Microsoft 365 Global Outage Enters Second Day: Outlook and Teams Recover as Email Backlog Persists

What's broken, and for whom​

Users have not all seen the same thing. The BBC reported that customers had "varying levels of access". Many could not send or receive email or see some files or calendar details. Others were still using Teams chat and meetings without trouble.

Microsoft's own list of affected services is longer than "Outlook is down." According to XDA Developers, Microsoft listed impacted services as Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Copilot 365, Microsoft Defender XDR, Microsoft Planner, Microsoft To Do, and Microsoft Purview. ABC7's live blog gave a similar list but included Microsoft Intune. Microsoft updated the list more than once, so admins should check their own tenant's view rather than rely on any one published list.

SecurityWeek, carrying Associated Press reporting, said the outage was affecting a wide range of Microsoft 365 offerings that interact with its Exchange Online and email services. That explains why the damage went well beyond email.

Digital Trends dated the broader Microsoft 365 outage to 1:26 p.m. Eastern on November 12. It also said Copilot users in some cases are unable to access chats or retrieve information.

Section summary: Exchange Online is at the center of this. Teams, SharePoint, Copilot, Planner and Microsoft's security and compliance tools were also on Microsoft's affected list at various points, and how bad it was depended on the user and the region.

How big is it? Nobody knows exactly​

There is no confirmed count of affected users, and three different numbers are going around:

The BBC pointed out that the real total is probably much higher, because Downdetector depends mostly on people choosing to report. Treat the 450 million figure as the size of the customer base, not a damage estimate.

The effects also reached outside Microsoft. OpenAI said it was investigating problems with its connections to Microsoft services that stopped some tools from working as expected. Anthropic reported problems too.

What Microsoft says went wrong​

Microsoft has ruled out a cyberattack. Digital Trends reported that Microsoft says there is no indication of malicious activity behind the outage.

The company's explanation, as the BBC reported it, is "elevated load." A large number of servers became "unexpectedly unavailable," and their traffic was pushed onto the remaining servers, which then struggled too.

Prof James Ferryman of the University of Reading's computer science department explained the problem to the BBC. He said the part of Microsoft's servers that sets up secure connections was getting overwhelmed and then stopped responding. As each server failed, its work moved to the next one, while huge numbers of phones and laptops kept trying to reconnect. That is why services have to come back gradually instead of all at once.

There is also a comparison going around that needs care. Australia's Home Affairs Minister Tony Burke said Microsoft had likened the outage to the CrowdStrike incident of July 2024. He quoted the company as describing, in some ways, "an update that has gone awry." That is Burke's second-hand account. Microsoft's public statements have not named a faulty update or a final root cause. Until Microsoft publishes a post-incident review, there is no confirmed link between the two events.

The recovery: progress, setbacks, more progress​

Microsoft's updates over Thursday night and Friday went up and down:

1. Partial recovery that didn't hold. ABC7 reported that late Thursday Pacific time, Microsoft 365 said it was observing partial recovery access across regions where it has rolled out changes, however, the recovery has not been sustained.
2. Fixes not working. According to AP, Microsoft then wrote that it had checked the changes it applied to improve serviceability and found they were "not taking as expected."
3. Early stabilization. A later update cited "early stabilization and capacity improvements as recovery actions continue." Microsoft also said "Recovery actions are ongoing across affected Microsoft 365 infrastructure and progressing in phases."
4. Recovery spreading. In its latest messaging, Microsoft said "We're seeing encouraging recovery progress, with service availability and email delivery performance improving across a growing portion of affected Microsoft 365 infrastructure." It added that "Some users may still experience intermittent issues as recovery actions continue. We're focused on recovery for the remaining affected environments while prioritizing email queue and backlog reduction."

The BBC reported that Microsoft saw encouraging progress in Europe and improvement in North America on Friday afternoon. As of Digital Trends' report, the company had yet to provide an estimated time for full restoration.

That mention of "email queue and backlog reduction" matters. Getting back into your mailbox does not mean every delayed message has arrived. Mail that piled up during the outage may keep trickling in after Outlook looks normal again.

Section summary: Recovery is real but patchy, comes in phases and varies by region. Nothing published so far says the outage is over.

Real-world impact: when email goes quiet​

The reported consequences show how much day-to-day work still runs through email, even when the core service an organization provides keeps going:

• UK public services: Some police forces said they could not take crime reports online and asked people to call. The National Pharmacy Association warned of possible prescription delays because NHS email systems were affected. Hospitals asked patients to attend appointments as normal.
• Courts: Courts in Los Angeles and Texas warned that communications might be delayed. The Philippines' Supreme Court said some operations, including email responses, were affected.
• Governments: Singapore's Government Technology Agency said government email was down. Japan said its government IT infrastructure was hit and that it had arranged alternatives such as telephones.
• Airlines: Air India said flights were unaffected and that it temporarily rerouted email so customer queries kept arriving. IndiGo said its email support was disrupted, but its other support channels and flight operations were unaffected.
• Business: Workhorse Group postponed its quarterly earnings call.
• Healthcare in Canada: CBC reported that a Toronto hospital network had email problems but said patient care was not affected.

Security researcher Troy Hunt told the BBC that the outage reaches past lost work time. It affects things like communicating about appointments, completing purchases that need verification, and creating or accessing accounts. Former Skype and Uber engineer Gergely Orosz said it may be the "most disruptive" business email outage "of all time." That is one expert's opinion, but it is a reasonable one given that the outage had lasted more than 20 hours at the time of the BBC's report.

What Windows users and IT admins should do now​

This is general operational guidance based on what has been reported. It is not a Microsoft-issued fix.

For administrators:

• Track the official incident. Windows Central reported that Microsoft pointed admins to incident MO1550821 for a more comprehensive update in the Microsoft 365 admin center's Service health area. Microsoft also points to its public status page when the admin center itself can't be reached. The Microsoft 365 Status account on X has been posting regular updates too.
• Check your tenant, not just the headlines. Recovery differs by region and workload, so your tenant may be fine while another one isn't, or the other way round.
• Assume your security and compliance view may be limited. Defender XDR and Purview appeared on Microsoft's affected list according to XDA, and Intune according to ABC7. Keep that in mind when reading alert dashboards or compliance reports covering the outage window.
• Expect delayed mail and plan for it. Since Microsoft is still working through email queues, tell users that late messages may show up hours after access returns.
• Use your continuity plan. Switch time-sensitive communication to phone or other channels you have already approved, as Japan's government and Air India did.

For end users:

• Don't rebuild your PC. Nothing reported points to a problem with Windows devices or local data. Restarting, reinstalling Office or resetting your password won't fix a cloud-side capacity problem.
• Don't keep resending. Messages may be sitting in a queue, not lost, and sending them again could leave recipients with duplicates once the backlog clears.
• Be patient with reconnection. As Prof Ferryman explained, a flood of reconnecting devices is part of the problem. A client that keeps showing "trying to connect" is waiting on Microsoft's servers, not broken.

The bigger picture​

This incident tests the trade-off every organization makes when it moves to the cloud. Running your own Exchange servers was hard work, but at least your outages belonged to you. With Microsoft 365, the hard work goes away, and so does the ability to fix things yourself when they break.

It doesn't help that the outage ran into Friday the 13th. Is the answer to drop the cloud? For most organizations, no. But it is a good reason to make sure continuity plans assume that both email and the collaboration tools built on it can go down together.

Microsoft owes its customers a full post-incident review. Key questions include why so many servers became unavailable at once, whether a change or update set it off, as Burke's account suggests, and why the first fixes failed. Until that review is published, any claim about the root cause is speculation, including comparisons to CrowdStrike.

Bottom line: Microsoft 365 is recovering in phases, the email backlog is still being cleared, and Microsoft has not given a time for full restoration. Admins should watch incident MO1550821, keep backup communication channels ready, and wait for Microsoft's post-incident review before deciding what caused it.