Is Microsoft 365 Down or Is It Us? Triage Checklist
When mail or Teams stops working, the first question is whose problem it is. Answer a few checks to get a verdict and the next steps. The 12 November 2026 outage began with Exchange Online mailbox access failures in the Americas, then affected Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR in multiple regions, per Microsoft and press reports. Microsoft said it is not aware of malicious activity causing it and will publish a post-incident report. Read what we know about the Microsoft 365 outage.
Microsoft points admins to the status page when they cannot sign in to the admin center. Links open Microsoft's own sites.
Answer at least 3 checks below to see a verdict. “Unknown” counts as answered but adds no signal.
A rule of thumb from your answers, not a diagnosis. Answers stay in this browser only; nothing is sent to us.
1. What Microsoft says
Start with Microsoft's own channels. They are the fastest way to rule a provider issue in or out.
Copy it exactly from the issue page. Microsoft's Graph documentation uses IDs such as MO226784 as examples.
2. Who is affected
A provider outage tends to hit everyone the same way. A local fault tends to follow a site, a network, a client or a group of users.
3. What changed on your side
Anything changed in the last few days is a suspect until ruled out. Ask the change owners, not only the change log.
4. What your logs say
Sign-in logs separate "we blocked it" from "the service failed after sign-in".
First symptom time, affected services, who you told. Do not paste passwords or personal data.
Security angle: what to watch during a provider outage
An outage is a cover story for attackers and can blind part of your monitoring. PlayCISO recommendations.
- Expect outage-themed phishing. Attackers copy the news. Watch for "Microsoft 365 outage: reset your password", "restore your mailbox", "re-verify your account" and fake Microsoft support numbers. Tell users before they see one: IT will not send a link to restore a mailbox or reset a password during the outage.
- Help desk social engineering. Callers who "lost MFA during the outage" and want a reset or a new phone registered are a known pattern. Keep the normal identity verification for resets, even when the queue is long.
- Detection may be reduced. If Microsoft Defender XDR or other Microsoft security services are listed in Service health, alerts, incident queues and data may be delayed or incomplete. Check your other sources (firewall, EDR console, identity provider logs, SIEM) and plan to review the delayed alerts once the service is restored.
- Do not weaken controls as a workaround. Turning off MFA or Conditional Access, allowing legacy authentication or opening the firewall "until it's fixed" creates the gap an attacker needs and rarely fixes a provider outage. If you must make an emergency change, log who approved it and when it will be reversed.
- Watch emergency access and shadow IT. Any sign-in with a break-glass account during the outage should be expected and recorded. Expect staff to move files and conversations to personal email and chat apps; say which alternatives are approved.
- After the outage. Review sign-ins and mailbox rule changes for the outage window, check for users who entered credentials on a phishing page, and add outage-themed lures to your next awareness message.
The filled checklist with your answers, issue ID, notes, next steps and sources, for the incident record.
TL;DRWhat this checklist is
5 points
- A short yes / no / unknown checklist for IT and security admins when Outlook, Teams or SharePoint stop working: what Microsoft says, who is affected, what changed on your side, and what the sign-in logs show.
- Your answers give a verdict (likely Microsoft-side, likely your side, mixed, or not clear yet) with next steps for each.
- Every Microsoft location in it (status.cloud.microsoft, @MSFT365Status, Health > Service health in the admin center, Entra sign-in logs) was checked against Microsoft Learn on 13 November 2026.
- Includes a security angle: outage-themed phishing, help desk social engineering, and reduced detection if Microsoft Defender XDR is affected.
- Free to use. Your answers stay in this browser and nothing is sent to us. Markdown and PDF exports of the filled checklist are available with a paid plan.
Frequently asked questions
How do I check if Microsoft 365 is down?
Admins should check the Service health page in the Microsoft 365 admin center (admin.microsoft.com, then Health > Service health). It lists active incidents and advisories for your tenant. If you cannot sign in to the admin center, Microsoft points you to the public status page at status.cloud.microsoft and the @MSFT365Status account on X.
Is Microsoft 365 down right now?
This page does not show live status. Check status.cloud.microsoft and the Service health page in your admin center, which are Microsoft's own channels. Then use the checklist to work out whether the problem you see matches what Microsoft reports or is on your side.
Why does Service health show nothing when my users cannot get email?
Either the issue has not been posted yet, it affects only some tenants, or the cause is on your side: a recent DNS, MX, connector, certificate, network or Conditional Access change. Microsoft says you can use "Report an issue" on the Service health page if your problem is not listed, so it can check whether it is wider.
What is the difference between an incident and an advisory?
Per Microsoft, an advisory means a problem is affecting some users but the service is still available, often with a workaround. An incident is a critical issue where the service or a major function is unavailable, such as users unable to send and receive email or sign in.
Who can see Microsoft 365 Service health?
Microsoft says people with the Service Support admin and Helpdesk admin roles can view service health, as well as other admin roles listed in its admin roles documentation. Entra sign-in logs need at least the Reports Reader role.
What should security teams watch during a Microsoft 365 outage?
Phishing that uses the outage as a lure ("restore your mailbox", "reset your password"), callers asking the help desk to reset MFA, and gaps in detection if Microsoft Defender XDR or other security services are listed in Service health. Do not turn off MFA or Conditional Access as a workaround.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.