Microsoft 365 Outage Runbook Builder
On 12 November 2026, per Microsoft and press reports, Exchange Online mailbox access failed in the Americas, then Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR were affected in multiple regions. Microsoft said it was not aware of malicious activity causing it. If email, chat and your security console go at once, how do you tell anyone? Fill in the form and get a runbook for the next one. Read what happened in the Microsoft 365 outage.
TL;DRWhat this tool does
4 points
- Answer a short form: who declares, which channels work without Microsoft 365, where the offline contact list is, which processes need email, Teams or SharePoint, and the fallback for each.
- Get a seven-phase runbook on the page: detect and confirm, declare, communicate, keep working, security watch, recover, and post-incident review.
- Status checks and Microsoft's post-incident review timing come from Microsoft Learn, linked in the runbook. Anything you leave blank is listed as an open decision.
- Free to use, signed out too. Your answers stay in this browser and nothing is sent to us. Markdown and PDF downloads are available with a paid plan.
Frequently asked questions
How do I check if Microsoft 365 is down?
Sign in to the Microsoft 365 admin center at admin.microsoft.com and go to Health > Service health. If you cannot sign in to the admin center, Microsoft points to its public status page at status.cloud.microsoft and the @MSFT365Status account on X. Service Support and Helpdesk admins can view Service health, not only Global Admins.
What should be in a Microsoft 365 outage runbook?
Who declares an outage and their deputy, a communication channel that does not depend on Microsoft 365, an offline contact list, the critical processes that depend on email, Teams or SharePoint with a fallback and owner for each, a security monitoring fallback, a customer status method, and recovery and review steps.
How do we communicate with staff when email and Teams are down?
Through a channel you set up before the outage: an SMS broadcast service, a phone tree, or a chat workspace that does not run on Microsoft 365. Keep the contact list somewhere that still works offline, such as a printed copy or an encrypted copy on managers' phones.
Does Microsoft publish a post-incident report?
Yes, for incidents with broad impact. Microsoft Learn says a preliminary post-incident review is delivered through Service health within 48 hours of resolution, and a final one within five business days. It covers impact, start and end times, a timeline, root cause and follow-up actions.
What happened in the 12 November 2026 Microsoft 365 outage?
Per Microsoft and press reports, it began with Exchange Online mailbox access failures in the Americas, then affected Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR in multiple regions. Microsoft said it was not aware of malicious activity causing it and would publish a post-incident report.
Why does an outage need a security watch?
Attackers use outages as a lure: fake "sign in to restore access" emails, texts and helpdesk calls. Security tooling can also be delayed, so alerts that arrive late after recovery still need review rather than bulk closing.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.