Microsoft 365 suffered a worldwide outage that began on the afternoon of Thursday, November 12, 2026 (US time) and was still being recovered early on Friday, November 13. Outlook, Teams and Copilot were among the services hit. Microsoft says it is not aware of any malicious activity. This is a developing story and this post reflects the reports available around 6 a.m. Eastern (11:00 GMT) on November 13; check Microsoft’s service health page for the current state.
Is Outlook down? What was affected
According to CBS News (AP), users reported problems with Outlook, Teams and Copilot, and Microsoft said a wide range of Microsoft 365 offerings that work with Exchange Online and email were affected. NBC News says Downdetector’s peak reports covered Outlook, Microsoft 365, OneDrive, Copilot and Teams, and that more than a dozen Microsoft cloud services were affected. A security write-up by Astra lists Exchange Online, Teams chat, meetings and calling, Microsoft 365 Copilot, SharePoint Online, OneDrive for Business, Intune, Purview, Defender XDR and the Microsoft 365 admin center, which some admins could not reach. Astra says on-premises Exchange Server and SharePoint Server were not affected.
NBC reports that OpenAI and Anthropic said they had problems with Microsoft connectors (relayed from Reuters).
When did it start?
The sources differ. NBC News says Microsoft put the start at 11:17 a.m. ET on Thursday, while noting that Downdetector’s reports began climbing at a different time. Astra gives about 17:54 UTC (12:54 p.m. ET) and says Microsoft acknowledged the issue a few minutes before 1 p.m. ET on its Microsoft 365 Status account on X. We use “Thursday afternoon US time” until Microsoft’s post-incident report fixes the start.
How big was it?
- CBS News says more than 130,000 users reported Outlook problems at the peak on Thursday. Astra puts the Downdetector Outlook peak at about 130,000 around 1 p.m. ET.
- NBC News, citing Downdetector, says reports spread to 74 countries and territories within about an hour and peaked at 19,650 reports per minute across the five named services, against fewer than 15 on a typical Thursday.
- Downdetector counts are user reports, not a measure of how many people were actually affected.
The disruption reached organisations worldwide. NBC and CBS report that Baltimore County, Jacksonville and Austin had email problems while 911 and essential services were not affected; Japan’s government reported disruption to inter-ministerial communications; Singapore’s GovTech said government emails were down; IndiGo, Akasa Air and Air India said email support was affected, while Air India said flight operations were unaffected; and Workhorse Group postponed an earnings call. Maersk warned customers of email delays.
What does Microsoft say caused it?
Microsoft has not published a final root cause. Its status updates, as relayed by the outlets, have changed over time:
- Early updates, per Astra, said Exchange Online servers became unresponsive and failed automatic health checks, were pulled from rotation, and pushed load onto the remaining servers, which then began failing too.
- A later update, at about 01:06 UTC on November 13 per Astra, pointed to “a core process on affected servers” that handles secure connections.
- NBC News reports that Microsoft cited positive stability results after applying an “upstream authentication/routing configuration component patch” to part of its infrastructure (around 2:30 a.m. ET Friday).
- Anadolu Agency reports Microsoft said “unexpectedly unavailable servers” were the main factor, and that earlier patches and reboots had only “marginal success.”
On whether this was an attack, Microsoft said it is “not aware of any malicious activity” (NBC News) and has “no indication” of malicious activity (CBS News). Australia’s Home Affairs Minister Tony Burke said Microsoft does not believe it is dealing with a cyberattack and likened it to the 2024 CrowdStrike incident, an update that “has gone awry.” That is the minister’s account, not a Microsoft finding.
Current status
- Around 4:15 a.m. ET Friday, Microsoft reported “early stabilization,” said capacity had not returned to normal, and extended its email timeout window to 48 hours to protect delayed messages (NBC News).
- Around 5:22 a.m. ET it reported incremental improvement in several workloads, with service health still variable (NBC News).
- CBS News (published 5:15 a.m. EST) says recovery is ongoing and has progressed in phases, with capacity not yet fully back to baseline.
- Astra says access was largely restored by about 05:33 UTC, while Anadolu Agency and NBC describe recovery as still in progress. Treat any claim that everything is resolved with caution until Microsoft says so.
- Microsoft says it will publish a post-incident report with the root cause once the incident is mitigated. It had not been published at the time of these reports.
What users and admins can do
For individuals, there is little to do except wait and avoid repeatedly resending important messages. Microsoft’s extension of the email timeout to 48 hours is meant to protect messages that were delayed. For admins, Astra lists the incident IDs EX1550543 (Exchange Online) and MO1550821 (Microsoft 365 admin center), which you can follow under Service health in the Microsoft 365 admin center. If the admin center is unreachable, Microsoft posts on its Microsoft 365 Status account on X. Astra also recommends, as its own suggestions rather than Microsoft guidance:
- export sign-in, mail flow and endpoint logs for about 17:00 UTC on November 12 to 06:00 UTC on November 13 and store them outside Microsoft
- set up a backup channel for incident communication, such as a secondary chat tool or mail tenant
- check what else depends on Exchange Online and Entra ID, including MFA, single sign-on and ticketing
We could not open Microsoft’s own status page, so the status lines above come from news reports of it.
Sources
- NBC News: Microsoft outage live blog
- CBS News (AP): Microsoft battling major outage (November 13)
- Astra Security: Microsoft 365 outage, what happened
- Anadolu Agency: Microsoft reports progress in restoring services
Image: Microsoft Redmond campus plaza, photo by Jonathan Schilling, CC BY-SA 4.0, via Wikimedia Commons.
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
