Outlook, Teams and other Microsoft 365 services have been disrupted for about 12 hours. Microsoft has ruled out a cyberattack and says engineers are reversing a network change while they investigate.
Microsoft is struggling to resolve a global outage that has disrupted Outlook, Teams and other Microsoft 365 services for millions of users. The company said it was still “working to address the issue” and that the fix was not progressing as expected. Executive vice president Charles Lamanna ruled out malicious hacking. “We regret that today’s outages caused disruptions for our customers, and we are working to address the issue,” he wrote on X. More than 430 million people use Microsoft 365 apps, according to the company’s website, but that is its overall user base and not a count of those affected.
The scale of the disruption
Reuters reported that Downdetector recorded more than 130,000 Outlook problem reports in the United States at around 1pm Eastern Time on Thursday. By about 4.30am GMT on Friday, more than 18,000 reports were still being logged. Downdetector figures are not counts of unique affected users. Deutsche Welle, drawing on Associated Press and Reuters reporting, said complaints came from 74 countries and territories within about an hour, spreading into Asian business hours. Reuters said the outage had lasted about 12 hours by the time of its latest update, and that no precise number of affected users has been established.
At around 5am GMT on Friday, a Microsoft 365 status feed still listed the Exchange Online incident EX1550543 and the wider incident MO1550821 as active, classed as service degradation. That does not mean every service was down, as some components continued to work.
What Microsoft says went wrong
According to Microsoft incident notices reproduced by the University of Pennsylvania, engineers found that a core process responsible for establishing secure connections was becoming overloaded. Affected servers stopped processing requests, which cut the available capacity of Microsoft’s cloud infrastructure.
Microsoft concluded that the initial surge in load was not caused by a rise in ordinary customer traffic. Many servers had instead become unexpectedly unavailable, forcing the remaining machines to handle extra connections. Engineers began reversing a recent network change that coincided with the start of the disruption, but Microsoft has not confirmed it as the root cause.
Recovery has proved difficult. Some restarted servers initially looked healthy but stopped responding once customer traffic was directed to them. Microsoft is rebuilding some affected machines using an older software configuration and testing whether restricting certain connection types lets servers recover gradually. It paused deployments and configuration changes as a precaution, according to its notices. It also added virtual machines to restore capacity, though some machines stayed stuck in a faulty state and could not apply the changes. The Guardian reported on the virtual-machine step. Recovery is being tested on isolated parts of the infrastructure, with connections increased only once systems appear stable.
The published timeline, in GMT:
- 12 November, 18:26: Microsoft records incident MO1550821.
- 12 November, 19:30: Engineers find the high load is caused by unavailable servers, not extra traffic.
- 12 November, 22:03: An overwhelmed core process is identified and infrastructure is isolated.
- 13 November, 00:00: Restarted servers are found becoming unresponsive again once traffic returns.
- 13 November, 01:06: Microsoft investigates the secure-connection process and begins reversing the correlated network change.
Which services were affected
Microsoft’s notices list a far wider range of services than Outlook and Teams. They include Defender products, where Safe Links could fail to verify URLs and some security-management pages might not open, and Purview, where data-loss prevention, sensitivity labelling and compliance tools were affected. Planner and To Do were unreliable, and applications using Microsoft Graph to retrieve Exchange Online email, calendar entries and contacts could time out. Some Fabric and Power BI customers could not export reports with sensitivity labels to PDF or PowerPoint, and Microsoft 365 Education features such as assignments and Reading Progress were also listed. Microsoft said Teams calendar functions, meeting scheduling and some chat-creation workflows could fail because they rely on Exchange. Teams features that do not use Exchange could keep working.
Governments and businesses hit
According to Reuters and ABC News Australia, the Australian Security Intelligence Organisation and the Australian Federal Police were among the agencies affected. The country’s National Cyber Security Coordinator, Lieutenant General Michelle McGuinness, was monitoring the situation. The Department of Foreign Affairs and Trade told people to use the Australian Sanctions Office’s phone service for urgent enquiries, and The Guardian reported that the agriculture department warned clients they might be unable to send or receive messages. Western Australia’s government confirmed problems with school email and staff collaboration systems but said classroom teaching continued, and four paper-based exams were not expected to be affected.
Japan’s Deputy Chief Cabinet Secretary Masanao Ozaki said government information systems were affected, according to Sky News. Reuters reported that the US House of Representatives was also affected.
Reuters reported that the Indian airlines IndiGo and Akasa Air had disruption to customer email support, though there was no indication that aircraft operations were affected. Taiwanese securities firms, life insurers and investment trust companies also reported disruption, and one unnamed firm cancelled a planned bond repurchase transaction, a source told Reuters. OpenAI reported problems with new Microsoft connector connections, and Anthropic said an upstream provider problem affected its Microsoft 365 connector, according to ABC News Australia and Deutsche Welle. That does not indicate a general outage of either company’s AI services. Reuters reported that the US electric vehicle maker Workhorse Group postponed its third-quarter results from 12 November to 16 November, citing the outage.
Not the first failure
Reuters said Microsoft 365 also suffered an outage in January 2026 and another in October 2025, and that an Azure cloud outage disrupted services in October 2026. The incidents should not be assumed to have the same cause. eToro analyst Josh Gilbert told Reuters that repeated outages could lead corporate IT departments to rethink concentrating more operations in Microsoft’s ecosystem, though he said the immediate market effect might be limited because large organisations cannot easily switch providers.
