Microsoft Outage: What We Know About the Outlook and Teams Failure

The Microsoft outage that began on the afternoon of Thursday 12 November 2026, has rolled into a second day with no confirmed root cause: Outlook, Exchange Online, Teams and Copilot went down or became unstable for users in at least 74 countries. In this post I pull together what we know, what we still don't know, and what your company should do right now while email slowly comes back.

TL;DR (updated 14:00 GMT, 13 November 2026)

• The problem started early on Thursday afternoon (12 November) and mainly hit Exchange Online, the email server behind Microsoft 365. Outlook took the hardest hit.
• Microsoft says it was not a cyberattack. According to the company, a process that sets up secure connections on its mail servers became overwhelmed, and the servers stopped handling requests.
• It is rolling back a network configuration change that coincided with the start of the outage, but it has not said whether that change was the cause.
• Recovery is partial and uneven: the backlog of delayed email is still being processed and there is no ETA for full service.
• The official incidents are EX1550543 (Exchange Online) and MO1550821 (Microsoft 365). Track those, not social media.

Microsoft outage timeline (UK time, GMT)

I built this Microsoft outage timeline from Microsoft's own updates and from international press coverage. Times are converted to UK time (GMT), and some are approximate because not every outlet reports the exact minute.

Thursday 12 November

• Around 16:00 to 17:00: users start reporting on Downdetector that they can't open their Outlook inbox on the web, in the desktop app or on mobile.
• Shortly before 18:00: Microsoft posts that it is "investigating reports of users experiencing issues" accessing online mailboxes. It first mentions users in the Americas, then says users in any region could be affected.
• Within about an hour: Downdetector logs complaints from 74 countries and territories.
• Through the evening: the company says it has paused all deployments, is moving traffic off the affected infrastructure and restarting servers. Teams is reported restored for most users.
• Later that evening: reports pass 140,000, according to figures cited by the press. Microsoft talks about limited recovery and later admits some changes are "not taking effect as expected."
• After midnight: Charles Lamanna, an executive vice president at Microsoft, posts that "there is no indication this is the result of malicious or cyber activity."

Friday 13 November

• Around 07:00: there are still more than 43,000 Outlook reports from 72 countries. Microsoft reports "marginal success" restoring service, and some servers that had come back fail again.
• About 16 hours after it began: the problem is narrowed down mostly to Exchange Online.
• Late morning and early afternoon: the company reports "early stabilisation and capacity improvements," then "encouraging recovery progress." The priority shifts to clearing the email queue and backlog. At the same time, it starts rolling back a recent network configuration change.

As of publication, both incidents were still open on Microsoft's service health dashboard.

What we know about the cause of the Microsoft outage

I'm going to separate what Microsoft has actually said from third-party interpretation, because on social media the two are blended together.

What Microsoft has said officially

• It was not an attack. The company ruled out malicious activity. There is no sign of any data breach tied to the Microsoft outage so far.
• Servers became "unexpectedly unavailable." The elevated load on the remaining ones did not come from a traffic increase. In other words, it wasn't a usage spike or a denial-of-service (DDoS) attack.
• A secure-connection process was overwhelmed. On the affected Exchange servers, the process that establishes secure connections (the encryption handshake that happens before Outlook can talk to the server) couldn't keep up, and the machines stopped responding.
• A configuration change is being rolled back. Microsoft is reverting a network configuration change that coincided with the start of the outage. Note that it has not said the change caused the problem, or that the rollback is what's bringing service back.
• A post-incident report is coming. The company promised to publish the full analysis (the PIR) once everything is stable.

What is interpretation, not confirmed fact

• Australia's Home Affairs Minister, Tony Burke, said Microsoft compared the situation to the 2024 CrowdStrike outage, when a faulty update crashed millions of computers. That's an analogy he relayed, not a diagnosis Microsoft has published.
• Some outlets linked the failure to settings applied to servers after an update. Microsoft's monthly security update (Patch Tuesday) shipped two days earlier, but nobody has confirmed any connection between the two.
• Analysts have floated a faulty internal update or a physical infrastructure failure as possibilities. One said there was no evidence AI computing load played any part.

What we still don't know about the Microsoft outage

This is the part that matters most if you have to make decisions today:

Question	Status at 14:00 GMT, 13 November
What was the root cause?	Not confirmed. We only know the symptom: the secure-connection process was overwhelmed.
Was the rolled-back network change to blame?	Not confirmed. It coincided with the start, and Microsoft hasn't said more.
How many users were affected?	Unknown. Microsoft hasn't released numbers. The 140,000 figure is Downdetector reports, not users.
When will everything be back to normal?	No ETA. Recovery is gradual, region by region.
Will delayed emails arrive?	Mostly, yes, but Microsoft hasn't disclosed the size of the backlog or how long it will take to clear.
Was any data lost?	No reports of loss, only delays. Confirmation should come in the post-incident report.
Was the UK hit harder than elsewhere?	No per-country breakdown. Microsoft treated the incident as global. Known UK cases include the NHS, schools and the Department for Education.

I'll update this table when Microsoft publishes its report.

Who the Microsoft outage affected and how bad it got

The scale of the Microsoft outage shows how much of the world has concentrated its communication in a single vendor. Reported cases so far:

• Healthcare: the NHS cancelled some operations and had problems with electronic prescriptions. A Canadian healthcare network declared a "code grey," the alert used for system failures.
• Government and courts: government systems in Japan and Singapore, courts in Singapore and the Supreme Court of the Philippines, which warned of delayed responses. In Australia, federal agencies saw minor disruption. In the US, House of Representatives staff said a full day of legislative work was lost.
• Cities: NYC Emergency Management warned that email and online city services could be delayed, and told residents to use the phone instead.
• Education: schools across the UK, Ofqual and the Department for Education saw major disruption.
• Business: on top of lost productivity, some companies delayed quarterly results announcements. Third-party tools that connect to Microsoft 365, including AI assistants, also failed.

One technical detail explains why the Microsoft outage hit companies unevenly. People using desktop Outlook in cached mode could still see email they had already downloaded and even draft messages, which sat in the outbox. People relying only on Outlook on the web or on mobile had nothing. And Teams calls and chats worked reasonably well most of the time, which shows the core of the problem was in Exchange.

What to do now if your company runs on Microsoft 365

I've followed several incidents like this closely with clients. In the post about the Slack outage I described how that one played out, and the playbook is similar. The main thing is not to make it worse.

While the Microsoft outage continues

1. Check the official source. Your Microsoft 365 admin can follow progress in the admin centre under Service health, using incident IDs EX1550543 and MO1550821. If you're not an admin, use Microsoft's public status page (status.cloud.microsoft).
2. Don't recreate profiles or reset passwords. Deleting your Outlook profile or changing your password won't fix a server-side failure, and it can force your computer to re-download the whole mailbox when service returns, while the servers are still under strain.
3. Keep desktop Outlook open. Cached mode keeps your history, and anything in the outbox will send on its own once the connection is back.
4. Tell customers through another channel. A note on WhatsApp Business, your website or social media ("our email is unstable because of the global Microsoft outage; reach us here") keeps orders and invoices from slipping through the cracks.
5. Be suspicious of emails about the outage. Scammers use high-profile incidents to send fake "reactivate your account" notices. We saw exactly that in the FBI alert about the Microsoft 365 phishing scam. Microsoft does not ask for your password by email to "restore" a mailbox.

What happens to email sent to you

Email sent to you during the Microsoft outage is mostly not gone. When a destination server doesn't respond, the sender's server normally holds the message and retries for a period that usually ranges from a few hours to two days, depending on the sender's configuration. That's why most messages arrive late instead of disappearing. The risk is with messages whose sender gives up before service returns: those bounce back to the sender as delivery failures. If you were expecting something important (an invoice, a contract, a payment), ask the sender to check whether they got a bounce notice.

Once things are back to normal

• Claim your SLA credit. Microsoft's service level agreement for online services provides credits when monthly availability falls below the guaranteed percentage. Your admin has to file the claim within a deadline; it isn't automatic. See the terms on Microsoft's official SLA page.
• Document the impact. Write down how many hours your team lost to the Microsoft outage and which processes stalled. That number is your business case for investing in contingency.

The lesson: email is critical infrastructure, and critical infrastructure needs a Plan B

This Microsoft outage is not a one-off. In January 2026, Microsoft 365 was down for almost 10 hours across North America. In August, thousands of Outlook users were locked out of their mailboxes. The pattern repeats with other tech giants, as we discussed in the Twitter (X) outage and its resilience lessons.

I'm not saying you should drop Microsoft 365. It's still a great platform, and no provider offers 100% uptime, Agathas included. The real question is different: does your business stop when a single vendor stops?

For most of the small and medium-sized businesses I work with, the honest answer is "yes". And a few simple measures can change that:

• Domain and DNS under your control. If the company domain is registered in your name and DNS lives in a panel you can access, you can redirect email in minutes during an emergency. If everything sits "inside" a single vendor, you depend on that vendor even to leave it.
• A backup mailbox outside the same provider. A secondary mailbox on your domain, hosted on different infrastructure, catches critical contacts (billing, sales, support) when the primary goes down.
• Copies of important email. A forwarding or archiving rule that sends critical addresses outside the primary provider keeps your history accessible even when the platform is down.
• An alternate channel agreed in advance. Customers and suppliers need to know, before the crisis, how to reach you if email disappears.
• A contact list outside the cloud. It sounds obvious until the day your entire address book is inside an Outlook that won't open.

How Agathas Web helps you avoid depending on a single vendor

This is exactly the kind of contingency we set up with Agathas Web Managed Hosting. In practice:

• Business email on your own domain, with spam filtering, working with Outlook, mobile and webmail. It can be your company's primary email or the backup mailbox for teams that can't stop when Microsoft 365 or Google Workspace go down.
• Domain and DNS tidied up and registered to your company, so switching where email goes in an emergency takes minutes, not days.
• Daily backups with 30-day retention, for websites and systems too, because a Plan B isn't only about email.
• Monitoring and support over WhatsApp, from people who know your environment, instead of a ticket in a global queue.

How it works: we talk through which mailboxes and processes are critical, design the contingency (replace, complement, or simply back up what you already have), and handle the migration or setup without taking your email offline. If the Microsoft outage left your company stuck over the last 24 hours, request a managed hosting quote and I'll personally walk you through what makes sense for your case.

Conclusion

The Microsoft outage of 12–13 November already ranks among the biggest Microsoft 365 disruptions in years, and the most important piece is still missing: the root cause. What we know so far is that it wasn't an attack, that the bottleneck was the secure-connection step on Exchange servers, and that Microsoft rolled back a network change that coincided with the start of the problem.

Until the official report is out, the best moves are to follow incidents EX1550543 and MO1550821, tell customers through another channel and document the impact. Once the dust settles, ask the question many companies asked themselves this week: what happens to your business next time? If you want to build that Plan B, talk to us about managed hosting and business email.

Sources: statements from Microsoft and Charles Lamanna; coverage by Al Jazeera, ABC News, Euronews and CNN. Post updated at 14:00 GMT on 13 November 2026; it will be revised when Microsoft publishes its post-incident report.