Thursday’s Microsoft 365 disruption shows that even the best-run clouds have bad days. What matters is how fast you see it and how fast you recover.
On Thursday, November 12, millions of people opened Outlook and found nothing. In a major Microsoft outage, Exchange Online, Microsoft Teams, SharePoint, OneDrive and Copilot slowed or stopped for users across the Americas and beyond, and the disruption ran through Thursday night and into Friday. With Outlook down and Teams unavailable, Downdetector logged more than 130,000 Outlook problem reports at the peak, according to the Associated Press.
It is worth saying plainly: Microsoft runs one of the most sophisticated infrastructures on the planet, and it is a valued Maintech partner. Its engineers paused deployments, rerouted traffic, restarted servers and rolled out an alternative health check method within hours. That is a world-class response to a hard problem.
But the shape of the problem should get the attention of every CIO and data center leader. It can happen anywhere.
Microsoft outage timeline: how Dark Thursday unfolded
Microsoft posted regular updates through its Microsoft 365 service health dashboard and the @MSFT365Status account throughout the incident. Pieced together from those updates and news coverage, this is how the Microsoft 365 outage played out. All times are US Eastern.
- Around 11 a.m. Thursday: Users began reporting they couldn’t access Outlook, with problems first appearing at about 16:00 GMT, Al Jazeera reported. Microsoft opened Exchange Online incident EX1550543 at 11:17 a.m. as users found they could not open their mailboxes.
- Early afternoon: Outlook down reports on Downdetector climbed past 130,000. Within about an hour of the start, reports were coming in from 74 countries and territories.
- Early to mid-afternoon: Microsoft reported elevated load across multiple regions, began restarting servers and redistributing traffic, opened a second incident, MO1550821, for Microsoft 365 services that depend on Exchange Online, and paused deployments and configuration changes (AzureBlog incident tracker).
- 2:43 p.m.: Affected servers were failing automated health checks and being taken out of service. Microsoft said the load was not caused by an increase in traffic.
- Late afternoon: Microsoft validated an alternative health check method and returned some servers to service, but said its actions “have not provided the anticipated relief” (TechRadar).
- Thursday evening: Servers that had been restored became unresponsive again once traffic returned. Microsoft applied traffic limits in some locations and rebuilt some servers on a previous software configuration.
- Thursday night: Microsoft said a process that establishes secure connections was becoming overwhelmed on affected servers, and began reverting a recent network configuration change that coincided with the start of the outage (Insurance Business).
- Friday, November 13: Microsoft reported traffic was “being gradually restored,” mainly in Asia-Pacific first, and extended the email timeout window to 48 hours to protect delayed messages (ABC News). It cautioned that some intermittent issues may continue.
What caused the Microsoft 365 outage?
Based on Microsoft’s own updates, the trouble was not a cyberattack and not a traffic surge. A large number of servers began failing their automated health checks and were pulled out of service. The servers that remained had to absorb all of the load, and they buckled.
Microsoft said a component that processes server health may have been at fault. In other words, the system designed to protect the environment ended up taking healthy capacity offline.
That is the uncomfortable lesson. Automation is essential, but automation that watches itself has a blind spot. When the monitor misfires, you need something independent to notice, and someone on the floor to act.
As the night went on, Microsoft’s explanation evolved. It reported that a process responsible for establishing secure connections was becoming overwhelmed on each affected server, causing those servers to stop processing requests. Having earlier said it had not found a recent change linked to the outage, Microsoft then began rolling back a recent network configuration change that correlated with the start of impact. At the time of writing, Microsoft has not published a confirmed root cause.
What Microsoft has been clear about is what this was not. Charles Lamanna, Microsoft’s executive vice president of Copilot, Agents and Platform, posted that “there is no indication this is the result of malicious or cyber activity” (Al Jazeera). Australia’s Home Affairs Minister, Tony Burke, said Microsoft had likened the incident to the 2024 CrowdStrike outage, describing it as “an update that has gone awry” (AP).
Microsoft 365 administrators should watch the Service health area of the Microsoft 365 admin center for Microsoft’s post-incident review once it is published. It will be essential reading for anyone building resilience plans around Microsoft 365.
Which Microsoft 365 services were affected?
Outlook and Exchange Online took the hardest hit, but because so much of Microsoft 365 depends on Exchange, the impact spread well beyond email. According to Microsoft’s incident notes, affected services included:
- Exchange Online and Outlook: no mailbox access through Outlook on the web, desktop Outlook or mobile mail, plus delayed email delivery
- Microsoft Teams: calendar, meeting scheduling and chat creation problems for some organizations, although core messaging and meetings largely kept working
- SharePoint Online and OneDrive: features that depend on Exchange Online
- Microsoft 365 Copilot: Copilot Chat failing to load or respond
- Microsoft Defender for Office 365: Safe Links potentially unable to verify URLs
- Microsoft Defender XDR and Microsoft Purview: portal pages not loading, with data loss prevention and compliance features affected
- Windows 365, Microsoft Graph, Power BI and Fabric, Intune, Planner and To Do, plus parts of the Microsoft 365 admin center
That last group matters for security teams. When Safe Links and the Defender portals are degraded, the tools organizations rely on to catch malicious links and monitor threats are working at less than full strength, at exactly the moment attackers are most active.
A global Microsoft outage: who was affected
This was not just an Outlook outage for office workers. The Microsoft outage reached governments, courts, police and global brands:
- Governments: Singapore’s Government Technology Agency reported government emails were down, Japan’s government said its IT infrastructure was affected, and the Supreme Court of the Philippines saw some operations disrupted (AP).
- Australia: the Australian Federal Police and ASIO were affected, courts in South Australia and Victoria reported issues, and Service NSW regional centers closed, according to local councils. Burke said a digital resilience agreement with Microsoft had been activated to prioritize Australian interests (ABC News).
- United Kingdom: the UK government said it was working closely with Microsoft, while councils and police forces, including Hertfordshire Police and Dorset Police, warned of disrupted online forms (TechRadar).
- Business: Workhorse Group delayed its quarterly earnings conference call, IndiGo’s email support was disrupted, and OpenAI and Anthropic both reported problems connecting with Microsoft 365 tools (AP).
Experts were quick to draw the same conclusion. “Everyone needs a Plan B,” said Richard Buckland, a cybercrime professor at UNSW. Walayat Hussain of the Australian Catholic University noted that an internal fault, rather than an attack, “should worry us more, not less” (ABC News).
Three questions to ask about your own environment
- Who watches the watchers? If your health checks or alerting failed tonight, what independent system would tell you?
- How much can you lose? Do you know how many servers can drop before the rest overload, and are you alerted well before that line?
- Who shows up? When a rack needs hands at 2 a.m. in Frankfurt, Singapore or São Paulo, is that person your employee, a subcontractor’s subcontractor, or nobody?
Your data center performance insurance policy
You insure your buildings, your fleet and your executives. Nobody buys that coverage expecting the fire. They buy it because the cost of being unprotected is too high. Your data center is the heart of your enterprise, and it deserves the same thinking.
That is the role Maintech plays for the world’s leading financial and commercial institutions:
- Redundant data center monitoring and alerting. Our 24/7 NOC monitoring adds an independent layer over your own tools, so a failing check, a silent alert or a shrinking pool of healthy servers gets caught early, not after users start calling.
- Data Center Infrastructure Management (DCIM). Real-time visibility into capacity, health and headroom, so you know your margin before you need it.
- Real people, everywhere you run. W-2 Maintech technicians in more than 60 countries, not a patchwork of subcontractors. Smart hands, break-fix and server deployments with 24/7 coverage and backup for every shift.
- Fast, accountable response. 2-hour response SLAs for critical systems, backed by more than 50 years of data center experience across 110+ facilities worldwide.
No partner can promise that nothing will ever fail. What the right partner can do is help you avoid the failures that are avoidable, limit the blast radius of the ones that aren’t, mitigate the impact fast, and protect the business while it happens. That is the difference between a bad afternoon and a bad quarter.
“Every operator, no matter how good, will have a day like Thursday,” said a Maintech spokesperson. “Our job is to make sure our clients see it first, contain it fast, and have a trained Maintech engineer on site when it counts.”
Microsoft outage FAQs
Was the Microsoft outage a cyberattack?
There is no evidence it was. Microsoft said there is no indication of malicious or cyber activity, and Australia’s Home Affairs Minister said Microsoft did not believe it was dealing with a cyber event. Criminals have still been quick to exploit the disruption, so read our guide to spotting Microsoft outage scams.
What caused the Microsoft 365 outage?
Microsoft has not confirmed a root cause. Its updates pointed to servers failing automated health checks, a secure-connection process becoming overwhelmed, and a recent network configuration change that correlated with the start of the impact, which Microsoft began reverting.
How long did the Microsoft outage last?
Problems began at around 11 a.m. ET on Thursday, November 12, and continued overnight. On Friday, November 13, Microsoft reported gradual recovery, starting in Asia-Pacific, while warning that some intermittent issues might continue.
Will emails sent during the Outlook outage be lost?
Microsoft extended its email timeout window to 48 hours to protect delayed messages, so mail sent during the outage should be delivered as service recovers. Expect a backlog, and be extra cautious with unexpected messages as it clears.
How do I check Microsoft 365 status?
Administrators can follow incidents EX1550543 and MO1550821 under Health > Service health in the Microsoft 365 admin center. Everyone else should rely on their IT team or Microsoft’s official status channels, never on a link in an unexpected email.
Don’t wait for your own Dark Thursday
Talk to Maintech today about a no-obligation review of your monitoring, alerting and on-site coverage.
- Call: +1 (800) 426-8324 (Global) · +44 (0) 7799 747974 (Europe) · +65 6909 7351 (APAC)
- Email: contact@maintech.com
- Visit: maintech.com/contact-us
Next in this series: The Day of the Outage: A Surge of Calls, Answered, on how our service desk supported customers while Microsoft 365 was down.
Sources and further reading
- Al Jazeera: Microsoft hit by global outages: What happened and why?
- Associated Press (via WSLS): Microsoft outage hits companies and governments worldwide as it struggles to restore services
- TechRadar: Microsoft outage live blog
- ABC News (Australia): Microsoft outage hits users worldwide
- Insurance Business: Banks warn of outage scams as Microsoft narrows in on fault
- AzureBlog: Microsoft 365 outage, 12 November 2026, incident tracker
Maintech has delivered IT infrastructure services for data centers, cloud and end-user environments for more than 50 years, with operations in 60+ countries and an average client tenure of 12+ years.
