than those will only be clear when Microsoft confirms full recovery.

## The failure chain: what is verified and what is not

**Verified from Microsoft's own updates:** mailbox connections to Exchange Online failed from about 16:17 UTC on 12 November across Outlook on the web, Outlook desktop, ActiveSync and REST; many servers failed automated health checks and became unavailable, overloading the rest (Microsoft says the load was not a traffic surge); a process on those servers that establishes secure connections then became overwhelmed and stopped them handling requests; a recent network configuration change that correlates with the start was rolled back; restarts, traffic limits and patches gave partial relief that did not hold. The recovery steps Microsoft has described include restarting servers, adding virtual machines, reverting the network configuration change, redistributing traffic across network paths, and rebuilding servers on a previous configuration (the last as quoted by Moneycontrol from a Microsoft status post). Because so much depends on Exchange, the effects spread: Outlook lost mail, Teams kept core chats, calls and meetings but lost calendars and scheduling, and SharePoint features, Copilot, Defender, Purview, Intune and others that rely on Exchange were degraded.

**Not verified:** why servers began failing health checks, what exactly the network change did, why the secure-connection process could not recover under load, and whether these are one fault or several. Those are the questions the Post-Incident Report should answer; anything more specific circulating today is a hypothesis.

## Does Microsoft have to pay for your losses?

Not for your business losses. Microsoft's Service Level Agreement for Microsoft Online Services (November 2026 edition) offers **service credits**, a percentage of the monthly fee for the affected service, when monthly uptime falls below its commitment. For Exchange Online, Microsoft Teams, SharePoint Online and OneDrive for work or school the tiers are: below 99.9% uptime, a 25% credit; below 99%, 50%; below 95%, 100%. In a 30-day month those thresholds are about 43 minutes, 7.2 hours and 36 hours of downtime, but Microsoft measures uptime in user-minutes and each service has its own definition of downtime, so a partial outage counts for less. Microsoft 365 Copilot has its own tiers (below 99.5%, 25%) measured on failed prompts.

- You have to claim it. The customer submits the claim to Microsoft support with the incident details; for these services Microsoft must receive it by the end of the month after the incident, so for this November outage, by the end of December 2026. Microsoft's outage notices do not mean a credit is owed.

- It is capped. One credit per service per month, up to that service's fees. Credits are the sole remedy and do not cover lost revenue or other business losses.

- Lawsuits: because the SLA makes credits the sole remedy and excludes lost revenue, a court claim for business losses would have to get past those terms. Claims that a class action over an earlier 2025 disruption is pending in Canada circulate without a source; we could not verify them.

- Not verified: whether consumer or personal Microsoft 365 plans carry any credit. The SLA we read covers Microsoft's Online Services sold to organisations; check your own terms.

Our [Microsoft 365 outage cost calculator](/tools/m365-outage-cost-calculator) estimates both numbers side by side: what the outage cost you, and the most a credit could be. For most organisations the gap between the two is the real lesson.

**Work out your own claim:** add up the incidents in the [downtime log calculator](/tools/downtime-log-calculator) (it converts time zones and merges overlaps), turn uptime into a tier and credit per service in the [SLA credit calculator](/tools/sla-credit-calculator), get the deadline, evidence list and a draft in the [SLA claim builder](/tools/sla-claim-builder), rehearse the whole claim in the [SLA breach lab](/tools/sla-breach-claim-lab), and use the [SLA uptime calculator](/tools/sla-uptime-calculator) and [composite SLA calculator](/tools/composite-sla-calculator) to see what 99.9% really allows, and why a chain of services is less available than any one of them.

## Was it an attack?

Microsoft says no indication of one. Its service-health update said "there is no indication this is the result of malicious activity", a later update said "we are not aware of any malicious activity that is causing this incident", and a Microsoft spokesperson told ABC "There's no indication this is a cyber attack." Early talk of a DDoS and an expert's suggestion of a routing misconfiguration are speculation. What Microsoft has described, servers failing health checks, an overwhelmed secure-connection process, and a recent network change correlating with the start, reads like a failure inside its own service. Wait for the Post-Incident Report before drawing conclusions either way. Microsoft's service description says that for incidents with broad impact it publishes a preliminary post-incident review through Service health within 48 hours of resolution and a final one within five business days, covering impact, timeline, root cause and actions.

### Is it linked to the Outlook zero-day?

A widely shared post calls it: the outage, two days after Patch Tuesday, must trace back to the actively exploited Outlook flaw Microsoft fixed that week. **No primary source supports that.** The flaw is **CVE-2026-124194**, "Microsoft Outlook Spoofing Vulnerability", released on 10 November with "Exploitation Detected" in Microsoft's Security Update Guide, rated Moderate with a CVSS 3.1 base score of 6.5. Microsoft's FAQ says a crafted message file that a user opens makes Outlook connect to an attacker's server without the usual warning, which can disclose authentication information; the Preview Pane is not an attack vector. That is a client-side bug that needs a user to open a file. The outage is a server-side failure in Microsoft's cloud that Microsoft ties to its own infrastructure. The timing is a coincidence until Microsoft says otherwise. Patch the Outlook flaw anyway: it is being exploited, and CISA has added it to its Known Exploited Vulnerabilities catalog (per secondary reports).

### Is it linked to the ConnectWise and ARTEX attack?

Another thread ties the outage to a China-linked campaign that used AI agents against more than 2,250 Microsoft 365 tenants through ConnectWise. The campaign is real; the link to the outage is not supported. On **21 October 2026** Microsoft Security Research and Microsoft Threat Intelligence published "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise". Microsoft says it *assesses* that a China-state-aligned actor it tracks as **Storm-0940** was responsible for the compromise of ConnectWise Cloud Backup application identities, and that the actor used ARTEX, an open-source penetration-testing framework of LLM-driven agents, from as early as September 2026 for scanning, reconnaissance, password spraying and OAuth app abuse. Microsoft also says many actors use ARTEX, so it is not an indicator of Storm-0940 on its own. ConnectWise said it identified unauthorized access to application identities in its Cloud Backup environment, disabled seven of them and took Cloud Backup offline, with no indicators to date that partner backup data was compromised (via BleepingComputer).

The numbers in the viral version need care. Microsoft says the actor used ARTEX to **attempt** to sign in to more than 2,250 tenants and that most of the targeting was not successful. The 2,900 figure is Microsoft's peak of 2,900 *failed* sign-ins per minute on 11 October, not successful logons. "Privileged access in under three hours" applies to "several attacks", not typically. Microsoft also says successful authentication does not necessarily mean data was accessed. Our [ARTEX post](/blog/artex-agentic-offensive-frameworks-gtig) covers the framework itself.

A second, separate incident is sometimes bundled in: a campaign abusing third-party extensions in cloud-hosted ScreenConnect panels to install rogue clients through a tool Huntress calls SCKit, on at least 288 computers in 48 organisations. ConnectWise said it found no evidence of a compromise of its infrastructure or a vulnerability in ScreenConnect itself, and disabled five extensions. We could not confirm the exact dates of the reporting. Neither the Microsoft post nor any other source we read links either campaign to the 12 November outage, and Microsoft's own explanation for the outage is failures inside its servers and network, with "no indication" of malicious activity.

## The part security teams should notice

Defender XDR and Defender for Office 365 were in the affected list, and Microsoft's incident text is specific about what that means: Safe Links, Safe Attachments, protection and submission policies, quarantine and Threat Explorer may fail, and "users clicking on wrapped/rewritten URLs typically processed by Safe Links will result in a failure to navigate". Purview's data loss prevention, auto-labeling, audit search and eDiscovery were also listed. For organisations whose email, chat, files, identity-driven apps *and* security monitoring all run on the same provider, an outage removes the tools you would use to see an attack at the same moment staff are most likely to fall for one. Expect outage-themed phishing ("your mailbox was disabled, restore it here") during and after the incident; at least one bank warned customers about scammers using the outage as a pretext, per ABC.

## What security leaders should do this week

- Do not declare it over from the public status page alone. Readers in several countries reported the public status page looking normal while their tenant's Service health still showed the incident as a service degradation. Your admin center's Service health, for EX1550543 and MO1550821, is the record for your tenant; confirm mail flow and sign-in yourself before you stand down your fallbacks.

- Confirm it is Microsoft, not you, before changing anything: check Service health in the admin center for EX1550543 and MO1550821, or status.cloud.microsoft if the admin center is down. Our [Microsoft 365 outage triage checklist](/tools/m365-outage-triage) walks through it.

- Tell staff through a channel that does not depend on Microsoft 365 (SMS, phone tree, intranet hosted elsewhere), and include an anti-phishing line. Our [outage communication templates](/tools/saas-outage-comms-generator) write the messages.

- Do not make emergency configuration changes to conditional access, DNS or mail flow to "fix" a provider outage; Microsoft paused its own changes.

- Tell people their mail is not lost yet. Microsoft says it is "extending the email timeout window to 48 hours to help protect delayed messages", so mail sent during the outage should be held and delivered later rather than bounced. Ask senders to check after recovery rather than resend everything.

- Treat links with extra care. With Safe Links failing to process rewritten URLs, the usual click-time check is not there; warn staff, and expect a backlog of quarantine and threat-explorer review afterwards.

- If you run hybrid mail, expect on-premises mail to and from Exchange Online to be delayed. Watch your queues and connector alerts rather than reconfiguring them, and keep a list of what was queued for the post-incident review.

- Prepare your statement. Our [incident holding statements](/tools/incident-holding-statements) help when the facts are still unclear, and the [crisis communications lab](/tools/crisis-comms-lab) lets your team rehearse it.

- Review security alerts once Defender recovers. Treat the outage window as a gap in monitoring: check delayed alerts, sign-in logs and mail-flow logs for the period.

- Patch CVE-2026-124194 through the November Office updates, separately from the outage.

- Write down what it cost (people idle, revenue missed) while it is fresh, and check whether your agreement allows a service-credit claim. Our [Microsoft 365 outage cost calculator](/tools/m365-outage-cost-calculator) gives a working number.

- After recovery, run the lessons-learned: which processes stopped, which fallback worked, and how much of your stack depends on one provider. Use the [outage runbook builder](/tools/m365-outage-runbook-builder) and the [SaaS concentration risk scorer](/tools/saas-concentration-risk-scorer), check whether your data would survive a provider losing it with the [cloud data loss checker](/tools/cloud-data-loss-survival-checker) (or play the fictional worst case in the [Cloud Collapse wargame](/tools/cloud-collapse-wargame)), then use our [post-incident review template](/tools/post-incident-review-template) and read Microsoft's Post-Incident Report when it lands.

## FAQ

### Does Microsoft have to pay for losses caused by the Microsoft 365 outage?

Not for business losses. Microsoft's Online Services SLA gives service credits of 25%, 50% or 100% of the affected service's monthly fee when uptime falls below 99.9%, 99% or 95% for Exchange Online, Teams, SharePoint Online and OneDrive for work or school. You must claim it through Microsoft support by the end of the month after the incident, credits are capped at that service's fees, and they are the sole remedy: they do not cover lost revenue.

### Is the outage linked to the ConnectWise and ARTEX attack on Microsoft 365 tenants?

No source links them. On 21 October 2026 Microsoft assessed that Storm-0940, a China-state-aligned actor, used the ARTEX AI-agent framework against ConnectWise Cloud Backup application identities and attempted sign-ins to more than 2,250 tenants (most unsuccessful, with a peak of 2,900 failed sign-ins per minute). That report does not mention the 12 November outage, and Microsoft attributes the outage to servers failing inside its own infrastructure, with no indication of malicious activity.

### Is Microsoft 365 down right now?

As of about 08:00 UTC on 13 November 2026 Microsoft was still restoring service, with partial recovery that had not held in every region. Check the Microsoft 365 admin center (Service health) for incidents EX1550543 and MO1550821, or status.cloud.microsoft if the admin center itself does not load.

### What caused the Microsoft 365 outage?

Microsoft has not given a root cause yet. It says the extra load was caused by servers being unexpectedly unavailable rather than more traffic, that a core process responsible for establishing secure connections became overwhelmed, and that it began reverting a recent network configuration change that correlates with the start of impact. It has promised a Post-Incident Report with full details.

### Was the Microsoft 365 outage a cyberattack?

Microsoft says not. Its service-health update said "there is no indication this is the result of malicious activity", a later update said it is "not aware of any malicious activity that is causing this incident", and a spokesperson told ABC "There's no indication this is a cyber attack."

### Is the outage linked to the Outlook zero-day CVE-2026-124194?

No source shows a link. CVE-2026-124194, patched on 10 November and marked "Exploitation Detected", is an Outlook spoofing flaw (CVSS 3.1 score 6.5) in which a crafted message file a user opens makes Outlook connect to an attacker's server without the usual warning. It is a client-side bug that needs user action; Microsoft attributes the outage to server and network failures in its own service. The timing is a coincidence until Microsoft's report says otherwise.

### Which Microsoft 365 services were affected?

Per Microsoft: Exchange Online (OWA, MAPI, ActiveSync and REST connections), Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR, later Planner, To Do, Purview, Intune, Power BI, Universal Print and Windows 365, and Defender for Office 365. It began in the Americas and spread to all regions.

### Can I claim a Microsoft service credit for the outage?

Possibly. Microsoft's Online Services service level agreement offers service credits when monthly uptime falls below its commitment, and the customer has to submit the claim. Check the agreement that applies to your subscription for the uptime tiers and the claim window; our cost calculator gives a rough estimate.

## Sources

"Read" means we opened the page; "via search" means we saw it only in search results.

- [ENow: Microsoft service health updates for MO1550821 and EX1550543](https://www.enowsoftware.com/office-365-monitoring-outages/microsoft-service-health-updates-for-microsoft-outages-mo1550821-and-ex1550543) (mirror of Microsoft's posts, paraphrased; read)

- @MSFT365Status posts on X (via search; X did not load) and [status.cloud.microsoft](https://status.cloud.microsoft/)

- [Microsoft Learn: service health and continuity](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/service-health-and-continuity) (post-incident review timing; read)

- [Microsoft Security Update Guide: CVE-2026-124194](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194) (read through the MSRC API)

- [ABC News: Microsoft outage affects users worldwide](https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050) (live blog quoting Microsoft; read)

- [BleepingComputer: Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide](https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-disrupts-outlook-teams-copilot-worldwide/) (read)

- [ITdaily: Microsoft 365 outage, Outlook and Teams](https://itdaily.com/news/cloud/microsoft-365-outage-outlook-teams/) (Downdetector figure; read)

- [Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) (21 Oct; read)

- [Moneycontrol: Airlines hit by Microsoft outage; flights cancelled, delayed at Delhi airport](https://www.moneycontrol.com/news/india/airlines-hit-by-microsoft-outage-flights-cancelled-delayed-at-delhi-airport-14079305.html) (13 Nov; read; relays NDTV and the airlines' posts)

- [ITIC: 2024 Hourly Cost of Downtime report](https://itic-corp.com/itic-2024-hourly-cost-of-downtime-report/) (source of the $300,000-per-hour survey figure; read)

- [Charles Lamanna on X](https://x.com/clamanna/status/2121085008966529423) (13 Nov 03:37 UTC; read)

- [Reuters via Yahoo: Australia's spy agency, federal police caught up in Microsoft outage](https://www.yahoo.com/news/world/articles/australias-spy-agency-federal-police-030851057.html) (13 Nov; read)

- [ABC: Top national security adviser warned about Australia's Microsoft reliance months ago](https://www.abc.net.au/news/2026-11-13/microsoft-reliance-national-security-risk/107382100) (read)

- [Microsoft: Australian Government resiliency MoU](https://news.microsoft.com/source/asia/2026/06/09/microsoft-au-government-resiliency-mou/) (9 Jun 2026; read)

- [Anthropic status: Microsoft 365 connector incident](https://status.claude.com/incidents/sqn3fg1l96dl), OpenAI status page (status.openai.com) and [Autodesk health dashboard](https://health.autodesk.com/incidents/yc6srpytcxcp) (read)

- [Workhorse Group: postpones third-quarter earnings release](https://ir.workhorse.com/news-events/press-releases/detail/343/workhorse-group-postpones-third-quarter-earnings-release) (12 Nov; read)

- [Techaeris: no word from Nadella](https://techaeris.com/2026/11/12/microsoft-365-outage-no-word-from-nadella/) (read)

- [Microsoft PIR VSG1-B90: Azure Networking, global WAN issues, January 2023](https://azure.status.microsoft/en-us/status/history/?trackingId=VSG1-B90) (read); [Microsoft status text for the March 2021 Azure AD incident](https://learn.microsoft.com/en-us/answers/questions/315440/notification-authentication-errors-across-multiple) (read)

- [Microsoft: November 10, 2026, KB5132061](https://support.microsoft.com/help/5132061) (read)

- [University of Pennsylvania: mirror of Microsoft 365 incident records](https://mailservices.isc.upenn.edu/computing/email/penno365/alerts/ms-incidents.html) (MO1550821 full text to 09:03 UTC on 13 Nov; read)

- Data is CITY Media live article on the outage (13 Nov, updated to 17:40 Japan time; read; cites the UPenn mirror, Nikkei, Reuters and AP)

- [Cyber Security News: Microsoft 365 massive outage](https://cybersecuritynews.com/massive-microsoft-365-outage/) (via search)

- [SecurityWeek: exploited Outlook zero-day among flaws patched](https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/) (via search)

**Share:** #Microsoft365 #Outlook #ExchangeOnline #MicrosoftOutage #Cybersecurity #Infosec #BusinessContinuity #IncidentResponse

*This article is general information, not legal or security advice. Follow Microsoft's service-health guidance for your tenant.*