The useful point for IT teams is that this was not a total Microsoft 365 shutdown. Microsoft lost a large share of the Exchange Online servers that store and deliver mail, calendars and contacts. Every feature that reads from those mailboxes then started to fail.
How it unfolded
Microsoft's first public note focused on one region. Its support account said it was investigating "reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas." Reports of the start time vary. LazyAdmin and other trackers say the incident started at 16:17 UTC (17:17 CET). The University of Pennsylvania keeps a copy of Microsoft's incident reports, and it shows the first Exchange Online advisory at 16:55 UTC. That advisory said users might be unable to connect through Outlook on the web, Outlook desktop (MAPI), Exchange ActiveSync, or REST-based connections.
By Thursday evening UTC, Microsoft had ruled out a simple traffic spike. In an update quoted by ABC News in Australia, the company said failed server health checks were at the root of it. It also said that "the elevated load isn't driven by an overall increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure." In plain terms, enough servers dropped out that the rest were overwhelmed.
Microsoft then took the standard precaution for a big cloud incident. According to LazyAdmin's timeline, Microsoft paused all deployments and configuration changes. The Penn copy of Microsoft's log says the pause was so the company could check whether any recent change was linked to the outage.
Why recovery stalled
Recovery did not go in a straight line. ABC News reported that Microsoft announced a "gradual recovery" just after 9am AEST, then said an hour later that restored servers were becoming unresponsive again. Microsoft blamed a process on those servers that handles secure connections. That process became overwhelmed, and the servers stopped processing requests. Microsoft's log also says a change meant to improve serviceability was not working as expected, so the company was looking for other ways to add capacity. LazyAdmin's timeline shows that at Fri 04:57, Microsoft scales up VMs to handle the traffic surge.
Microsoft's later updates, as copied on the Penn page, were more hopeful:
- Microsoft said it had tested an alternative health-check method on a subset of affected servers. Those servers came back into service, and the change was being rolled out more widely.
- It was preparing an automated process to find unresponsive servers and restart them, to keep them in service while that rollout continued.
- It said its review of recent changes had found a small number of configuration updates that it was investigating as possible contributors.
- In the most recent update captured, recovery work was finished across parts of the Asia Pacific region. Mailbox access and delayed email processing were improving there, but some users could still see intermittent problems, and Microsoft was extending the work to other regions.
Note what Microsoft has not said. It has not named a final root cause. The configuration updates are described as possible contributors, not confirmed causes. Treat any post-mortem you read before Microsoft's own as speculation. Even independent admins are cautious. LazyAdmin's Rudy Mens wrote that in his tenant Outlook Online takes forever to load, but it loads, and the Outlook client is starting to receive mail again. But Microsoft hasn't called it fixed yet.
Section summary: The problem started with servers failing health checks. The remaining servers took on too much load, and fixes that worked briefly kept falling back. Recovery was partial and moving region by region at last report, and Microsoft had not confirmed a root cause.
What broke, and what kept working
This is where the incident matters most for admins. Microsoft said features of many Microsoft 365 services that interact with Exchange Online and email services are impacted. Elements of those services that do not depend on interaction with Exchange Online remain functional.
Based on Microsoft's service notices as copied on the Penn page, the picture looks like this:
| Service | Reported impact | What generally still worked |
|---|---|---|
| Exchange Online | Mailbox access could fail across OWA, MAPI, EAS and REST; mail delivery could be delayed | — |
| Microsoft Teams | Problems with calendars, scheduling, invites, meeting edits, and creating Live or Virtual events; private and shared channels could not be created or deleted; contact sync problems | Joining calls, meetings, group chats, standard channel messages |
| SharePoint Online | Features that depend on Exchange | Opening files stored directly in SharePoint |
| Microsoft 365 Copilot | Copilot Chat might not load or respond; no access to work email, calendar or files | — |
| Purview | DLP, auto-labeling, Information Protection, Communication Compliance, eDiscovery search/export, and audit searches could be affected; portal and protected content might not load | — |
| Defender XDR / Defender for Office 365 | Defender portal pages might not load; Safe Links verification and label-based policy enforcement could be delayed or fail | — |
| Fabric / Power BI | Exports to PDF or PowerPoint of reports with sensitivity labels could fail, as could updates to labeled items and opening labeled .pbix files | — |
| Microsoft 365 Apps Admin Center | Cloud Update, Cloud Policy and Inventory pages might fail to load | — |
| Windows 365 | Tenants using Purview Customer Key for Cloud PCs might have users unable to connect | — |
| Planner, To Do, Intune, Universal Print, Education tools | Reliability problems, failed loads, and possible problems with Intune enrollment and check-ins | — |
The Safe Links item affects users directly. LazyAdmin warned that Safe Links may not be able to verify URLs, so link clicks in Outlook and Teams can fail. If help-desk tickets say "links are broken," this is the likely reason, not a bad Outlook build.
Consumer accounts were affected too. One explainer reported that by Friday morning Microsoft's status page for consumers said Outlook.com, OneDrive, OneNote, To Do, Teams and Microsoft 365 for the web were affected for personal accounts too.
The effects reached beyond Microsoft. ABC News reported that OpenAI and Anthropic both saw problems with their Microsoft 365 connectors. Australia's Home Affairs Minister Tony Burke said the government had activated a cyber agreement with Microsoft to get Australian services prioritized for restoration. Japan's government and the US House of Representatives also reported impact.
How big was it?
Downdetector numbers vary by source, and they count reports to an outage tracker, not confirmed affected customers. ABC7's live coverage cited nearly 130,000 users on outage tracker Downdetector reporting Outlook problems just after 1 p.m. Eastern Thursday. ABC News in Australia reported a peak of more than 120,000 Outlook reports and more than 45,000 for Microsoft 365. Either way, it was large.
Was it an attack?
Microsoft has said it saw no sign of malicious activity, and ABC News reported the same. The timing still raised questions. SecurityWeek noted that the disruption came two days after Microsoft released its November Patch Tuesday updates, which included an actively exploited Outlook spoofing flaw. However, Microsoft's service advisories have not linked the vulnerability to the Exchange Online outage. Unless Microsoft says otherwise, the patch timing is a coincidence, not evidence of a link.
What admins and users should do
None of this is something you can fix locally. This is a server-side failure, so reinstalling Office, rebuilding profiles or swapping laptops will waste the help desk's time. Here is what is worth doing:
- Follow the right incident IDs. In the Microsoft 365 admin center, open Service health and watch EX1550543 and MO1550821.
- Use the fallback status channels if the admin center won't load. Microsoft's notices warned that some admin pages might fail. LazyAdmin notes that Microsoft posts the same updates on status.cloud.microsoft and on the @MSFT365Status account on X.
- Tell users what still works. Teams chat, calls and standard channels were largely working, and so were files stored directly in SharePoint. Use those for urgent communication instead of waiting on Outlook.
- Be careful with sensitivity labels. Microsoft's Fabric workaround was to remove the label from the affected item, but only if your organization's data-protection policies allow it. Don't let a deadline become a quiet DLP violation.
- Expect a backlog. As mail flow returns, delayed messages may arrive in bursts. Warn users that "missing" mail may show up late, not disappear.
- Record the business impact now. Note timestamps, affected workloads and user counts while they are fresh. Admins tracking this outage are already asking about SLA service credits. Your own records will make any claim, or any conversation with leadership, much easier.
The bigger picture
Microsoft 365 isn't a set of separate apps. It's a group of services built around Exchange Online. When Exchange has serious trouble, the damage spreads to Copilot (which can't read your mail), Purview (which can't evaluate labels), Defender (which can't check links) and even Windows 365 Cloud PCs in certain Customer Key setups.
That tight integration is one of the platform's selling points. Copilot is useful largely because it can read your mail and calendar. But the same dependency means one failure spreads widely. Organizations that rely on Microsoft 365 for both business work and their security and compliance tools should treat this as a fire drill. Who is your out-of-band communication channel? Can your security team still work if the Defender portal won't load? Does your incident plan assume "Microsoft is down" always means "everything is down," when the real situation is more selective?
Microsoft will almost certainly publish a post-incident review once the dust settles. The most important question it needs to answer is why the health-check failures took so many servers out at once. The configuration changes it is now investigating may be the start of that answer.